Home
Contents

NetResident - Network Content Monitoring Tool

Prev Page Next Page
 
Introduction
Overview
System Requirements
What Network Content NetResident Can Analyze
What’s New in NetResident 3.0
NetResident Architecture
Deploying the Application
Before You Begin: Network Visibility
Step 1: Deploying the NetResident Service and Console
Step 2: Deploying NetResident Agents
Ensuring Connectivity Between the System Components
Tips and Tricks
Setting Up the Database
Step 1: Creating a New Database and Configuration File
Step 2: Selecting an SQL Server
Step 3: Selecting a Database Location and Name
Step 4: Setting Database Access Token
Step 5: Summary
Working with NetResident
Events
Connections
Alerts
About
Understanding the Difference Between the Display and Capture Filters
Remote Connections
Aliases
Workspaces
Adding Exceptions to NetResident Agents
Manual SQL Server Installation
Analyzing Imported Capture Files
Frequently Asked Questions
Sales and Support

Frequently Asked Questions

Q. My HTTP plugin does not always display HTML pages correctly. For instance, some images are not displayed. Why is this so?

A. A typical HTML page represents a collection of a dozen of independent objects: HTML code, images, CSS styles, and others. A browser requests each of these objects; however, most of these objects are cached (saved to the computer’s hard drive for future access) and hence not requested from the network every time a Web page is viewed. NetResident does not have access to your browser’s cache; therefore, it cannot “see” these objects. This is not a problem with NetResident; you can always reload the Web page in your browser (you need to perform a complete reload; in Internet Explorer, this is achieved by clicking on the Refresh button while holding down the Shift key). This will allow NetResident to log and store all Web page elements.

Q. When I try to import CommView or CommView for WiFi log files, I am unable to display the contents of some of the files. I believe I have all parameters set correctly regarding the event viewer and filtering.

A. It is important to understand that the import procedure has its own filter, and the content displaying mechanism has its own filter. When you were importing the file, the content was possibly filtered out during the import phase if you applied filters. Once the import phase is over, the application uses the display filter to show the contents. There is a chance that the application is configured to show only the data collected during the last two days, while the logs contained sessions that were outside this time frame. You may want to disable the display filter to have the application show the data.

Q. Why does the NetResident service insist on starting if I just want to review LOG files and not capture current data?

A. The database is maintained by the service. The GUI is simply a console that “talks” to the service. All data processing and filtering is performed by the service as well, so it has to be running.

Q. Can you give some performance metrics when NetResident is being used to monitor a heavily loaded network?

A. The program’s performance depends on the CPU speed and RAM size. If you use the default monitoring settings (i.e., when all the plug-ins are enabled and all the ports are being monitored, an average Pentium4 3 GHz PC with 512 Mbytes of RAM can monitor a fully used 100 Mbit link. To monitor faster network links, you should set up filtering by station, limit the ports being monitored, and disable unnecessary plugins. The performance also depends on the type of traffic being monitored, so additional filters should be applied only if you experience performance problems.

Q. For some ICQ and AIM chat sessions, one of the parties’ ID number is shown as “Not detected.” Why is it not detected?

A. This happens when an ICQ or AIM chat session (including the authentication phase) begins before NetResident starts capturing network packets. If capturing is started in the middle of a chat session, the ID can sometimes be found (as it is contained in some service packets, which are sent intermittently), although this cannot be guaranteed.

Q. Can your VoIP module be used for logging Skype conversations?

A. No, sorry. Skype uses robust encryption; it is impossible to decrypt Skype conversations.

Q. Why does NetResident not show the amount of transferred data in terms of bytes?

A. NetResident does not always store transferred data in their original form. Rather, it processes data for more convenient presentation. It is not uncommon for a single network session to be divided into several separate events, or several network sessions to be combined into one event. Besides, some transferred data simply are not supposed to be processed by current NetResident plugins. That said, NetResident cannot and is not supposed to display reliable network data statistics.

Q. I use NetResident 2.x. Can I import my existing database into NetResident 3.0?

A. Unfortunately, no. NetResident 3.0 is a completely new product that uses a new database structure, so importing is not possible.

Q. I use NetResident 2.x. Can I install NetResident 3.0 on the same computer?

A. Yes, these applications can work side by side.