ClearSight Analyzer serves up clear view of VoIP activity

ClearSight's Analyzer can be deployed on its own or paired with remote-agent software available in its ClearSight Analyzer Distributed packaging. We tested ClearSight Analyzer Distributed 6.1.6, which supports most VoIP protocols, including SIP, H.323, Cisco's Skinny Client Control Protocol, MGCP, Megaco and Real Time Streaming Protocol.

As in the previous incarnations of Analyzer, the latest version stands out for its intuitive and comprehensive display of network activity. Analyzer Distributed offers a multisegment ladder diagram, which gives quick insight into VoIP network activity, illustrating both sides of a call. The ladder diagram also can piece together data collected on different network segments to provide a complete illustration of a voice or data dialog, from the client through the infrastructure to the server and back.

Consistent color codes — red for trouble, yellow for suspected problems, and blue or green for normal conditions — are used throughout. All alerts and thresholds are configurable, but the defaults were effective at identifying what is critical — red — and less severe — yellow. While testing the product's diagnostic capabilities, we observed how problems, such as low-level packet loss and slightly degraded voice-call quality, accurately triggered appropriate warnings (yellow in this case).

Red warnings on the ladder diagram indicated more serious problems, such as an unreachable SIP registrar, which would prevent an IP phone from establishing an initial setup on the network. In addition, severely degraded VoIP calls (to the point we set at 3.0 MOS or lower) triggered severe alarms and necessitated a notation in the events reporting log.

Analyzer's ability to piece together views of the test network's different segments, clearly show the completed dialog, and isolate a fault in our troubleshooting exercise, contributed to its top diagnostics-and-troubleshooting rating.

We've always liked Analyzer's drill-down capabilities. Users can easily explore from high-level application parameters all the way down to packet decodes. We clicked on a SIP call we were monitoring, and from there burrowed down through statistics screens for the call, including details on quality and call-setup. We even could get to the capture buffer that showed a packet capture trace of the transaction.

The ClearSight tool detects in real time TCP/IP and application anomalies, and offers configurable, periodic (ours was 15 seconds) snapshots of the network. It lets network administrators rapidly determine the sources of problems and make changes without capturing, stopping, recapturing, then recomparing data.

We used the Distributed capture and a transaction-reassembly feature of Analyzer to piece together the clues — a misconfigured Layer 3 switch and an overloaded WAN link — of a compound network anomaly that was impairing voice calls. As many as four flows from different network locations can be merged and displayed together, a feature we found to be helpful for rebuilding conversations and spotting seemingly unrelated activities that don't automatically appear in the flow.