TCP Flow Analyzer

TCP Flow Analyzer is the layer version of TCP Flow Monitor. It can be attached to Pcap Sniffer or Ethernet Tap to convert low-level packet views into high-level data flow representations.

Capabilities

Required

com.ioninja.layer

Required for attaching layers to sessions or logs.

Basic Setup

  1. In a Pcap Sniffer or Ethernet Tap session, attach the TCP Flow Analyzer layer.

_images/tcp-flow-analyzer-attach.png

  1. Analyze Pcap Sniffer or Ethernet Tap logs as if they were TCP Proxy or TCP Server session logs.

_images/tcp-flow-analyzer-analyze.png

  1. Adjust settings as needed via the “Settings” button (see “Settings” section below for details).

Settings

_images/tcp-flow-analyzer-settings.png

Setting

Description

Default

View filter

Term to filter with when displaying packets.

IP fragment limit

The maximum number of IP fragments. IP fragments refer to the pieces of a larger IP packet that has been broken up for transmission across a network.

8

IP fragment timeout (ms)

The maximum delay between IP fragments.

10000

TCP out-of-seq limit

Maximum number of out-of-order TCP segments.

8

See Also