Observer GigaStor Metadata Probes : Metadata Probes (first sold October 2020) : Getting started : Getting started using your GigaStor
Getting started using your GigaStor
 
What is the GigaStor?
Differences between GigaStor Software Edition and GigaStor
Using the GigaStor Control Panel
Non-GigaStor-specific settings
Setting the GigaStor general options
Understanding GigaStor protocol and port settings
A GigaStor probe is a hardware device with many terabytes of storage space to capture, store, and analyze your network traffic.
Prerequisite(s):  
Follow these steps to get started with your GigaStor. The installation happens in two main parts. The first part is at the GigaStor probe in the server room. The second part continues at a desk using Observer to connect to the GigaStor probe.
Before getting started with your GigaStor probe, these tasks should already be complete:
1. It has been decided where to install the GigaStor probe as discussed in Deciding where to place probes in your network
2. The GigaStor probe has been installed into a server rack. It is important to install the RAID drives into the correct slots. Ensure that monitoring interfaces are connected to the appropriate data feeds (SPAN or mirror ports, TAPs, aggregation devices). Ensure the configuration of these third-party devices is done properly so data flows to the GigaStor.
 
All GigaStor probes use the Expert Probe software. Learn more about the Expert Probe in Using the Expert Probe software.
To get the most out of your GigaStor, you need:
♦A good working knowledge of your network. You can use Observer to gather information from your routing protocols and verify your network configurations, which is helpful when updating your network map.
♦An understanding of the protocols that run on your network.
♦An understanding of probe instances and why you want to use them. In particular, a GigaStor is heavily reliant on a unique probe instance called an active instance. See What is a probe instance?.
To get started with your GigaStor probe:
1. By default the GigaStor probe’s name is a random mix of letters and numbers. Change the name of the GigaStor probe to something identifiable (such as the physical location or purpose). See Configuring a probe’s name and other probe options.
In a typical installation, the GigaStor probe runs the Expert Probe software as a Windows service and a remote Observer connects to the GigaStor probe to complete the configuration.
From the Observer system, complete the following steps. These steps requires that you have an Observer installed and licensed separate from the GigaStor probe.
2. Connect to the GigaStor probe from your Observer. See Connecting to a probe instance from an Observer Analyzer.
3. By default the active instance is called Instance 1 and there are no passive instances. Rename the active instance to something more meaningful (for instance, Active Instance) and create at least two passive instances. (You can create more passive instances later if you wish.) Although you renamed the GigaStor probe in step 1, renaming the probe instance is different. For details, see Creating a probe instance. Pay attention to the special instructions if your GigaStor array is larger than 256 TB.
5. To capture network traffic, you must have the GigaStor capture running. See Configuring probes to collect data even when not connected to an analyzer.
The purpose of a GigaStor probe is to capture and store large amounts of data. By default the GigaStor is not set to capture any data. It must be enabled.
6. Using a passive probe instance, begin analyzing the traffic you are capturing. See Using the GigaStor Control Panel.
After you have collected data, you will want to see what is happening on your network.
●.
●.
●.
●.
Although not a complete list, these are common optional settings you may want to change. Use these options along with the rest of the information in Using the GigaStor Control Panel to fine-tune your GigaStor.
7. If you want to track physical ports individually, ensure you enable Track statistics information per physical port. See Setting the GigaStor general options.
Tip! All GigaStor probes come with a capture card. Details about this unique capture card, including physical port indexing or virtual adapters, is covered in Hardware configuration .
8. If you want to define the different subnets of your network so that GigaStor can track and report on them, see Defining subnets in your GigaStor.
9. Your reports and displays may be more complete and readable if you add devices to the GigaStor probe’s address book and define any custom applications to the list maintained by the probe.
10. The default settings for Observer is to be unaware of TCP connections that were opened after the GigaStor or packet capture started. You can change this default setting by doing the following:
a. Mine some data from the GigaStor by following .
This opens the Decode and Analysis tab.
b. Ensure the Expert Analysis tab is selected, and click the Settings button at the top.
The Expert Global Settings window appears.
c. Click the TCP/IP tab and clear the Follow only newly opened TCP connections.
A newly opened TCP connection is any connection established after Expert Analysis was started. If the conversation started before Expert Analysis was started, Observer cannot see it.
 
By following the steps, you successfully configured the GigaStor probe to collect network traffic. You also made some configuration changes that help the GigaStor probe work well in your network. Also, you mined data from the GigaStor probe.