Baseline Analysis

nChronos 5.2 provides a baseline analysis feature. On nChronos trend charts, choose a baseline type, and then the baseline will be automatically generated and displayed. The trend charts could be based on traffic, bandwidth utilization, packets and broadcast packets.

And, nChronos 5.2 provides baseline alarms. User can define baseline alarms by setting a deviation threshold from the baseline. When the baseline value matches the threshold condition, the baseline alarm will be triggered and displayed on alarm window. With baseline analysis, it is easy for network administrators to compare current network traffic with historical network traffic, and thereby find out network abnormalities.

Whitelist/Blacklist Alarm

nChronos 5.2 provides a whitelist alarm and a blacklist alarm. Both whitelist and blacklist are defined based on server IP, server port number, client IP, application and protocol. When any captured conversations match the blacklist or don't match the whitelist, the blacklist alarm or the whitelist alarm will be triggered. With whitelist and blacklist alarms, it is efficient to find out abnormal network accesses.

TCP Transaction Analysis

nChronos earlier versions provide transaction analysis based on HTTP protocol. With nChronos 5.2, TCP-based transactions can be analyzed. nChronos provides a transaction analysis window to display the details of all transactions, including transaction name, traffic information, success rate, response time, the related information on client side and on server side, transaction logs and transaction content.

Users can define TCP transactions based on the protocol fields of application layer according to actual network applications. nChronos is capable of monitoring transaction performance and recording transaction content, which provides reference value for business analysis and application performance analysis.

Network Segment Group Analysis and Application Group Analysis

With network segment group analysis, nChronos is able to group multiple network segments and do traffic statistics based on the groups. With application group analysis, multiple applications can be grouped as one type and nChronos can do application traffic statistics based on the application group. A Network Segment Group view and an Application Group view are added to display the statistics.

For example, for a WAN access network link of a bank, users can use the network segment group feature to do traffic statistics for branches and sub-branches.

What's New in nChronos 5

HTTP Packet Reconstruction

Colasoft nChronos 5 provides an HTTP packets reconstruction functionality, which is capable of reconstructing a complete webpage that an endpoint visits. Simply select the time range that you are interested in, select an IP address and click "Reconstruct HTTP Packets", then nChronos shows the web pages that the IP visit during that time range, including URL, client and server IP, and access time. Click a desired URL, the window shows the related page and original codes. You can also select the application "Web" and right-click "Reconstruct HTTP Packets", and then all pages visited in that time range will be displayed.

Packet Replay Link

Colasoft nChronos 5 provides packet replay link, with which you can set up analysis rules to analyze packet files. The replay link has exact the same function as a normal capture link, including bandwidth settings, alarms, name tables, segment settings, etc. The packet file can be trace files from nChronos Server or from local folders saved by other programs, such as Colasoft Capsa and Wireshark.

Quick Decode with Expert Analyzer

Sometimes we need to see the proof details to define the root cause when there is abnormality on the network, especially when we need to define the problem which is related to network or to application. With nChronos 5, you can view the packet details very quickly, without opening the complete Expert analyzer. Just select the interested traffic and click "Decode Packets", you can load Expert Analyzer to decode packets down to protocol fields.

VXLAN Analysis

Colasoft nChronos 5 supports VXLAN analysis. Users can define virtual interfaces based on VXLAN ID. The data from different VXLAN channels can be analyzed as from a network link. A VXLAN view is provided to display VXLAN statistics, including VXLAN ID, traffic information, TCP packet data, etc. Users can drill a VXLAN item down to application and IP address.

Convert Statistics to Graph

Colasoft nChronos provides lots of statistics, which are displayed on the statistical views. Now, you can convert the statistics to a graph by some clicks. Just click the Generate Graph icon on the toolbar, all the data are displayed in a top chart. You can modify top number and sample field for the chart. You can show the chart as pie chart or column chart, and you can save the chart to local. To convert the chart back to statistics, just click the button again.

WYSIWYG Report from Statistical View

With earlier versions, to generate a report, you need to go to the Reports window and to choose the desired report modules. But now, with nChronos 5, you can generate a WYSIWYG report. The data on all statistical views can be generated as reports. To have a WYSIWYG report, just click the Generate Report icon on the toolbar and choose the interested fields. For WYSIWYG reports, you still can set the report time, compare the report data with historical data, and send the report to any email recipients.

Statistics between Network Segments

Networks contain various subnets. Usually we call a subnet as a network segment. With nChronos, you can define a network segment based on an IP, several IPs, or a subnet. The communication traffic between those network segments can be calculated. Colasoft nChronos 5 provides a Statistics Between Segments view to display the communication between two segments. With that view, just by a glance you can know which applications and protocols are running between segments. You can furthermore drill the communication down to IP conversation and TCP conversation.

Advanced Filter View

With numerous data on the statistical views, it is not easy to see the one that you are interested in. Colasoft nChronos 5 provides an advanced filter, which enables you to generate a new view based on the existing view via logically combining lots of filter conditions. The newly generated filter view provides all the functions that the original view provides, including drilldown, analyzing with Expert Analyzer, generating graph, generating report, downloading packets, etc. You can even generate another filter view based on the existing filter view. The generated filter views will be auto-saved on nChronos Console when you close Console.

What's New in nChronos 4.3

Service Port Monitor

nChronos 4.3 provides a Port view and a Service Access view to monitor and analyze service ports. The Port view calculates the statistics based on IP address + TCP/UDP service port. Together with the sorting function of nChronos, you can easily know which service ports are running on the network, and running for which IPs. The Port view further provides other information about the service port, including the application, the uplink and downlink traffic, the service access time, access times, etc. The Service Access view calculates the statistics based on server and client IPs, port number and applications. It provides the access details for each service port. You can drill a service port down to a specific service access session.

VLAN and VPN Virtual Link Support

nChronos 4.3 provides support for virtual links, including VLAN and MPLS VPN. You can add virtual interfaces and set up network links based on the virtual interfaces. There is a VLAN view, which displays traffic statistics based on VLAN ID. An MPLS VPN view is also provided to display traffic statistics based on MPLS VPN label. Together with the name table function of nChronos, you can add names for VLANs and MPLS VPNs.

Millisecond Analysis

Millisecond analysis provides traffic analysis accurate to one millisecond. It is important for users who care about transient traffic burst. Colasoft nChronos 4.3 provides millisecond traffic statistics and millisecond traffic alarm. Users can define any millisecond traffic alarm according to the need. The Millisecond Analysis window displays the millisecond traffic statistics trend charts in real-time.

Multi-Segment Analysis

Sometimes the responses from large websites are very slow, and to find out the system bottleneck for the websites, it is necessary to analyze each link of the websites. Colasoft nChronos 4.3 provides a multi-segment analysis function, which associates and correlates the data of the same conversation collected on two or more network segments, and displays graphical performance analysis results, like packet loss, delay, retransmission, etc., thus providing visibility into the areas where bottlenecks may occur. A Multi-Segment Analysis window has a timeline pane to show the traffic trends of monitored links. When a conversation is analyzed, the conversations on other segments will be picked up and analyzed automatically.

A Multi-Segment Detail Analysis window shows the detailed analysis results and visualizes the conversation flow across multiple segments. When clicking and hovering a packet, correlated packets will be highlighted, the time difference between the packets will be displayed, and the packet view will show the in-depth decoding information for that packet.

Storage Filter

nChronos 4.3 provides Storage Filter for users to store packets that match the filer rules. You can define the filter rules based on IP/MAC address, port number, protocol type, packet size, etc., and only packets matching the rules will be stored. Besides the filter rules, Storage Filter provides a functionality to truncate the stored packet to a specified size. With Storage Filter, you can store interested packets, and even store only the first few bytes of interested packets. It saves storage space, and helps you avoid from policy problems in some environment.