Solution Detail
Flow Hunter Passive Capture, Historical Investigation and Evidence Export
Turn slow access, choppy meetings, failed connections and abnormal bandwidth into host, session, protocol and PCAP evidence for troubleshooting and vendor review.
Products
3
Scenarios
6
Evidence
PCAP
Why
Many faults cannot be reproduced continuously. Users report a slow system, poor meeting or unavailable page, while operations teams must distinguish DNS, TCP setup, TLS handshake, HTTP server, link loss, retransmissions and congestion.
Flow Hunter remains passively connected without changing application paths, organizing traffic by host, session, protocol, time window, quality and PCAP. BestPerf supplies active baselines, and NetAccura Traffic Generation replays relevant captures in the lab.
Topology
How
Connect Flow Hunter to core switches, exits, mirrored firewall ports, TAPs or server aggregation points where key client-server sessions are visible. Capture east-west or cloud-edge traffic at separate points by application domain.
Organize sessions by MAC, VLAN, IP, TCP/UDP, DNS, TLS and HTTP. Identify retransmissions, handshake duration, DNS/TLS failures, slow HTTP responses and abnormal connection patterns.
Use BestPerf to record quality continuously. When jitter or loss peaks appear, analyze real sessions from the same window rather than an isolated capture.
Export key sessions as PCAP extracts for Wireshark, vendors, developers or NetAccura Traffic Generation. Replay security/performance samples in the lab to validate policies or fixes.
Product Stack
Tool Combination
Flow Hunter
Capture passively through mirrored ports or TAPs for L2-L7 analysis, session investigation, protocol-stage diagnosis and PCAP export.
BestPerf
Actively measure RTT, directional loss, jitter, micro-outages, TCP goodput and quality under load to establish link baselines.
NetAccura Traffic Generation
Generate L2-L3 test streams. Software models also replay Ethernet PCAPs, rewrite IPv4 addresses and TCP/UDP ports, and multiply traffic for performance, security detection and issue reproduction. Stop all transmit tasks before switching modes. Simultaneous generation and replay require separate devices.
Result
See not only device alerts, but session timings, retransmissions and failures at each protocol stage.
Provide security, application and cloud vendors with clear time windows, sessions and captures, reducing repeated capture requests.
Deliver more than throughput or delay figures: include topology, parameters, timelines, quality curves, key sessions, anomalies, PCAP extracts and retest results. Development, testing, operations, vendors and customers can discuss the same evidence rather than relying on screenshots, verbal descriptions and repeated debate.
References
Next Step
NetAccura can create a test topology, parameter table and POC plan based on your links, models, application protocols, available PCAPs and SLA goals.