Exinda Networks - Application Specific Analysis Modules (ASAM)

Technology	What It Does	Benefit
Application Analysis Engine	Provides a plug in framework for delivering application specific details for existing and new key enterprise applications.	Understand network behaviour at from an application level.
VoIP Analysis	Track SIP based call information including phone numbers, call duration and CODEC. See what resources are cosumed as calls are being made in realtime	Identify top callers and receivers at the phone system level and how they consume network resources.
Citrix Application Analysis	Classify and track Citrix Published Applications within ICA sessions.	Identify which applications are used within Citrix sessions. Prioritise important applications within these sessions.
HTTP URLs Analysis	Classify and manage HTTP traffic by URLs. Use regular expression to filter specific URL groups.	Monitor top URLs. Prioritise traffic by inbound/outbound URLs.

For more information on VoIP Analysis and Citrix Application Analysis

Voice over IP (VoIP) Analysis Module

Platforms: 4000 series and 6000 series platforms

Currently available: 4800 & 6800 firmware version 4.8 onwards

Installation:
- Download and install '470-citrixsip' via the CLI, don't reboot.
- Install the latest L7 Signaturtes under System | Updates | Layer 7 Signatures
- Reboot.

Overview:
Exinda can classify Session Initiation Protocol (SIP) Voice over IP (VoIP) calls and perform call based classification based on IP phone extensions within the corporate network. Exinda can monitor SIP VoIP calls being made from and/or to the office location. VoIP calls within a corporate setup are initiated by the SIP protocol followed by Real-time Transport Protocol (RTP) to carry the voice data.

Exinda statefully tracks the SIP call setup process and classifies call requests from the details available. Classification during initiation includes details in the form of Private Branch eXchange (PBX) extensions of caller and receiver, CODEC to be used for RTP voice data during conversation and network level data e.g., bytes transferred and data rates of voice data transmission.

Image 1: Per extension drill down analysis

Configuration Modes:

In VoIP, the digital signal processor (DSP) segments the voice signal into frames and stores them in voice packets. These voice packets are transported using IP in compliance with one of the specifications for transmitting multimedia (voice, video, fax and data) across a network: H.323 (ITU), MGCP (level 3, Bellcore, Cisco, Nortel), MEGACO/H.GCP (IETF), SIP (IETF), T.38 (ITU), SIGTRAN (IETF), Skinny (Cisco), etc. The only specification supported by Exinda at this stage is the Session Initiation Protocol (SIP). Hence only the voice calls made using SIP would be classified by Exinda.

Coders are used for efficient bandwidth utilization. Different coding techniques for telephony and voice packet are standardized by the ITU-T in its G-series recommendations: G.723.1, G.729, G.729A etc. The coder-decoder compression schemes (CODECs) are enabled for both ends of the connection and the conversation proceeds using Real-Time Transport Protocol/User Datagram Protocol/Internet Protocol (RTP/UDP/IP) as the protocol stack. Exinda VoIP monitoring is independent of the CODEC in use for encoding or decoding the voice data sent using RTP.

Image 2: Real Time Call Analysis

Features:

VoIP Overview Summary
Detailed (drill-down) SIP VoIP call monitoring. (image 1)
Realtime SIP VoIP call monitoring. (image 2)
VoIP Reporting - On demand and Scheduled PDF reports

Detailed (drill-down) SIP VoIP Call Monitoring
Under Monitor | Applications, where 'sip-rtp' appears, there is a link next to it called 'View Calls'. This will take you to a list of SIP VoIP calls registered going through the Exinda. From here you can see the top inbound and outbound callers and callees in terms of data transferred. Furthermore, if you click on the link for an individual extension in the list, calls made or received by the extension will be displayed.
Realtime SIP VoIP call monitoring
In the Monitor | RealTime section, the caller and the callee extensions will be displayed next to SIP-RTP traffic if the Exinda has detected the SIP VoIP call specific details.

Specific VoIP Information:

Caller Name
Caller Number
Caller Handset IP Address
Receiver Name
Receiver Number
Receiver Handset IP Address
Codec Type
Number of Calls - per number
Number of Calls - total
Number of Packets
MB Transfered - total per number
MB Transfered - per call
Average Throughput - total per number
Average Throughput - per call
Talk Time - Total Sum
Talk Time - Total per number
Talk Time - per call
Talk Time - Total Average
Talk Time - Average per number
Top 10 Callers graph
Top 10 Receivers graph
Support up to top 1000 callers and 1000 receivers

Analysis by:
       Real Time
       This Hour
       Last Hour
       Today
       Yesterday
       This Week
       Last Week
       This Month
       Last Month
       This Year
       Last Year

Format:
HTML
PDF

Citrix Published Application Classification Module

Platforms: 4000 series and 6000 series platforms

Currently available: 4800 & 6800 firmware version 4.8 onwards

Installation:

Download and install '470-citrixsip' via the CLI, don't reboot.
Install the latest L7 Signatures under System | Updates | Layer 7 Signatures
Reboot.

Overview:

Exinda can classify Citrix Independent Computing Architecture (ICA) traffic and perform subport classification of Citrix traffic based on Citrix published applications. Exinda can monitor Citrix ICA client requests for a published application destined to a Citrix ICA Master browser. After the client requests the published application, the Citrix ICA Master browser directs the client to the server with the most available memory. The Citrix ICA client then connects to this Citrix ICA server for the application.

Exinda statefully tracks Citrix ICA server client messages and classifies requests for given Citrix application names and traffic. A Citrix application is named when published on a Citrix ICA server.

Image 1: Citrix Published Applications List

Configuration Modes:

Citrix ICA clients can be configured in various modes. Exinda cannot distinguish among Citrix applications in all modes of operation. Therefore, network administrators might need to collaborate with Citrix administrators to ensure that Exinda properly classifies Citrix traffic.

A Citrix administrator can configure Citrix to publish Citrix applications individually or as the entire desktop. In the Published Desktop mode of operation, all applications within the published desktop of a client use the same TCP session. Therefore, differentiation among applications is impossible, and Exinda can only be used to classify Citrix applications as aggregates (by looking at port 1494).

The Published Application mode for Citrix ICA clients is recommended when you use Exinda. In Published Application mode, a Citrix administrator can configure a Citrix client in either seamless or non-seamless (windows) modes of operation. In non-seamless mode, each Citrix application uses a separate TCP connection, and Exinda can be used to provide interapplication differentiation based on the name of the published application.

Seamless mode clients can operate in one of two submodes: session sharing or non-session sharing. In seamless session sharing mode, all clients share the same TCP connection, and Exinda cannot differentiate among applications. Seamless sharing mode is enabled by default on some software releases.

In seamless non-session sharing mode, each application for each particular client uses a separate TCP connection. Exinda can provide interapplication differentiation in seamless non-session sharing mode.

Image 2: Citrix Published Applications - Application drill down

Image 3: Citrix Published Applications - Real Time Analysis

Features:

Citrix Published Applications List (image 1)
Realtime Citrix Application Monitoring (image 3)
Detailed (drill-down) Citrix Application Monitoring (image 2)
QoS (shaping) by Citrix Application

Realtime Citrix Application Monitoring
In the Monitor | RealTime section, the published application name will apear next to the service 'ica' if the Exinda has detected the application name for that particular ica session.

Detailed (drill-down) Citrix Application Monitoring
Under Monitor | Applications, where 'ica' appears, there is a link next to it called 'View Applications'. This will take you to a list of detected Citrix publised applications. From here you can see who used what applications. Furthermore, if you go to Monitor | Hosts and click on a host (IP), you can see what Citrix published applications this user used by selecting 'Citrix Applications' from the dropdown.

QoS (shaping) by Citrix Application
Published applications can be defined as Traffic Types, which can then be used in Optimizer policies. To correctly define a traffic type goto System | Traffic Types | Add Traffic Type. Enter a name, select IP as the protocol, select 'ica, port 1494' as the service, and select 'Citrix Application' from the last dropdown. Here you can enter the publised application name. You can enter the full application name, eg, Internet Explorer, which is case-sensitive, or you can use widcards, eg, internet*, which is case-insensitive. You can save this Traffic Type, then use it in Optimizer policies.