Version 3.2 of Performance Vision introduces new features for CIFS transaction analysis including performance monitoring, troubleshooting tools, and detailed metrics for clients, servers, files, and users. Enhancements include improved LDAP integration, better query multithreading for faster response times, and a new user-friendly interface for refined searches. Significant updates focus on improved data merging and the ability to switch between TCP flows and CIFS transactions seamlessly.

1. WHAT’S NEW
IN VERSION 3.2?
© SecurActive 2014

2. PERFORMANCE VISION VERSION 3.2
CIFS Transaction Analysis
New Features & Improvements
© SecurActive 2014

3. Performance
Vision 3.2
CIFS/SMB
TRANSACTION ANALYSIS
© SecurActive 2014

4. CIFS TRANSACTION ANALYSIS: USER BENEFITS
Monitor CIFS/SMB Performance
Troubleshoot File Sharing Issues
Access Rights Deleted or Corrupted Files Insufficient Resources All Errors and Warnings
© SecurActive 2014
Identify Slow Transactions
Correlate File Sharing Problems with Network Performance Issues

5. IN-DEPTH CIFS/SMB PERFORMANCE ANALYSIS
© SecurActive 2014
CIFS/SMB in APS
Supported CIFS/SMB versions
 SMB 1.0
 SMB 2.0
 SMB 3.0 (no encryption)

6. CIFS OVERVIEW
Overview of CIFS Commands
© SecurActive 2014 6

7. OVERVIEW OF CIFS COMMANDS
Display CIFS Overview per Command type:
 Number of Queries
 Number of Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payload and Number of Packets (PDUs)
One-click drill down to more details
© SecurActive 2014

8. CIFS PERFORMANCE
Performance of CIFS Queries over Time
© SecurActive 2014 8

9. PERFORMANCE OF CIFS QUERIES OVER TIME
Display CIFS Performance metrics over time:
 Data Transfer Time and Server Response Time
 Number of OKs, Warnings and Errors
 Payload for Queries, Responses and Metadata
One-click drill down to more details
© SecurActive 2014

10. CIFS CLIENTS
CIFS Most Active Clients
© SecurActive 2014 10

11. CIFS MOST ACTIVE CLIENTS
Display CIFS metrics for the most active clients:
 Client IP
 Number of Queries, Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payloads and Number of Packets (PDUs)
One-click drill down to queries and errors
© SecurActive 2014

12. CIFS SERVERS
CIFS Most Active Servers
© SecurActive 2014 12

13. CIFS MOST ACTIVE SERVERS
Display CIFS metrics for the most active servers:
 Server IP
 Number of Queries, Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payloads and Number of Packets (PDUs)
One-click drill down to queries and errors
© SecurActive 2014

14. CIFS FILES
CIFS Most Active Files
© SecurActive 2014 14

15. CIFS TOP FILES
Display queries aggregated by Files:
 File Path
 Number of Queries, Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payloads and Number of Packets (PDUs)
One-click drill down to queries and errors
© SecurActive 2014

16. CIFS TREES
CIFS Most Active Trees
© SecurActive 2014 16

17. CIFS TOP TREES
Display queries aggregated by Trees:
 Tree Path
 Number of Queries, Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payloads and Number of Packets (PDUs)
One-click drill down to queries and errors
© SecurActive 2014

18. DIFFERENCE BETWEEN TREE AND FILE
© SecurActive 2014
Tree (Mount
Point)
WINSHARE
DATA
WINSHARE USR
File
Private Users UC576 mailbox.pst

19. CIFS USERS
CIFS Most Active Users
© SecurActive 2014 19

20. CIFS TOP USERS
Display queries aggregated by Users:
 Username
 Number of Queries, Errors and Warnings
 Performance Metrics (SRT, DTT)
 Payloads and Number of Packets (PDUs)
One-click drill down to queries and errors
© SecurActive 2014

21. USER NOT ALWAYS AVAILABLE?
© SecurActive 2014
Why is the User not always available?
 Secured authentication (Kerberos)
 Potentially unsupported authentication
mechanism
 Session initialization has not been captured

22. CIFS QUERIES
List of CIFS Queries
© SecurActive 2014 22

23. CIFS QUERIES
Available CIFS Data
© SecurActive 2014
 Command, Subcommand and Status
 File ID and Path
 Number of Queries, Errors & Warnings
 Performance Metrics (SRT, DTT)
 Username
 Domain name
 Tree ID and Tree name
 Data Payload: Reads, Writes
 Metadata Payload: Reads, Writes
 Number of Packets (PDUs)

24. CIFS RAW DATA
Details of all CIFS Transactions
© SecurActive 2014 24

25. CIFS RAW DATA: TRUE ROOT CAUSE ANALYSIS
© SecurActive 2014
CIFS transactions without any grouping
 Useful for advanced troubleshooting
 Application behavior auditing
Queries
Raw Data

26. USER FRIENDLY ROOT CAUSE ANALYSIS
© SecurActive 2014
User-friendly interface
 Color highlighting for readability
 One-click filtering facility
 Inline CIFS protocol help
 Resizable textboxes

27. CIFS DEDICATED FILTERS
© SecurActive 2014
Dedicated CIFS filters:
Refine search for specific issues
Search results by:
 Port number
 Command type
 Status name
 Path name and File ID
 Subcommand type
 Tree name and Tree ID
 User and Domain

28. SEARCH FOR SPECIFIC CIFS ELEMENTS
CIFS Commands, Statuses and Subcommands organized into Categories
Type text to automatically refine the list of available
options
© SecurActive 2014

29. EASY DRILL-DOWN
 One click to see Performance over time for these CIFS Transactions
 One click drill-down to CIFS Queries or Raw data
 One click drill-down to Flow Details associated to these Transactions
One click drill-down to CIFS Errors or Warnings
© SecurActive 2014

30. FOR POWER USERS: CUSTOM FILTERS FOR CIFS
© SecurActive 2014
Custom Filters for CIFS
 Used to build advanced queries
 See Custom Filters reference in
Guide

31. FAST ANALYSIS: CIFS COMMON STATUSES
© SecurActive 2014
Common Statuses for CIFS:
 STATUS_NO_SUCH_FILE,
 STATUS_NO_SUCH_DEVICE,
 STATUS_OBJECT_NAME_NOT_FOUND,
 STATUS_OBJECT_PATH_INVALID,
 STATUS_OBJECT_PATH_NOT_FOUND,
 STATUS_OBJECT_PATH_SYNTAX_BAD,
 STATUS_DFS_EXIT_PATH_FOUND,
 STATUS_REDIRECTOR_NOT_STARTED,
 STATUS_TOO_MANY_OPENED_FILES,
 STATUS_ACCESS_DENIED,
 STATUS_PORT_CONNECTION_REFUSED,
 STATUS_FILE_DELETED,
 STATUS_INSUFF_SERVER_RESOURCES,
 STATUS_MORE_PROCESSING_REQUIRED,
 STATUS_BUFFER_OVERFLOW,
 STATUS_WRONG_PASSWORD,
 STATUS_NETWORK_ACCESS_DENIED,
 STATUS_TOO_MANY_SESSIONS.
Common statuses category contains
the most common CIFS errors and warnings.
cifs.status = "common"
Note: We do not consider
SMB_STATUS_NO_MORE_FILES as a
Warning

32. ACTIVATION: CONFIGURE CIFS ANALYSIS
Configuration > Zones
 Activate CIFS transaction analysis
© SecurActive 2014
for the zone and its subzones
If not needed, do not add print
servers to the scope of CIFS analysis.

33. IMPACT: CIFS ANALYSIS WORKLOAD
© SecurActive 2014
Configuration > Database Workload
 Check impact of CIFS analysis on
workload

34. PERFORMANCE SAVING: CIFS DATA MERGING
Datatype Zone Merging level Degraded metrics
© SecurActive 2014
Configuration > Data Merging
 Adjust merging levels for more performance
or for more details
 By default: maximum performance

35. CORRELATION BETWEEN
NETWORK ISSUES AND CIFS TRANSACTIONS
© SecurActive 2014
CIFS

36. ONE CLICK SWITCH:
FROM TCP FLOWS TO CIFS TRANSACTIONS
© SecurActive 2014
DNS
HTTP
SQL
ICMP
Flows
CIFS
Already in 3.0
Switch from TCP Flows to CIFS Transactions
 From TCP Details to CIFS Queries
 From TCP Raw Data to CIFS Queries

37. ONE CLICK SWITCH:
FROM CIFS TRANSACTIONS TO TCP FLOWS
Switch from CIFS Transactions to TCP Flows
 From CIFS Queries to TCP Flow Details
 From CIFS Raw Data to TCP Flow Details
© SecurActive 2014
CIFS
HTTP
SQL
Flows
DNS
Already in 3.0

38. CIFS DOCUMENTATION
User Guide update
 CIFS Analysis
 CIFS Status Categories (appendix)
© SecurActive 2014

39. Performance
Vision 3.2
NEW FEATURES
& IMPROVEMENTS
© SecurActive 2014

40. LDAP INTEGRATION
© SecurActive 2014
LDAP Integration
 Requires anonymous
authorization

41. SORT BCN BY CRITICALITY
BCN can be sorted by criticality level
 BCN with most alerting events are shown first
 One Red > Any oranges
 One Orange > Any greens
Note: For Business Critical Networks only (not yet for BCA)
© SecurActive 2014

42. #REQUESTS FOR DNS PAGES
© SecurActive 2014
For all DNS pages:
 Add #Requests: Number of DRT
 DRT: DNS Response Time

43. DNS TROUBLESHOOTING
© SecurActive 2014
For DNS Troubleshooting:
 Add new Custom Filters
 Bandwidth, Packets, IPs
3.0
3.2

44. ONE CLICK @ SWITCHING
New button to switch client/server values:
 Zones, IP Addresses and MAC Addresses
© SecurActive 2014

45. HINTS FOR « NO RESULTS »
Hints added:
 When search requests return “No results”
 Data could be merged
 Metric could be disabled at sniffer level
 Metric might not be active on any zone
© SecurActive 2014
Examples:

46. HTTP DATA MERGING
© SecurActive 2014
3.0
3.2
For HTTP Transactions:
 Added a new data merging level

47. DATABASE PERFORMANCE IMPROVEMENTS
Better usage of query multithreading:
 Response times up to 20% faster
 Example: BCN computations
© SecurActive 2014

48. BETTER HANDLING OF BUFFERED TCP PACKETS
Better handling of buffered TCP packets
 Potential impact on DTT / EURT metrics
© SecurActive 2014
Note: already included in 3.0.17

49. SHELLSHOCK SECURITY UPDATE
© SecurActive 2014
Bash security update for
 Shellshock vulnerability
http://en.wikipedia.org/wiki/Shellshock_(software_bug)

50. VERSION 3.2: IMPACTS SUMMARY
Migration time is low
 Update should take few minutes depending on
database size
 Check impact of CIFS performance analysis on
 Major impacts compared to 3.0:
 Database migration time: low
 CIFS performance analysis
 Potentially on DTT/EURT
© SecurActive 2014
workload & license limits
 Potential impact on DTT/EURT metrics

51. SOMETHING BIG IS COMING
© SecurActive 2014
 Q1 2015 Technical Update
 TBD 2015 Something BIG is coming

52. REBOOT AFTER UPDATE
After the upgrade is completed
© SecurActive 2014

53. YOU'RE READY TO GO, ENJOY VERSION 3.2!
© SecurActive 2014

54. What’s New
in Version
3.2?
For any Question
sales@securactive.net
support@securactive.net
THANK YOU!
Follow Us on
@SecurActivePV
www.securactive.net
blog.securactive.net
© SecurActive 2014