Network Instruments® | Comprehensive Forensics

Observer | Observer Standard | Observer Expert | Observer Suite | Observer Reporting Server

Is it the network? Is it the application? Is it security? When troubleshooting enterprise-level networks, engineers from security and network teams often do not have the visibility required to quickly isolate and resolve issues.This results in time wasted by attempting to replicate the network issue or arguing with other network teams over the cause.

The Network Instruments GigaStor™ Forensics allows managers through retrospective network analysis to quickly diagnose and resolve network problems. GigaStor operates like a security camera, recording everything traversing the network and storing terabytes of packet-level data for future network forensics analysis. Upon learning of a problem, the network manager can isolate the time period around the event and replay and review all network activities.

Retrospective Network Analysis
With the GigaStor everything is captured—every transaction, every packet, every protocol. And it’s captured for hours, days, weeks, and sometimes months. GigaStor can then quickly search through the massive amounts of traffic to find the specific policy violation, performance issue, or anomalous traffic causing the network degradation. With the retrospective analysis solution in place, network engineers no longer spend time attempting to replicate sporadic network issues, which dramatically speeds time to resolution. Learn More.

Network Forensics
With over 590 protocols decoded and 570 Experts, Observer allows network managers to quickly isolate and identify network and application performance issues. Experts go beyond simple network statistics by identifying problems and providing potential solutions. Experts predict network bandwidth and response-time impacts; track and solve application problems; view application session flows graphically, reconstruct data packets, and isolate transaction delay.

Application Forensics
Go back in time and track application communications to pinpoint problems using Observer’s Application Analysis. Obtain statistics on errors, review application response time, and obtain in-depth application performance analysis.

See a list of supported applications:

SQL (TDS)
Oracle (TNS)
MS Networking (SMB) [new]
VoIP
DNS
FTP
HTTP
POP3
Telnet
SMTP
SNMP
Exchange
Citrix

Security Forensics
GigaStor Security Forensics determines whether a security breach occurred by comparing historical traffic against a list of thousands of Snort rules to identify known network attacks and anomalies. If a breach is identified, GigaStor provides drill-down analysis to determine the source and time of the occurrence.

Drill down for packet-level forensic analysis
Identify compromised machines and network infrastructure
Validate and provide evidence for compliance and security issues
View security and access violations in context of what else was happening on the network

Network Security Surveillance
GigaStor Security Forensics complements your existing IPS / IDS solution by providing a complete view of any unauthorized access attempts or network attacks. Your traditional IDS will only let you know an attack or hacking script was identified on your network. GigaStor provides more in-depth information, such as letting you identify the infected laptop that connected to the network minutes before the attack. Unique to the GigaStor is the ability to identify previously unknown “zero-day” attacks by comparing the historical traffic to new Snort signatures as they become available after network attacks.

Compliance and Security Investigations
GigaStor plays a significant role in data mining, network forensics, and data-retention compliance. It provides a separate, unaltered, and recorded view of all network traffic and activity that can be played back to investigate and verify connections and transactions exactly as they happened. In addition, GigaStor not only shows communications that occurred, but it can reconstruct the mined data – providing hard evidence such as VoIP phone conversations, web pages, documents, instant messages, and e-mails.