299-01 Questions and Answers

By setting intelligent static thresholds for Application metrics and Interface metrics, tolerance can be determined. Cascade will use these thresholds and tolerances to report on deviations indicative of performance problems.

The Customer only needs to identify their critical hosts, interfaces and/or applications, and Cascade will automatically baseline their behavior and report on deviations indicative of performance problems.

The Performance Analytics use knowledge of hosts, interfaces, and/or applications are able to detect security threats such as host scans and worms.

After baselining is completed, Cascade can re-route congested traffic to avoid congested application delivery paths.

200,000 flows per minute per port

300,000 flows per minute per port

500,000 flows per minute per port

500,000 flows per minute total

600,000 flows per minute total

Active Directory information for successful/failed login association to IPs

DHCP for host IP to MAC address association.

SNMP polling to routers, switches, and servers for CPU information.

SNMP trap data from routers, switches, and servers for security events.

SNMP polling to routers and switches for MAC address and physical switch port association.

http://10.1.1.1

https://10.1.1.1

https://10.1.1.1:443

https://10.1.1.1:8080

http://10.1.1.1:8080

Use a BPF filter to speed up the View.

Apply a generic View and then define a filter by drilling-down through a more specific View.

Use a Cascade Pilot filter first and then a BPF filter.

Create a time filter and then apply a View with a Cascade Pilot filter.

Packets can be captured from multiple capture ports on one Cascade Shark appliance.

The maximum length the packet data can be specified.

Packets can be filtered on host IP addresses.

SSL traffic can be decoded if the appropriate certificate are loaded in the Cascade Shark appliance.

The maximum storage bandwidth for the job can be specified in bits/sec.

Multiple packet capture jobs can run concurrently.

Watched list as a bar chart

Watched list as a stacked area chart

Watched list as a line graph

Watched list as a pie chart

Top list as a bar chart

Network Round Trip measurement

Packet logging

Server Delay measurement

Connection Throughput measurement

Retransmission measurement

L7 application fingerprint checking

The time span of the report does not cover any connection set-up points

Server delay is zero.

The protocol used by the application in not TCP-based.

Application traffic was not seen by a Cascade Sensor.

The server plug-in is needed to measure "Server Delay" and not functioning correctly.

SNMP polling from the Gateway

SNMP polling from the Profiler

SYSLOG

All of the above

None of the above

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

5

20

15

10

Unlimited

Traps sent via NetFlow, sFlow, or IPFX

Alerts sent via eMail

Traps sent via SNMP

Traps sent via SPAN

Traps sent via FIX Protocol

Traffic between Virtual machines is not switched; it is routed by the standard vRouter included with ESXi

A standard or distributed vSwitch which comes with ESXi must be used, there is not 3rd party software available

A 3rd party virtual switch is required such as the CISCO Nexus 1000v as no standard vSwitch exists with ESXi

The included standard vSwitch of the CISCO Nexus 7000

The included standard vSwitch or the CISCO Nexus 1000v

Is either a BPF or Wireshark Display filter only.

Can be created from a chart.

Can be changed after applying a View.

Is the equivalent of the Wireshark "display filter input".

192.168.1.120 is not in the 192.168.1.0/25 subnet

192.168.1.120 has been input as a trusted host in a security policy

Traffic to 192.168.1.120 was not picked up by a Sensor

Traffic to 192.168.1.120 was not picked up by a Gateway

192.168.1.120 never sent any traffic

The correct communication port(s) are NOT open on the firewall between Cascade Pilot and Cascade Shark.

The Cascade Shark is placed in "passthru" mode so Cascade Pilot access is not available

The Cascade Shark appliance has no capture jobs configured.

You may be running Cascade Pilot-Personal-Edition (PE). You need the full version of Cascade Pilot to connect to Cascade Shark.

Trend/Index data is disabled on the Cascade Shark Appliance.

Stratified policy limits ranging from 5000 for Cascade Profiler Express platforms to 10,000 for Cascade Enterprise Profiler platforms

5,000 for all platforms

15,000 for all platforms

The Analytics license provides for an unlimited number of policies

None of the above

Changes are saved only in the View to which the filter has been applied.

The modified filter is saved on the machine on which Cascade Pilot is running.

The modified filter is saved on any Cascade Shark that Cascade Pilot is connected to.

The changes are lost when you close Cascade Pilot.

Copy the file onto a Cascade Shark to ensure better performance.

Create an index so that processing of the View analytics will be faster.

Apply a View with a specific filter.

Use Wireshark tools to split the trace file in multiple and smaller trace files.

They appear in the my-views main directory.

Views that take advantage of the trending/indexing data load faster.

The file icon includes a colored-lightning bolt.

The file loads faster into Wireshark.

Additional pre-defined filters and watches are available.

Manually configure the interface speeds on the Devices/Interfaces page.

Configure and enable SNMP access to the reporting devices on the Devices/Interfaces page.

Enable NBAR on the routers.

Check the "Interface Utilization" box under the Devices/Interfaces page for each router and/or Steelhead desired.

Configure the appropriate Device Interface Analytic.

Wireshark display filter

BPF

Cascade Pilot Filter

Cascade-Scripting filter

IP chains filter

System Information > Devices/Interfaces

System Information > Profiler

Dashboard

Log in to the shell and view the /usr/mazu/var/log/Sensor.log

Ping devices on UDP port 2055 to see if they are up and running

Connect a cross-over cable from your laptop to the Ethernet management port and connect through the Web browser to the default IP Address of 192.168.1.10.

Connect a cross-over cable from your laptop to the Auxiliary Ethernet port and connect through the Web browser to the default IP Address of 192.168.1.10.

Connect by KVM or Serial Console and run the command line tool, sa_wizard, to perform the initial configuration.

Connect to the appliance using the Riverbed Central Management Console (CMC) on its default IP Address and perform the initial configuration.

An ACL might exist on the flow source (router) and the Cascade Standard Profiler IP address is not in it.

SNMP is not enabled.

The correct IP address of the flow source was not entered into the GUI.

The SNMP read string provided and entered might not be correct.

The flow source is not using the same NTP source as the Cascade Gateway.

No.

Yes, you can do this with the "ARIN" lookup in "external links". The customer can also add additional external links if they have other sites they use to look up IP Addresses.

This is available as a column in any report that displays the IP Address.

This is available under IP Host Group Type.

SNMP to send traps to trap receivers.

SNMP to discover switch ports associated with IP addresses.

SNMP to discover router interface capacities.

SNMP to discover router CPU utilization.

Enabled

Disabled

Set to retain up to 1 week or 10GB of indexing/trending data

Set to retain up to 1 week or 10GB of packets

Set to keep the indexing/trending data indefinitely

SNMP based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

NetFlow based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

NetFlow based technology does NOT typically include response time information, packet inspection is necessary to measure response times

It is NOT possible to understand which conversations traversed a link without full packet capture

SNMP based technology querying routers in the network can be used to view end to end conversations across a network to determine top talkers

Lock the trace clip.

Send the trace clip packets to file.

Detach the trace clip from the capture job trace.

A and B

A, B, and C.