Network analysis software is an essential tool for any IT administrator, but the ridiculously high prices commanded by most solutions puts them out of the reach of the smaller business. This leaves most of them without the faintest idea as to what is happening on their network.

Starting life over a decade ago, Network Instruments Observer has traditionally bucked the trend and has always had a keen eye on value. True, a starting price tag that’s just on the right side of four figures may seem high to some, but you are getting a lot of features for your money. Along with a complete toolbox of network monitoring and troubleshooting tools, you get full packet capture and decoding – two features that can cost a king’s ransom with many competing products.

This version brings in plenty of new and useful features. For starters, VoIP comes into the frame as Observer can now identify this type of traffic, decode it and provide an expert analysis of detected problems. We found the VoIP analysis useful as we’ve had some issues with call quality in the test lab and it was very useful to see what was actually happening to the traffic on our LAN. Packet capture is easy to run as you simply pull up this option from the toolbar and hit the start button when you want Observer to start buffering captured packets.

With a buffer full of data we could see a full summary of VoIP traffic along with jitter and lost packets and wise words in the panel below from the Observer Expert Analysis if it detected a problem. You can view all VoIP calls made on the network segments under scrutiny and see the phone numbers of the caller and the recipient, the call start time and the duration. Even smarter is Observer’s ability to rate VoIP calls for quality by calculating a MOS (Mean Opinion Score) from the dropped packets and jitter, which is a prediction of how a real user would rate the call. Stream reconstruction has a lot of potential uses as any TCP stream that appears in the capture buffer can be rebuilt using the relevant packets. For web use and email you can see what site your users are browsing and also completely reconstruct email messages passing over the network. Observer also displays a user’s POP3 account passwords in plain text – so be careful with this software.

Networking toolbox
For general network monitoring, Observer provides a wealth of tools – you start by monitoring the local network segment that the PC running the software is located on. Optional remote probes are also available so other network segments can be monitored from the same interface as well. The local and remote probes are accessed from the left pane of the main interface and you can add individual SNMP devices as well, although we found the options for monitoring the latter somewhat basic. Each monitoring tool loads a window with a row of controls across the top. You can discover network nodes, resolve their IP addresses and start packet capture on specific systems directly from this interface.

Real-time graphs are provided so you can easily see the top 10 users on the network, general bandwidth utilisation and protocol distribution. The Web Observer function monitors all or selected ports on web servers and all Internet related traffic can be monitored to give you a clear picture of overall usage plus specific station usage. The sub-protocols section breaks down traffic to show what percentage is composed of, say, web browsing and email.

We’ve always found Observer to be one of the best network analysis solutions on the market; with a high level of features for a price that now includes extensive VoIP monitoring. Few products can compete at this price, making it a good choice for SMEs that want to know everything that’s happening on their network.