Launched in November, the eleventh version of Network Instruments (NI)’s popular Observer packet-analysis package offers improvements for voice over IP (VoIP) management. This could attract many firms, as converged voice and data networks and applications are now being used in significant numbers. And firms can also run Observer 11 on 64bit systems as a native 64bit application.

At first glance, new users may be put off by the system’s apparent complexity, but difficult tasks can be accomplished simply with a few mouse clicks.

Observer 11 is as yet a Windows-only application. We installed the basic package on Windows 2000 Professional and XP systems and initially examined local network traffic. Large firms, however, will require a “distributed” packet-capture system capable of examining full duplex data normally available through a switch “span” or mirrored port. This would usually be achieved by deploying a probes on a systems linked to such ports.

VoIP analysis through NI’s VoIP Expert was simple to run. We could start a packet capture while making a call over a VoIP link and see in real time how much jitter and bandwidth the call was using.

VoIP Expert also shows an absolute value of jitter in milliseconds, the number of lost packets, bandwidth used, call setup duration and further information about the codecs used by the method of IP call. VoIP Expert also outputs two measures of call quality: mean opinion score (MOS) and a scalar quantity called the R-factor.

A feature which could be important for network administrators is the time-based navigation forensics option, which allows real-time traffic analysis. Firms wanting to analyse large packet capture datasets can buy an appliance designed for the task. This kit is called the GigaStor and can capture to disk at wire speed up to 8TB of data, which can then be processed and analysed remotely and the results sent, for example, to a central laptop console.

Another major feature is multihop analysis, which lets firms track up to 10 conversation or transaction hops on WAN links, as well as wireless and Gigabit Ethernet traffic. This is useful to find network choke points and to provide data to verify any third-party service-level agreements firms may have.

Observer 11 now also decodes Citrix network streams, offers better network trending facilities for virtual LANs and wireless LANs, and can use Perl-based filtering scripts to target specific network traffic.

Like rival WildPackets Omni 3, NI Observer 11 captures network traffic data through a Network Driver Interface Specification (NDIS)-driven Ethernet link. Capturing network traffic through USB modems is not possible. But we could use the open-source Ethereal program to save packet captures in NI Observer 9 or tcpdump format, which Observer 11 could import. For example, we could import packet captures taken during VoIP calls which could be analysed in Observer 11 to show VoIP call R-factor and MOS ratings, as well as call setup time and the codecs used during the call.