Real-Time Perspective.

This article provides information on the TrueSight TS-1000 Real Transaction Monitor from Coradiant. The device gives real-time view of the end user experience without throwing extra traffic at the Web application servers. Built on Gentoo Linux, the device is easy to set up. The initial configuration must be done from a serial connection. From there, the user can create a security-officer account and set up network parameters. Traffic capture is off by default. Once traffic capture began, it took about 60 seconds for the device to classify data and show it on the front page. Because of its location on the network, TrueSight watched both inbound and outbound traffic. Its value comes from its watchpoints, perspectives built from data taken by watching the network from the tap and resembling each user transaction. Users can choose from about a dozen preconfigured watchpoints or create their own. Like other network monitoring device, TrueSight must first decrypt the Security Sockets Layer Web traffic users want to analyze. They must give the device the private key of the Web server generating the traffic. One loaded into the device's one-way encrypted jail, the key cannot be viewed. Only a designated security officer can manage or remove it.