Observer Analyzer : Observer Analyzer : GigaStor Control Panel : Mining data from your GigaStor : How to reorder packets based on a trailer timestamp
How to reorder packets based on a trailer timestamp
You can change how Observer filters and sorts packets in the Decode pane based on a timestamp from your switch aggregator rather when GigaStor saw the packets.
Reordering packets is limited to post capture analysis only; it does not affect real-time analysis, triggers and alarms, or trending analysis. If you save a packet capture after it has been reordered using this option, the packets are saved in the reordered series. If you load a saved, reordered packet capture, then analysis is based on the reordered time frames and not the time stamps from the GigaStor.
1. In the GigaStor Control Panel, select the time range of traffic you want to decode and click Analyze.
GigaStor Analysis Options opens with the start and end time selected.
2. Select a filter type.
3. Select Reorder and filter based on trailer timestamp and click Settings.
Trailer Timestamp Settings opens.
Figure 66: Trailer Timestamp Settings
4. In Timestamp type, choose your switch aggregator.
5. Choose what filters to apply.
The Decode pane displays packets in the sorted (and filtered) order based on your chosen switch aggregator.
Timestamp types
The Timestamp types provides a list of the supported switch aggregators that can be used to reorder packets before they are shown in the Decode pane.
Switch Aggregator
Keyframes are used to correlate packets to a physical port group. For instance, any keyframe seen on port 1 associates packets with that keyframe only with port 1. Likewise, a keyframe seen on port 2 associates the packets only to port 2, and so on. A keyframe is unique to a physical port group.
Gigamon GigaSMART
Gigamon H-Series
Network Instruments
Choose if you use Matrix.
PacketPortal PDG
VSS Monitoring
VSS Monitoring w/Port
VSS Monitoring with Port Stamping.
Trailer filters
Trailer filters allow you to exclude or include packets from your switch aggregator based on where the trailer occurs and other location-specific information.
Trailer level
Use when multiple timestamps are found in a packet to identify which timestamp to use. The levels are identified starting at the end of the packet.
Group ID
The port group ID from Matrix. You can find this ID on the Matrix in System > General > Trailer Configuration.
Box ID
The port box ID from Matrix. You can find this ID on the Matrix in System > General > Trailer Configuration.
The ingress port on the switch aggregator where the packet was seen.
Probe ID(s)
A comma separated list of hexadecimal characters from a PacketPortal IV SFProbe or JMEP. Use PacketPortal System Manager (IV SFProbe) or the SFP Programmer GUI (JMEP) to view a list of probe IDs. A sample probe ID: 5e65eb52f633.