Previous Topic: Filter NetworksNext Topic: Define a Server


Filter Servers

A server is a computer on the network that responds to client TCP requests. The Configuration Utility detects the SYN-ACK packet and automatically displays the corresponding server in the Detected Servers pane.

We recommend defining server subnets to monitor server traffic.

Sort the list by clicking a column header:

Bytes To and Bytes From, and Packets To and Packets From

Identifies servers with the most traffic. As a best practice, we recommend monitoring the applications on your busiest servers. If the Bytes From or Bytes To column is 0, this can indicate a problem with how the TCP packets are mirrored to the monitoring device.

VLAN

Identifies tagged server VLAN traffic.

When filtering for tagged VLAN traffic, set the Group By Mask for the Server Filter to a server subnet that corresponds to a particular VLAN. Or, set the Group By Mask to Server (/32) to display all tagged VLAN traffic.

TTL

Indicates observed Time to Live (TTL) values from the server to the client. In an ideal configuration, monitored servers are spanned directly to the monitorand this value should be a default, undecremented TTL value. 128 and 64 are common TTL values for Windows and UNIX servers, respectively.

If the TTL is not a default value, the difference between the default and the value is the number of network hops between the server and the spanned switch. As a best practice, we recommend monitoring the servers that are closest to the spanned switch. Use the Time to Live (TTL) column to find interesting candidates to monitor.

Maximum IPs/Mac and Group By Mask

Refines the filter results. Set to All to see all servers in the SPAN, and look for servers with a low ratio of IP addresses per MAC address.

Use filtering to find a server of interest:

Server filter

Lists the client networks that access the server, and which application ports are accessed. For example, applying a Server filter to a server adds the server to the Server Filter criteria and displays a list of associated application ports and client networks.

With a VLAN based SPAN (VSPAN), use the VLAN column to find the servers in the SPAN or filter with a server subnet mask that corresponds to the VLAN with the server traffic you want. For example, add a Server filter, 192.168.0.0/16, to see all servers and applications on that subnet.

Network filter

Indicates whether the server acts as a client to another server, and on which ports. Keep in mind that to monitor multi-tier applications, CA ADA automatically creates a /32 network for each server definition. For example, applying a Network filter to a server adds the server to the Network Filter criteria and displays a list of associated servers and application ports. This filter is useful for discovering a multi-tier application.

Group matching networks by selecting the mask you want from the Group By Mask list.

Follow these steps:

  1. In the Detected Servers pane, right-click a server and click Apply description (port) as Server Filter or Apply description (port) as Network Filter.

    If you want to filter a server by a range of IPs or a subnet, type the IP range or subnet in the Server Filter detection criteria field and press Enter.

  2. (Optional) Add the server or network definition to CA ADA.

More information:

Filter Criteria

Define a Server

Define a Network