If you expect to be capturing vast amounts of network data then consider the Observer GigaStor, which is a separate rack mount storage device dedicated to Observer and accessed remotely from its main interface. The price tag indicates this is aimed firmly at enterprises with the 2TB version costing a hefty 14,450.
However, whichever method used, you'll find Observer's decoding capabilities are of Bletchley Park quality. The Expert Analysis shows utilisation during the capture period, a summary of detected error conditions and an analysis of each one along with suggestions for remedial actions.
Packet decoding is very intuitive and the Expert Analysis makes light work of understanding the information presented.
From the same tab you have a range of events such as TCP, NetBIOS and UDP and the Expert will give its prognosis on each one. For each capture session, you can see who the top talkers were, what the protocol distribution was and much more.
From the TCP option you can select a line of data and call up Observer's slick stream reconstruction feature. For web browsing it'll show you the sites visited and associated IP address pairs for the source and destination. Any files downloaded can be viewed and email reconstruction extends to revealing the contents of a selected message along with the sender and recipient plus the option to view any attachments.
The separate web console provides access to baselining tools and complete reports on server and application performance.
The VoIP functions are particularly impressive as Observer has tools specifically for handling H.323 and SIP traffic. VoIP is included in the packet decoder. This provides a full summary along with jitter and lost packets plus wise words in the panel below from the Expert if it detected a problem.
We tested using SIP and liked the feature that enabled us to view all VoIP calls made and see the phone numbers of the caller and the recipient, the call start time and the duration. Observer can rate VoIP calls for quality by calculating a MOS (mean opinion score) from the dropped packets and jitter, which is a prediction of how a real user would rate the call.
