Colasoft nChronos Network Performance Analysis System
Network Performance Analysis System
nChronos is an application centric, deep-dive network performance analysis system. It combines the nChronos Console with the nChronos Server to deliver the capability of 24x7 continuous packet capturing, unlimited data storage, efficient data mining and in depth traffic analysis solution. nChronos captures 100% of all data captured for real-time analysis as well as historical playback.
nChronos is designed for monitoring the network traffic in medium and large corporates. It connects to company's core router or switch and monitors all network traffic, emails and chat sessions inbound and outbound. Also, it provides the ability to monitor abnormal traffic and alert upon detection of "Suspicious Conversations". Only when network engineers monitor network activities of the entire network at the packet level are they able to identify abnormal network activities and protect their companies from cyber-crime and cyber-attacks.
nChronos can not only alert an Cyber Attack, but also record all packet data. This ability helps network engineers to "rewind" and "replay" the actual network activity when it occurs. Companies have video cameras to monitor who physically enters their business afterhours, now with nChronos network engineers can monitor and record data activity in a similar manner. The time has come where theft of company assets and intellectual property from data streams and network activity is the greater threat. With a relatively minor investment, nChronos provides an insight and deep packet analysis of all network activity.
nChronos Console
Provides quick access to all distributed deployed nChronos Servers where packets are stored, it serves as the center of the enterprise network management which is capable of visualizing the overall enterprise network activities, drilling down to isolate performance issues and troubleshooting high-priority and critical network issues.
nChronos Server
Performs 7x24 real-time packet capturing and continually store to hard disk for quick packets and statistics retrieval. With flexible and non-intrusive deployment with standard network mirror port or link tap technologies, it provides native packets for the Console to go back in time and complete retrospective network analysis.
Technical Specification
| nChronos Appliance | Small/Mid-size Office | Large Office or ISP | |||
|---|---|---|---|---|---|
| Series | 2000 Series | 2500 Series | 3500 Series | 5500 Series | 7600 Series |
| Profile | 1U | 2U | 2U | 2U | 4U |
| Throughput* | 2Gbps | 5Gbps | 10Gbps | 20Gbps | 40Gbps |
| Max Conversation Capacity | 250,000/s | 400,000/s | 600,000/s | 1,000,000/s | 2,000,000/s |
| Max pps | 2,000,000pps | 3,000,000pps | 6,000,000pps | 10,000,000pps | 15,000,000pps |
| HDD | 16TB | 32TB | 64TB | 96TB | 192TB |
| Capture Ports | 6 | 6 | 4 or 6 | 4 or 8 | 2 or 4 or 8 |
| Power(redundant) | 600W | 750W | 750W | 800W | 1200W |
* The throughput may be affected by hardware configurations and traffic composition.
24x7 Real-time Network Traffic Capturing and Recording
nChronos offers real-time capturing, analyzing, and storing sustained traffic at Gigabit line rates for all data flows and packets. nChronos also provides scalable extensive storage capacity varies from 1TB to unlimited storage to meet the customizable network requirements and assure the long-term traffic storage for critical links.
Retrospectively Analyze Historical Traffic
nChronos can fast retrieve the traffic packets at any time period (real-time or retrospective), and simultaneously drill down for data-mining and full analysis. nChronos helps network users to quickly pinpoint, analyze, and resolve network and application problems, detect the attacks and threats, efficiently and in-depth analyze the network activities. By back-in-time network analysis, nChronos can efficiently solve the network interruption issues.
Real-time Network Monitoring
nChronos offers real-time network statistics, including total bytes, total packets, bandwidth utilization, top IP talkers and top application talkers. With the Real-time statistics, network administrators can instantly understand the current pattern of the network. For example, when the network gets slow, network administrators can log on to nChronos right away and see which hosts are the top talkers, and what applications are consuming the most bandwidth.
Statistical Reports
nChronos provides both system and user-defined reports. The System Reports include global report, traffic reports, protocol distribution report, application performance and transaction report, alarm reports and top talkers reports. All reports can be configured to provide actual statistics of the traffic and analysis data in specified time period, as well as the comparison to historical statistics, to thereby provide better references for network administrators. Reports can be sent to specified email recipients. Users can schedule hourly, daily, weekly and monthly reports.
Benchmark and Visualize Trends of Network Performance
Based on the long-term network traffic capture and analysis data, nChronos visualizes the statistics in trend charts to help IT stuff establish baseline for the entire network, and get hold of the trend of the network operations in long-term running, identify and pinpoint network problems, acquire the evidence for decision-making on network policies, and reinforce the overall technical level for network management as well as the ability to solve network issues.
Critical Links Monitoring & Alerting
nChronos offers visualized entire network traffic monitoring . By long-term traffic monitoring and visualizing network critical links behaviors and network traffic patterns, nChronos helps users to create a network baseline, setup online triggered alerts for network events for warning and preventing network outrages. With nChronos, there will be no critical events missed on critical links.
Efficient Drill-down for Data-mining & Index
nChronos provides efficient data retrieving and drilling down over any time period for hours, days, or weeks with accurate time stamp. It offers complete access to application level traffic flows, network statistics and data links information across all seven OSI layers level. This powerful framework can greatly reduces the time of identifying root-cause and resolving the problem.
Application Performance Analysis
One of the most critical requirements of management software is the ability to monitor and record detailed application activity. nChronos can define custom application monitoring functions as well as transaction monitoring based on the application data. Then the custom application and transactions capability of nChronos enables the network administrator to view the detailed traffic status and statistics of the application or the transactions.
In-depth Network Analysis for Performance Optimization
nChronos offers powerful ability for application-oriented analysis. The various Analysis Profiles include High-performance Analysis, Full Analysis, HTTP Analysis, high-level FTP Analysis, Email Analysis, DNS Analysis, etc., helping IT professionals to conduct in-depth network analysis with less MRRT (Mean Time to Repair) and optimize the entire network performance so as to increase enterprise network productivity.
nChronos Standard Technical Specifications
- 10/100/1000/10000 Base-T
- 10000 Base-SX/LX/ZX
Note: To have an analysis performance of 100,000 Mbps, professional capture cards are necessary.
System Requirements for nChronos Server
The following table lists the minimum system requirements for nChronos Server.
Depending on network traffic and analysis performance required, the requirements may be substantially higher.
Factors that contribute to superior performance include high speed CPU, RAM, and high performance disk storage subsystem, and enough hard disk space is required to store network packets and data that you want to have.
System Requirements for nChronos Console
For more information about Colasoft nChronos Appliance, please visit www.colasoft.com/nchronos.
How to Configure a TCP Transaction
In nChronos 5.2, a new feature, TCP transaction analysis, is provided. TCP transaction analysis allows users to define the transaction by configuring the protocol on the application level. And this would make transaction identification and analysis more accurate.
How To Use Multi-Segment Analysis to Troubleshoot Network Delay, Packet Loss and Retransmissions with Colasoft nChronos
Troubleshooting network problems can be a very intensive and challenging process. Intermittent network problems are even more difficult to troubleshoot as the problem occurs at random times with a random duration, making it very hard to capture the necessary information, perform troubleshooting, identify and resolve the network problem.
How to Reconstruct Http Packets/Data & Monitor Http User Activity with nChronos
HTTP reconstruction is an advanced network security feature offered by nChronos version 4.3.0 and later. nChronos is a Network Forensic Analysis application that captures packets/data around the clock. With HTTP reconstruction, network security engineers and IT managers can uncover suspicious user web activity and check user web history to examine specific HTTP incidents or HTTP data transferred in/out of the corporate network.
Migrating Configuration Files from nChronos Evaluation to an nChronos Licensed Version
The following steps will allow you to migrate configuration files from an nChronos Evaluation to an nChronos Licensed version on the same machine.
How to Baseline Network Throughput and Performance
Do you know what your normal network throughput volume is, what types of traffic are most used in your network? If you can't answer these questions then you should baseline your network.
How to Connect to nChronos Server
Based on the architecture that nChronos stores all data on nChronos Server while nChronos Console works like a display, users who want to view network data have to connect to nChronos Server first.
How to Display IP Addresses as Host Names
If you use nChronos to monitor traffic on a core switch you will see lots of internal IP addresses, and also the Internet IP addresses. You can find that most of the Internet IP addresses are shown as their domain name, such as www.colasoft.com.
Set up a Traffic Alarm and Get Notification Emails
nChronos provides a Traffic Alarm, which is defined by users, so as to notify there is traffic abnormal on the network.
Define and Customize a Report
Colasoft nChronos provides twelve system reports, and users can define new reports according to need.
How to View and Analyze Historical Network Traffic
As a network performance analysis solution, nChronos allows users to view historical data just by a drag. Below is a screenshot of the Time Window, you can drag the trend charts back and forth to view the network traffic of any interested time period.
Create Network Link to Start Monitoring Traffic
A network link is defined as the traffic source of a monitoring session. Depending on different editions, higher edition enables you to use one nChronos server to monitor mirror traffic from multiple NICs in one link, while basic edition may only support monitor traffic from a single NIC. .
Colasoft nChronos Overall Introduction [Video]
This short video introduces the components, user interface and important functions of Colasoft nChronos. Please leave a comment for suggestions or feedback below. Thank you.
nChronos Console Overview
nChronos Console provide quick access to all distributed deployed nChronos Servers where packets are stored, it serves as the center of the enterprise network management which is capable of visualizing the overall enterprise network activities, drilling down to isolate performance issues and troubleshooting high-priority and critical network issues.
nChronos Configurations
nChronos is a Network Performance Analysis Solution for high performance & critical enterprise networks. It combines the nChronos Console with the nChronos Server to deliver the capability of 24x7 continuous packet capturing, unlimited data storage, efficient data mining and in depth traffic analysis solution. Follow a few simple steps to deploy nChronos.
nChronos Deployment
After the installation of nChronos, this step by step guide helps you finish all the necessary configurations before nChronos actually start working. Now you have a DVR for Network Data. Simply dial back the time and watch historical traffic of your network from last week as if in "real-time".
How to Identify Top Talkers
nChronos provides a link monitor window which automatically shows top talkers. They are: top segments, top applications, and top internal hosts. With these charts, you can quickly identify the top talkers at a glance. You can also modify the refresh interval for the charts if you like or change the number of Top Talkers displayed.
How to Rewind Historical Network Traffic & Solve Problems
Network problems never occur when you watching the network. With nChronos you can now simply "rewind and replay" your network traffic. This allows you to isolate and solve the network problem based on the first occurrence. You no longer have to wait for it to fail again to solve the problem.
Top 5 Reasons to Buy nChronos
nChronos is an affordable deep pack recorder and network forensic solution that can help you isolate many network issues in a matter of minutes.
Here are the top 5 reasons to buy your company a nChronos...
Users can activate nChronos Server on Server Administration webpage or from nChronos Console
How do I activate nChronos Server on Server Administration webpage?
- Enter the IP address of nChronos Server in the address bar of the browser to open Server Administration webpage and log in with default username and password.
- The Product Activation webpage pops up. Read the privacy declaration and then click Next.
- Enter the serial number, choose Active online and click Next to complete the activation.
How do I activate nChronos Server from nChronos Console?
* Only works for version 4.X.
- Start nChronos Console.
- On the Server Explorer, click to
add the nChronos Server that you want to activate. - hen the Server appears on the Server Explorer.
- Double-click the server node, for example, local server.
- Then a message box pops up to prompt that the Server is inactivated:
- Click Yes, and then follow the Activation Wizard to complete the activation.
What's the difference between Activate online and Activate with license file?
There are two options to activate nChronos Server: Activate online and Activate with license file.
Activating nChronos Server online
To activate nChronos Server online, just enter the serial number and then click Next to complete the activation. This method is very quick and easy, and the activation process will only take a few seconds.
If you have Internet connection, you are recommended to activate nChronos Server online.
Activating nChronos Server with license file
When you don't have Internet connection or failed to activate online, you can choose this method to activate nChronos.
Enter the serial number, choose "Activate with license file", and then click Next. You will get an interface as the figure below:
The license file is generated by the serial number and the machine code, and can be obtained by two ways: via Colasoft Webpage and via Colasoft Support.
Obtaining license file via Colasoft webpage
Follow steps below to obtain license file via Colasoft Webpage:
- On the activation interface, click the link in Option 1, and then Colasoft Activation Webpage pops up:
- Click the button Save as Bin to save the license file as a .bin file.
- On the activation interface, click Browse to import the saved .bin file, and then click Next to complete the activation.
Obtaining license file via Colasoft Support
Follow the steps below to obtain license file via Colasoft Support:
- On the activation interface, copy the information of serial number, machine code, as well as product version, and send it to
- Colasoft Support will send you the license file via email.
- On the activation interface, click Browse to import the license file and then click Next to complete the activation.
- Study your network topology and find the perfect place from where you want to capture traffic you need. The core switch (a managed switch) is the perfect choice, which enables you to capture all data on the switch, and a hub or Tap works for data capture as well.
- Read System Requirements (both nChronos server and console) to prepare a server and a machine for console.
- Install nChronos server on the server machine and activate it.
- Follow step-by-step guide to initiate nChronos server, and create a network monitoring session.
- Install nChronos console on the machine, and activate it.
- Add a server connection information, and connect to the server to view monitoring data on the server.
Read 
Getting Started Guide for more details.
Want to Know More About nChronos?
nChronos is a Network Performance Analysis Solution. It integrates real-time network monitor with long-term network data storage, drilldown and retrieval. nChronos includes nChronos Server and nChronos Console in client/server architecture. nChronos Server is for traffic capture, analysis, statistics and storage, while nChronos Console is for data presentation, analysis and output by accessing data from nChronos Server.
HTTP port is for users to access nChronos Server from web browsers to make configurations, while TCP port is for nChronos Consoles to connect to nChronos Server for acquiring data.
Yes, the connections between nChronos server and console are encrypted by private encryption algorithm, which secures data transmissions and minimizes the length of data.
nChronos Server is based on CentOS from v5.0, and nChronos Console is based on Windows.
Have Problem While Installation
Based on nChronos architecture, nChronos Server should have at least two network adapters, one for capturing traffic and the other for communicating with nChronos Console.
Yes, nChronos Server can be accessed from web browsers for configurations.
Yes. nChronos can simultaneously monitor the traffic from multiple network adapters as one traffic source and/or as multiple traffic sources. To monitor as one traffic source, set up one network link and the traffic will be analyzed aggregately. To monitor as separate traffic sources, set up a network link for each capture interfaces and the traffic would be analyzed separately.
No. Once nChronos Server is installed, the related services start automatically when Windows starts. Users can use Colasoft nChronos Service Manager to start, stop and restart related services.
Yes. One nChronos Server can be accessed by multiple nChronos Consoles and one nChronos Console can connect multiple nChronos Servers simultaneously. Users can create multiple accounts for one nChronos Server with different privileges.
Since nChronos Server requires lots of system resource to capture, analyze, and store large amount of network traffic, it is not recommended to install nChronos Server on a virtual machine.
According to our license policy, one license can only be activated on one machine or one OS. If you want to reinstall nChronos on a new machine or on the same machine which is reinstalled with a new OS, there will be a notice: You have reached your installation limits. You should completely uninstall nChronos previously installed and then install it on a new machine or new OS, or you can just contact us for help.
Have Problem While Using
First you need to make sure the server is up and running, and then check if you use the same communication port number as specified on the server (by default port # 3,000). Then you need to check your account and password.
You need to click-n-drag on the trend chart to select a time slice. When a time span specified, the views will show data among that time period only.
To drill down, just double-click the item you are interested in. The drill-down function is available for the Application view, the Physical Address view, the Network Segment view, the IP Address view, and the IP Conversation view.
After configuring SMTP settings, please click Test to check if the settings are correct.
In any view, check the items that you want to download the packets of them, right-click and choose Download Packets from the context menu. Then specify a local folder and file name to save the packets, and then click Download button. Note that you are not suggested to check too many items and download packets from a remote server because they may take a large volume of traffic and take a long time.
Yes. nChronos provides capture filter capability. Users can define any capture filters to just capture and analyze interested traffic. Besides, nChronos provides display filter capability. User can search and view interested items.
Yes. nChronos provides real-time alarms. All the alarms can be defined by users according to actual network status. When alarms are triggered, the alarm logs can be sent to specified email addresses.
Yes. nChronos provides some default reports and users can add new reports according to need. Furthermore, users can schedule daily reports, weekly reports, and monthly reports. All reports can be sent to specified email addresses.
When trend charts display with traffic, but no packets can be downloaded, please check if the trend charts display with red scales. The red scales indicate that the packets are discarded due to the circulation of storage space.
Yes. nChronos can replay packets file of following formats: Colasoft Packet File (*.cscpkt, *.rawpkt. *.cscproj), Accellent 5Views Packet File (*.5vw), EtherPeek Packet File (V9) (*.pkt), HP Unix Nettl Packet File (*.TRC0; TRC1), libpcap (Wireshark, Ethereal, Tcpdump, etc.) (*.cap; pcap), Microsoft Network Monitor 1.x, 2.x (*.cap), Novell LANalyzer (*.tr1), NetXRay2.0, and Windows Sniffer (*.cap), Sun_Snoop (*.Snoop), and Visual Network Traffic Capture (*.cap).
Yes. nChronos can analyze the traffic down to protocol field level. Click the button ˇ°Analyze Packetsˇ± to launch the Expert Analyzer which is a built-in component, and then you can go to the Packet view to view packet decoding information.
Yes. When upgraded from nChronos 4.0, nChronos 4.1 can inherit the configurations and the historically captured data.
When forget the administrator password, you can create a new administrator. First open Colasoft nChronos Service Manager, and then on the menu Configure click Create Administrator to create a new administrator. You can go to the User Account page to delete the original administrator.
This error sometimes happens upon upgrading. Please re-active your nChronos and the license will work fine. For information on how to re-active nChronos, please refer to http://www.colasoft.com/nchronos/server-activation.php.
Yes, you can enable this feature in Name Table Options.
Yes, nChronos is capable of monitoring and analyzing VLAN traffic, you can check the information of VLAN traffic in the VLAN tab in Link Analysis.
Yes, you can customize applications in nChronos as needed, including standard application, web application and signature application.