Network Time Machine™

The Network Time Machine is an all-in-one solution for back-in-time root cause analysis of network and application problems. The innovative Performance Bottleneck Analysis (PBA) visually identifies the fault domain to the server or the network. Application-centric analysis finds problems without needing to look at packets. Advanced data mining quickly pinpoints the relevant packets in multiple terabytes of captured data.

These time-saving analytics are integrated into a single appliance, reducing initial expense, set-up time and ongoing maintenance. NTM’s plug-and-play operation automatically identifies applications, analyzes their performance, and displays relevant statistics in user-configurable dashboards. You won’t miss a key event with the NTM’s independently verified 100% packet capture at on multiple 10/100 Mbps, 1 Gbps and 10 Gbps Ethernet interfaces at rates exceeding 10Gbps with multiple terabytes of RAID storage.

The NTM automatically discovers applications and reports performance trending metrics by server, network and client site. The unique Performance Bottleneck Analysis (PBA) displays server, network and client site time for each TCP flow. PBA metrics show where application time is spent, immediately identifying the root cause of application performance complaints.

In addition, the NTM also shows how related performance metrics change over time, allowing identification of the fault domain to a specific server, or network. The packet extraction process is integrated with the UI so that the set of flows exhibiting the problem can be quickly analyzed.

Once the relevant packets are extracted, the NTM guides users from application to flow to transaction view using an intuitive drill down process. Bounce charts give a clear indication of how transactions transverse over time and indicate problem packets without going into decode view. The result is increased operational efficiencies through a reduced learning curve, shorter time to domain isolation and quicker root cause resolution.

Fluke Networks’ Performance Bottleneck Analysis (PBA) is based on a patent-pending algorithm in which the analyzer isolates the time that a flow spends with the Server, Network and Client. The algorithm requires one measurement point in the network near the end-point, such as the Server or Client. This speeds troubleshooting time as it does not require measurement at two locations to determine change in network latency.

• The PBA function shows the average time application flows (for example, SMTP and HTTP) spent on server, network and client. Trend graphs indicate a sudden change in time spent on server or network during the analysis period.
• Once the fault domain is identified, detailed metrics can be used to isolate the root cause. The NTM automatically tracks key performance indicators such as server connections, TCP resets from servers, or retransmissions to understand the exact cause of performance issues.

The NTM uses stream-to-disk technology to record all network traffic up to full 10Gbps line rate so you don’t miss any critical events. All Network Time Machine products come with multiple, high-performance interfaces with multiple platform choices.

The NTM integrates the powerful application-centric analysis engine based on the award-winning ClearSight™ Analyzer (CSA) which provides automatic application analysis. For each application flow, the CSA can automatically construct bounce charts and notes with highlighted text and color codes to indicate application impairments, such as slow TCP sever response, and error status. In addition, CSA supports multi-segment analysis so you can quickly analyze flows that span across multiple tiers of servers or network segments. This powerful capability visually identifies problems in timing, command/response and TCP level impairments such as lost packets or out-of-order sequence. Perform in-depth analysis of the most commonly used applications such as SQL, Oracle, MS Networking (SMB), VoIP, DNS, FTP, HTTP, POP3, Telnet, SMTP, SNMP, MS Exchange, and Citrix. CSA also supports WireShark® decodes, providing visibility into an even wider range of applications.

The NTM is application and server aware. It offers a high-level dashboard view of applications, servers and sites. This single screen provides a visual representation of key performance indicators such as data volume by application, network latency by site, and connections by server. While the NTM continuously discovers and logs the performance of each application server, users can easily select and show the KPIs that are of interest with one click, making it easy to compare performance between servers supporting the same application. In addition, users can define thresholds and alarms for analyzed performance metrics. This speeds the detection of recurring problems by proactively monitoring key metrics for the applications of interest:

• Servers take too long to render data for application transaction
• Excessive number of connections to a server by application
• Excessive network latency to a branch office
• Excessive retransmissions by site or server

A key feature the NTM platform is the ability to quickly identify the packets that are related to the event of interest through the use of an advanced indexing and classification engine. In its heart is a powerful Relational Database Management System (RDMS) which crunches and makes sense of volumes (many terabytes worth) of network data in near real time.
The NTM interface uses the information to create unique views that are critically valuable to assist network engineers and administrators to proactively manage and service their networks. These views are shown in an intuitive workspace where relevant information is easily accessible with a few mouse clicks.
The framework provides an extremely intuitive method of troubleshooting networks, and represents a revolutionary new way to manage and service your network. Four main upper layer application types are supported with detailed analysis: HTTP, H.323, SIP, and RTP. Flow-based information on the Transport and Network Layer are also easily accessible so users can extract the flows or packet of interest for root cause analysis.

Each Network Time Machine (NTM) is equipped with a high performance FPGA-based capture card, supporting 1 Gbps or 10 Gbps with multiple interfaces.  All capture cards have built-in hardware filters and DLL error detection capabilities. NTM can be connected to the network through SPAN ports or any of the large array of inline, aggregation or switching Taps available from Fluke Networks.  Together with its high performance stream-to-disk functionality - up to 10 Gbps, the NTM provides you with the peace of mind that you will not miss a critical event on your critical links.

• Suitable for monitoring at critical network consolidation point: load-balancers, data center ingress or egress, Gigabit Ethernet Channel, and core switches.

•  

  When NTM is connected to multiple links or with multiple NTM’s deployed, it has the ability to synchronize, merge and analyze flow data collected from different locations and provides a multi-segment bounce chart with timing error detection. Root cause issues such as dropped packets or abnormal network latency as packets transverse across the network can be quickly isolated and identified.
• VoIP traffic that involves a different signal path for signal and voice stream is automatically correlated and displays as a multi-segment bounce chart for quick resolution of dropped packet, latency or connection issues.

  

The NTM provides real-time or post-capture VoIP and video quality assessment with extensive QoS, call type and codec analysis for all SIP or H.323 calls.  Quality parameters including packet loss, jitter, R-value, can be displayed or combined into MOS and R-factor for voice or VQFactor™ for a video stream.  Generate a QoS report for a VoIP call simply by selecting the desired call and clicking the “report” tab.  Call setup problems, such as can’t connect or busy, are shown without the need to decode packets. Playback the call or video to see the actual problem.

High performance stream-to-disk captures packet and payload for long term storage for tracing of abnormal user behavior. Advanced filters aid in the extraction of traffic to see user patterns, a server susceptible to tampering, and compliance and security violations.

ClearSight Analyzer can provide detailed analysis showing where and how the issue occurred. FTP, Messaging, Email, Video or Voice calls can be played back in ClearSight Analyzer to quickly extract evidence required for action.

Reconstruct email	Reconstruct messaging

Portable Network Time Machine Units

Portable Network Time Machine Units Deploy quickly to solve application and network performance problems - wherever the location might be. Plug and play real-time monitoring and network forensic analysis capability. ClearSight Analyzer is embedded for on-board or remote-controlled application-centric analysis. Onboard problem identification and multi-segment transactional analysis for quick network and application problem isolation. Large LCD display, with keyboard and mouse for onsite operation. Remote Agent Viewer option supports up to 3 concurrent remote agent viewers for collaborative analysis with remote colleagues.

NTM Portable1A		NTM Portable 2
Lightweight and economical Portable1A unit supports four 1 Gbps monitoring ports with 2 Gbps stream-to-disk performance and 1.4 Terabytes of storage		Powerful Portable2 unit supports either four 1 Gbps or two 10 Gbps monitoring ports with 3 Gbps stream-to-disk performance and 1.7 Terabytes of storage

Three appliance configurations to choose from for data center, LAN consolidation points and branch office link monitoring and analysis. High performance, custom NIC and RAID-based stream-to-disk functionality that doesn't miss key events. Premium3 and Standard3 EA features a dual RAID5 controller for hot-swappable disk arrays and disk-fail redundancy. ClearSight Analyzer embedded for on-board application-centric analysis - so there's no need to extract data out of the NTM for analysis. Onboard problem identification and multi-segment transactional analysis for quick network and application problem isolation.

NTM Express 1U with 1TB storage Post-Capture Atlas Analysis and Remote Agent Manager built-in

NTM Standard 2U and field-upgrade from 4TB to 8TB available Remote Agent Manager and 3 concurrent remote agent viewer built-in

NTM Standard Extended/ Premium 4U and 2 additional 2U disk-arrays can be added. Remote Agent Manager and 3 concurrent remote agent viewer built-in