201-01 Sample Questions & Answers

Host Groups aggregate IP addresses into logical containers, which is essential for reporting on the traffic patterns of entire departments, server farms, or branch offices as a single entity.

Using logical names for Host Groups in service definitions, report filters, and policies makes the configuration more readable, manageable, and less prone to error than maintaining long, static lists of IP addresses.

The diagram clearly shows the breakdown of time spent in each segment. The Network RTT between the Application Server and the Database server is 150ms, which is the largest single component of delay. This indicates that the most significant bottleneck is the network segment connecting these two tiers.

SteelCentral Portal uses widgets as the building blocks for dashboards. Each widget is designed to pull specific data from a configured data source (like NetProfiler or AppResponse). To create the desired view, the administrator would create a new dashboard and then add the appropriate 'Top N Applications' widget from the NetProfiler data source and the 'Top N Web Applications' widget from the AppResponse data source.

A 'Transaction' model in Transaction Analyzer is used to stitch together individual packet traces from different tiers (e.g., web, application, database) into a single, cohesive end-to-end view. This allows an analyst to visualize the message flow, identify which tier introduces the most latency, and understand the complete response time breakdown for a user's action.

The distributed architecture of NetProfiler Enterprise is designed for scalability. By separating the database, application processing, and web interface onto dedicated servers, each component can be scaled independently to handle very high flow volumes (millions of flows per minute) and store massive amounts of historical data, which is common in large enterprise or service provider networks.

The Expert System in Packet Analyzer automatically analyzes trace files for common problems. The 'Expert Events' view provides a categorized summary of all detected issues, including a specific category for TCP retransmissions. This allows the engineer to instantly see all affected conversations without needing to manually create filters or inspect each stream individually, making it the most efficient method.

A Host Group is needed to define the scope of 'any single host inside the network' that the policy will monitor.

A Service is required to define the traffic of interest, specifically from the internal Host Group to any external address. This allows the policy to focus only on data leaving the network.

The Policy is the core component that ties everything together. It will use the Host Group and Service to specify what to monitor and then apply a threshold (1 GB) to the 'Total Bytes' metric over the specified time window (1 hour) to trigger an alert.

This is the fundamental difference. A capture filter (e.g., BPF syntax) is applied before data is written, preventing unwanted packets from ever being stored. This is a destructive action in that the filtered-out packets are lost forever. A display filter (e.g., Wireshark syntax) is non-destructive and is applied to an existing trace file to temporarily hide or show packets in the user interface for easier analysis.

'Retransmission Delay' is a network-related metric that quantifies the impact of packet loss. It measures the time elapsed from when a TCP segment was first sent to when its retransmission was sent, indicating that the original packet was lost or corrupted in transit. A high value in this metric points directly to a network quality issue (congestion, faulty hardware, etc.) as the source of the slowness.

This statement is true. A key capability of NetShark is its ability to serve multiple purposes. It can perform continuous packet capture, allowing analysts to pull specific trace files into Packet Analyzer for investigation. At the same time, it can generate flow records (often called 'Enhanced Flows' or 'Packet-derived Flows') from the captured traffic and export them to NetProfiler, enriching NetProfiler's visibility without requiring separate flow sources.