Reports from the right-click menu
Right-click menus enable you to obtain additional information without having to switch contexts or go to the report pages. You can right-click any underlined item in any list or table entry to drill down to additional detail about that item. You can also right-click any traffic graph on the Dashboard or on any traffic report to obtain additional detail.
The choices for additional information that appear on the right-click menu depend on the item you right-click and the options that you have configured. For examples:
-
If you right-click a service, the available service performance reports are shown on the right-click menu.
-
If you right-click a host, you can choose from a list of NetProfiler reports available for that host or choose to send the host information to another Riverbed product for additional analysis.
-
If you have external links defined, the links are listed on the right-click menu, and you can send the item you click to an external program.
-
If user reporting is enabled on your account and a user identity source is available, you will be able to run a user report from the right-click menu.
-
If the NetProfiler is receiving information from an Alluvio NetShark or AppResponse, you can get a packet report for the host.
Menu choices that are grayed out are either not applicable to the item clicked or else not available because they are not configured.
The report that you generate from the right-click menu retains the context of the report in which you right-clicked the item. If the table item, list item, or graph you right-clicked is on a dashboard widget or traffic report for a particular port, protocol, group, time period, etc., then the drill-down report is limited to those same attributes.
Drilling down
Assume, for example, that you want to know about any host making connections over tcp/23, so you run a report of tcp/23 traffic, listed by host. The report subtitle identifies that it is only tcp/23 traffic for the specified time frame. This is the context of the report.
In the report, you identify a host that you want to investigate further. You right-click a host and get a right-click menu that offers you two choices for reporting the traffic of that host:
-
Traffic for this host – keeps the time frame of the current report, but does not limit the new report to tcp/23. The new report will list all traffic for this host during the time frame of the parent report.
-
Traffic for this host in context – keeps the time frame of the parent report and the constraint for limiting the report to tcp/23 traffic. Also, it adds the constraint of the selected host to the context of the report.
In this example, if you choose Traffic for this host in context, the new report will show only tcp/23 traffic for only the host you right-clicked.
Drilling down by pairs
When you drill down by host-pairs or group-pairs, you get lists of pairs in which at least one member of the pair is within the context of the parent report. You can drill down farther for traffic information about either or both members of the pair. However, right-clicking a member of the pair that would take the next report outside the context of the current report requires that you make a choice of contexts.
Assume, for example, that:
-
You are looking at a list or graph of hosts that belong to a host group named "East."
-
You want to investigate a suspicious host in this group.
-
To see which hosts the suspicious host is connecting to, you right-click the host and choose Traffic for this host > by Host Pairs from the right-click menu. This generates a report of host pairs in which at least one member of each pair must belong to the group "East."
-
You find that the host of interest is connecting to in the group named ”r;West,” which you want to investigate. So you right-click that host.
You cannot generate a new report for the host in the "West" group while still preserving the context that limits the report to the "East" group. You must make a choice. So the right-click menu offers you four choices:
-
Traffic for this host – keeps the time frame of the parent report, but does not limit the drill-down report to any other context (protocol, port, group membership, etc.).
-
Traffic for this host in context – keeps the time frame of the parent report and also the context (in this case, membership in the group "East").
-
Traffic between these hosts – keeps the time frame of the parent report, but does not limit the drill-down report to any other context (protocol, port, group membership, etc.).
-
Traffic between these hosts in context – keeps the time frame of the parent report and also all the context (protocol, port, etc.) except for the conflicting context element (in this case, membership in the group "East").
These choices allow you to drill down to the specific detail you seek without needing to go to another page or specify another report.
The right-click menu for drilling down on host pairs is available only when you right-click one of the hosts in the Host Pair column. Hosts in the Client or Server columns do not support host pair drill down. The Host Pair column is displayed by default, but can be deleted from the report display. Use the Change columns option from the report Options menu if it is necessary to add this column to the display.
Drilling down to packet level
Once you have drilled down to a specific host, host pair, port, protocol, or flow that you want to investigate, you can obtain packet-level detail by continuing your investigation on Packet Analyzer or Cascade Sensor. more