It's the final inning of the seventh and deciding game of the World Series, and the situation is grim for the home team - two out, down by two runs. The rookie batter awaits the pitch from last year's Cy Young winner. Fans across the country watch breathlessly, including ... the office workers crowded into a colleague's cubicle, watching the game on a computer monitor streaming over the Internet.

Even a small percentage of workers using streaming applications on their office computers can cut network performance in half. Four workers watching 400 kbps video streams will completely congest a branch office T1 line. On such an overburdened network, response times might increase by a factor of ten or more. Worse, excessive delays and packet losses in overloaded networks can cause application time-outs, resulting in no response at all.

Rogue Repercussions

There are many types of applications that deliver streaming applications to the desktop. Media players such as iTunes, Real Player, Windows Media Player, and Rhapsody stream high-quality audio at up to 128 kbps, while video is often streamed at 400 kbps or more. These media players use various adaptive media scaling technologies to fit the streaming bandwidth to the available bandwidth, causing them to increase their bandwidth to use available network resources.

Large amounts of bandwidth can also be consumed by bidirectional interactive video and audio applications. In addition to Microsoft NetMeeting, instant messaging (IM) applications that enable voice and videoconferencing such as those from Yahoo, MSN, AOL, Google, and Skype are prime examples. Voice and videoconferencing bandwidth of these applications is adaptive; many H.363 videoconferencing terminals can use up to 768 kbps in each direction. Just two employees using such videoconferencing sessions can saturate a T1 link.

Transmission Control Protocol (TCP) has inherent standard congestion management algorithm to reduce traffic on a congested network. However, many video and audio streams use User Datagram Protocol (UDP) rather than TCP transport and are robust to a certain level of packet loss. As a result, UDP streaming flows may be more aggressive than legitimate enterprise applications in competing for network bandwidth, impacting network performance more adversely than equivalent TCP flows.

Catching the Rogues

One solution to catching rogue applications is to implement stream-to-disk recording technology, a methodology to identify complex and intermittent problems as they occur, record them, and play back the data at a later time for analysis, troubleshooting and remediation. Also known as "retrospective analysis", this technique goes a major step beyond traditional network management techniques by combining, into one solution, three critical performance analysis and problem resolution functions:

• Real-time, point-in-time analysis: to identify and resolve the root causes of network problems as they happen.
• Back-in-time analysis: allows packet level, bit-by-bit specificity to be applied to small or vast amounts of data captured over hours, weeks or months.
• Historical analysis: Long-term trend analysis of application and network behavior and growth over an extended period of time.

Together, these retrospective analysis capabilities represent the foundation for a new generation of application and network performance analysis solutions. Retrospective analysis is effective for minimizing business-impacting rogue applications, and stop offenders before they crash the network.

Glen Bourne is a Product Marketing Manager for Sniffer Enterprise Platforms. He can be reached at 408-571-5167 or Glen.Bourne@networkgeneral.com. For more information, visit Network General's website at www.networkgeneral.com.