Conversations in Real Time

The Conversations in Real Time monitor shows the top conversations by throughput observed by the Exinda appliance during the last 10 seconds. This report can answer questions such as, “My link is congested; who's doing what on my network right now? I think I have a problem with a particular host or subnet; what is that host or subnet doing right now? Is the traffic being accelerated or processed by Edge Cache properly? Is the traffic passing through my High Availability or Cluster correctly?"

The Conversations in Real Time monitor shows inbound conversation traffic separately from outbound conversation traffic.The conversations are represented as external IP, internal IP, and application. Some traffic types will show extra information, such as the URL for example, in square brackets following the application. The traffic is sorted by transfer rate. The packet rate and number of flows for each conversation in that 10 second period is also shown. You can set the chart to refresh frequently or infrequently or not at all. Each refresh shows 10 seconds of data.

The Conversations in Real Time monitor can help you diagnose an issue:

• by allowing you to filter the conversations by IP address or subnet,
• by showing the user name associated with the internal IP address,
• by showing which policy the conversation falls into,
• by allowing connections within a flow to either be shown individually or to be grouped together,
• by highlighting accelerated conversations (in yellow) and indicating the acceleration technique being used,
• by highlighting conversations that have been processed by Edge Cache (in blue), and
• by indicating how the conversations is flowing through the high availability cluster
• by indicating if you're seeing asymmetric traffic.

Where do I find this report?

Go to Monitor > Real Time > Conversations.

To understand the acceleration and high availability icons & coloring

When a conversation has been accelerated by the Exinda appliance, the conversation is highlighted in yellow and the application acceleration technologies being applied to that conversation are displayed on the left-hand side as a series on icons.

For example, the FTP connection below is accelerated (shown in yellow) and is also been processed by WAN Memory (indicated by the icon).

When a conversation has been processed by Edge Cache, it is highlighted in blue.

The following legend describes the meaning of each acceleration icon.

	WAN Memory: The connection is been processed by WAN Memory.
	CIFS Acceleration: The connection is been processed by CIFS Acceleration.
	SSL Acceleration: The connection is been processed by SSL Acceleration.
	NCP Acceleration: The connection is been processed by NCP Acceleration.
	MAPI Acceleration: The connection is been processed by MAPI Acceleration.

When an appliance is deployed in a High Availability (HA) or Clustering mode, the following icons may also appear next to each conversation.

	Asymmetric: The traffic is asymmetric, and is not being accelerated.
	Locally Bridged: The connection is passing through this appliance in the cluster. If the row is colored yellow, then the flow is remotely accelerated.
	Remotely Bridged: The connection is passing through another appliance in the cluster. If the row is colored yellow, then the flow is remotely accelerated.
	Locally/Remotely Bridged: The connection is passing though both this and other appliances in the cluster. (Asymmetric traffic) If the row is colored yellow, then the flow is remotely accelerated.
	Locally Bridged + Locally Accelerated: The connection is passing through this appliance in the cluster and is being accelerated on this appliance.
	Remotely Bridged + Locally Accelerated: The connection is passing through another appliance in the cluster and is being accelerated on this appliance.
	Locally/Remotely Bridged + Locally Accelerated: The connection is passing through both this and other appliances in the cluster and is being accelerated on this appliance. (Asymmetric traffic)

When an appliance is deployed in a High Availability (HA) or Clustering mode, the following icons may also appear next to each conversation.

To filter by IP address or subnet

Simply type the IP address or subnet in the IP/Subnet Filter field at the top of the screen and click Apply. The conversations can be filtered by IPv4 or IPv6 addresses.

To show the user associated with the internal hosts

Check the Show Users checkbox.

Note	You must have Active Directory configured to display user names. See Integrate the Exinda Appliance with Active Directory.

To group individual connections within a flow as a single line item or to show each connection as a separate line item

Toggle on or off the Group checkbox at the top of the screen.

To display the policy the conversation falls into

Select Show Policies checkbox at the top of the screen.

Trouble-shooting virtual circuits and policies

If you are unsure whether traffic is being processed properly by the virtual circuit or the policies within your virtual circuit, it is best to use real time monitoring to determine if traffic is hitting your virtual circuit as you would expect.

1. On the Real Time Conversations screen.
2. Select Show Policies checkbox at the top of the screen to group the conversations by virtual circuit and policy.
3. Look at the traffic falling under your virtual circuit to decide if the correct traffic is in there.
4. If there is traffic that you were expecting that is not there, look in other virtual circuit groups to see where you expected traffic is.
5. If your traffic is falling into the wrong virtual circuit, check the definition of the affected virtual circuits and ensure the most specific virtual circuit is higher in the policy tree.