Observer Analyzer : Observer Analyzer : Expert Analysis : Preparing expert decoding techniques
Preparing expert decoding techniques
Real-Time Expert is the collection of tools in Observer that help you identify network problems and determine a course of action; these tools provide expert decoding techniques.
With Real-Time Expert, you can obtain post-capture expert event identification, explore expert analysis, reconstruct TCP streams, and model network traffic.
There are several ways to approach a network problem with Real-Time Expert. As with any network problem, you should first determine if you can reproduce the problem. If you can reproduce the problem, set up a capture to collect data for the entire event (start to finish) and then use the Expert in post-capture mode to identify possible causes of the event. Otherwise, begin using Real-Time Expert while a packet capture is running—this is real-time mode.
 
 
Figure 31: The Real-Time Expert user interface
 
To begin using Real-Time Expert and its advanced decoding techniques, you must first configure the Expert system; this is a two-step process, which is described in these sections:
Follow the configuration steps described in each section. When both steps are complete, you can begin using Real-Time Expert with confidence in its results.