MSA Project Analysis Options - Omnipeek

Once you have created or opened an existing MSA project window, you can access the Multi-Segment Analy- sis Options dialog to edit segment, synchronization, and limit options. Additionally, you can add notes for the project.

To edit MSA options:

1. Click Analysis Options in the MSA project window. The Multi-Segment Analysis Options dialog appears.

   

2. Complete the dialog:
   • Insert: Click to insert a new segment. You will be prompted to name the segment and select a supported capture file.
   • Edit: Click to edit a selected segment. You can choose to rename the segment or choose another supported capture file.
   • Delete: Click to remove a selected segment.
   • Move Up: Click to move a selected segment up in the ordered list of segments.
   • Move Down: Click to move a selected segment down in the ordered list of segments.
   • Auto Arrange: Click to arrange the segments in order from client to server based on the TTL values in the packets. If you create MSA projects that include multiple flows, all of the flows in the project should be initiated from the same direction. If you create MSA projects that include NAT (Network Address Translation) segments, apply a Mapping Profile before selecting Auto Arrange.
   • Clear Manual Offsets: Click to set the manual offsets to zero.
   • Column Header: Displays the column headings currently selected. Right-click the column header to enable/disable columns. Here are the available columns:
     • Segment Name: The name of the segment.
     • Calc. Offset: The automatically calculated synchronization offset for the segment.
     • Manual Offset: The user-specified offset. A manual offset can be used instead of, or in addition to, the automatically calculated offset.
     • Total Offset: The calculated offset plus the manual offset.
     • Mapping Profile: The mapping profile associated with the segment. A mapping profile can be created to map private addresses/ports to public addresses/ports. See Creating a mapping profile below.
     • File: The location and packet file on which the MSA segment information is based.
     • Columns…: Displays a dialog that lets you enable/disable and organize columns.
     • Show All Columns: Displays all available columns.
   • Disable auto synchronization: Select this option to disable automatically calculating offset values.
   • Automatically calculate synchronization offsets: Select this option to enable automatically calculating synchronization offset values. All Capture Engines should be set to the correct time, preferably through the use of an NTP server. But, even with the use of NTP servers, offsets may be needed to adjust for slight timing inaccuracies across Capture Engines. Automatic calculation of synchronization offsets is based on the TCP SYN and TCP SYN ACK packets. If a segment does not contain the SYN and SYN ACK packets, there will be a dash (–) in the Calc. Offset field. If the MSA project contains multiple flows, the automatic calculation of synchronization offsets is based on all flows.
   • Limits: Select this check box to enable the limit on the number of packets analyzed per flow, and then enter or select the number of flows.
   • Notes: Type any notes to append to the MSA project.
3. Click OK.