299-01 Riverbed Certified Solutions Professional - Network Performance Management Question and Answers

Interactive views based upon time control.

A time control window for creating trace clips.

A panel displaying current time in the packet capture (pcap) file under analysis.

A triggering and alerting capability based upon traffic views.

A triggering and alerting capability using an optional fault management add-on for monitoring routers and switches.

A single capture port can be specified.

Any combination of capture ports can be specified.

All capture ports on the Cascade Shark can be specified.

Trend/Index data has a default retention of seven days.

There is no Trend/Index data by default, it is recommended to set this as appropriate.

TCP Resets are tracked via reading the TCP header on the Sensor.

TCP Resets are tracked by collecting the flag via NetFlow.

Both A and B.

Cascade does not track Resets.

10.0.0.0/255.255.255.255

0.0.0.1/255.0.0.0

10.0.0.1/255.255.0.255

10.0.0.0/255.0.255.0

10.0.0.1/255.0.0.255

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

Active Directory information for successful/failed login association to IPs

DHCP for host IP to MAC address association.

SNMP polling to routers, switches, and servers for CPU information.

SNMP trap data from routers, switches, and servers for security events.

SNMP polling to routers and switches for MAC address and physical switch port association.

Enabled

Disabled

Set to retain up to 1 week or 10GB of indexing/trending data

Set to retain up to 1 week or 10GB of packets

Set to keep the indexing/trending data indefinitely

Can only capture traffic from a single port.

Can only capture traffic that is routed (not switched)

Can only capture traffic that is ingress or received by the device

The number that can be configured is oftentimes limited to two

Requires at least two monitoring ports to capture a single link

Layer 1 information. For example, for Ethernet tap points this includes signal levels and attenuation.

Layer 2 information. For example, for Ethernet with 802.1Q encapsulation this includes the VLAN identifier and frame size between MAC Addresses

Layer 3 information. For example, for IPv4 this includes the protocol, time-to-live (TTL), and IP Identifier between IP Addresses

Layer 4 Transport information. For example, for TCP this includes TCP flags, size in bytes, and sequence number between IP Addresses.

Application header information. For example, for Web traffic this includes HTTP methods and message numbers (e.g. "200", "404").

3

5

10

15

Hover your mouse over the name of the view.

Hover your mouse over the icon in front of the view name.

Open context-sensitive help with the view displayed.

Right-click within the main workspace and select "show view tool tip" from the right hand menu.

Active time-out setting for flows should be set to 600 seconds.

Inactive time-out setting should be set to 15 seconds.

NTP should be configured on the device.

Active time-out setting for flows should be set to 60 seconds.

Apply a View on the live interface and then start a Capture Job on the capture port to analyze traffic later.

Start a Capture Job on the capture port with a BPF filter and apply a View on the live interface for the same capture job.

Start a Capture Job on the capture port, apply a View on the live interface and create a trace clip for the time window of interest.

Never create a Capture Job to prevent packet drops.

The license key is entered during installation. The license is activated either through an Internet connection or by phone.

The license key is entered during installation. The license must be activated through an Internet connection.

The license key is entered during installation. There is no activation but Cascade Pilot will detect if the license is already in use on the network.

There is no license key activation. The software image is shipped with the license key installed.

Allows Cascade Pilot to load views that take advantage of the Index more quickly.

Includes the number of bytes and packets for each conversation seen by the Cascade Shark appliance.

It is configured on a per-port basis.

It is configured using the sa-wizard as part of the initial configuration.

It is enabled by default per capture job.

Line Graphs

Stacked Area Graphs

Pie Charts

Bar Charts

Tables

Connection Graphs

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Server" in the drop down, enter "tcp/25" in the Protocol field and select "Hosts" in the "report-by" pull down.

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Server" in the drop down, enter "tcp/25" in the Protocol field and select "Peers Hosts" in the "report-by" pull down.

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Client and Server" in the drop down, enter "tcp-25" in the Protocol field and select "Hosts" in the "report-by" pull down.

Under the "Quick Reports" pull down from the dashboard page, select "Host" enter the IP Address and hit return.

The time span of the report does not cover any connection set-up points

Server delay is zero.

The protocol used by the application in not TCP-based.

Application traffic was not seen by a Cascade Sensor.

The server plug-in is needed to measure "Server Delay" and not functioning correctly.

Changes are saved only in the View to which the filter has been applied.

The modified filter is saved on the machine on which Cascade Pilot is running.

The modified filter is saved on any Cascade Shark that Cascade Pilot is connected to.

The changes are lost when you close Cascade Pilot.

10.0.0.0/23 United_States

0.0.0.0/0.0.0.0 Worldwide

24.32.8.43/32 CEO_Printer

192.168.0.5/255.0.255.0 Printers

10.38.14.1/255.255.255.255 My Computer

192.168.66.* Web Servers

192.168.0.100/255.255.0.255 Database_Servers

192.168.14.0/24 Mail_Servers

192.168.*.* Boston

IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number of packets, retransmitted bits

IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number of packets, inbound/outbound interface ID

IP Addresses, MAC Addresses, Port Numbers, Protocol, DSCP Marking, number of bits, number of packets

IP Addresses, Port Numbers, Protocol, Round Trip Time, DSCP Marking, number of bits, number of packets

IP Addresses, Port Numbers, Protocol, Packet Latency, DSCP Marking, number of bits, number of packets

Ask Riverbed Support to send you the proper View to use.

Open the View folders in Cascade Pilot to look for a View named "Round-trip time".

Use the View search box and enter "round".

Use the Help menu and search for round.

MOS scores voice quality issues

ABC-threshold

Signal-to-noise ratio

Jitter

Packet Loss

You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis.

You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis.

You can start analysis on the Cascade Profiler based upon flow data that has been sent from Cascade Shark to Cascade Profiler.

You can export data from a capture job directly to a packet capture (pcap) file and open in any tool that accepts pcap format.

You can start by loading views of the data from the Cascade Shark Appliance Web GUI before export to Wireshark.

The correct communication port(s) are NOT open on the firewall between Cascade Pilot and Cascade Shark.

The Cascade Shark is placed in "passthru" mode so Cascade Pilot access is not available

The Cascade Shark appliance has no capture jobs configured.

You may be running Cascade Pilot-Personal-Edition (PE). You need the full version of Cascade Pilot to connect to Cascade Shark.

Trend/Index data is disabled on the Cascade Shark Appliance.

from the Cascade Sensor

NetFlow

NBAR

Packeteer

User Defined

Enhanced sFlow

Average drops

Average retransmits

Average response time

Average utilization

Total bandwidth bits

Increase in Server Delay

Decrease in Average Connection Application-level Throughput

Increases in the number of TCP retransmissions

Decreases in the number of new connections to the application servers

Increase in the number of Active Connections

Unlimited

Ten

Four

Twenty

Warn if either inbound or outbound traffic increases abnormally

Warn if an application component of traffic increases abnormally

Warn if traffic to/from specific hosts exceeds a specific utilization level

Warn if the response time across a link increases abnormally

One minute flow records are deleted from the file system FIFO (oldest first) once the appliance has filled the space that is allocated.

There is a fixed amount of space on the filesystem for completed reports.

A report template can be marked "keep until I delete it" so that any reports that are scheduled with this template are not automatically deleted from the filesystem.

When the flows or rollup records have been deleted from the filesystem, any saved report that was generated from those flow sources is no longer available.

Users have the ability to allocate additional space to the 1 min flow logs in order to increase retention. This is done at the expense of other rollup resolutions.

Three weeks

Three days

One day

Configurable from one minute to three weeks