Corvil network data analytics is powered by high-performance Enterprise plug-ins that provide support for dozens of the most widely deployed enterprise applications, including VoIP, Storage, Database, and Web. Application data is decoded from the network in true real-time so that an authoritative record of all communication is available. As part of the decoding process, for each application, the raw data is enriched with contextual information and analytics so that problems, and their solutions, can be quickly identified.


Corvil's VoIP plug-in builds the key monitoring analytics directly from the network data to provide a real-time view of call quality and signalling performance. The plug-in supports SIP, H.323, RTP and RTCP, giving complete visibility in mixed environments. Corvil’s analytics include:

  • Corvil Discovery - Signalling and media traffic - SIP and H.323 signalling traffic and the associated RTP streams are presented in unified call records in the UI and analytics streams.
  • MOS scores - E-model MOS calculated directly from the network measurements at multiple locations
  • SIP performance metrics
  • SIP Error analysis
  • Complete record of RTP media traffic to show bandwidth utilisation and network level effects like DSCP marking


Web delivered applications are covered by a range of analytics available in the HTTP plug-in.

  • Request-response latency - Correlate requests and responses to measure server latency with support for pipelined requests.
  • Corvil Discovery - HTTP traffic is recognized regardless of port with a default categorization by server
  • Error analysis - Reporting and alerting on errors with a breakdown of status codes
  • Support for compressed content-types
  • Payload reassembly - Deep analysis of HTTP APIs with classification and alerting based on the HTTP payload of requests and responses.
  • TLS support
    • Reporting on ciphers used, key length and certificate expiration dates
    • Detection of heartbleed attacks and vulnerabilities
    • Decryption with support for resumed sessions


  • Request-response latency CIFS, NFS, iSCSI
  • Filename resolution - File names may only be referenced in the first message of an interaction with the server - plug-ins maintain a mapping from protocol-level identifiers so that names can be reported in all the subsequent messages.
  • NetApp support - The NFS plug-in decodes the NetApp filehandle format to discover volume and qtree identifiers and integrates with the NetApp ONTAP API to convert these IDs to logical names.
  • Load analysis - Categorize traffic according to servers and volumes with a breakdown of request types.
  • Error analysis - Reporting and alerting on errors with a breakdown of status codes


Plug-ins are available for Sybase, MS-SQL, MySQL, PostgreSQL and Oracle.

  • Query response latency - Queries and responses messages are paired up so that the critical response latencies can be measured.
  • Transaction Analysis - Queries that occur within a single transaction will be associated so that latency can be measured for completion of the transaction and filtering can identify all the messages exchanged with the transaction context.
  • Error conditions - Queries that generate error responses from the database will be detected, with details recorded for the query and any error description.
  • Query breakdown - Categorization of query messages into SELECT, INSERT, etc


Corvil has broad support for message-based middleware - including Informatica, Tibco, Solace, Nirvana and IBM’s low latency MQ. The analytics plug-ins provide insight into multiple aspects of middleware performance management.

  • Traffic Load Analysis
  • Performance Diagnostics
  • Business Payload Decoding and Analysis


Corvil provides decoding and analytics for a range of network protocols that support application delivery.

  • Request-response latency - ICMP, DHCP, DNS and LDAP
  • Error reporting - LDAP errors are detected and categorized: authentication failures, protocol compliance problems, timeouts
  • Netflow - Records are collected and summarized
  • Syslog - Log message payload is available for searching and is categorized by facility, severity and content.
  • RSVP
  • ARP
  • Multicast protocols IGMP, PIM, Source Discovery Protocol and PGM

Border Gateway Protocol (BGP)

BGP routers establish peering relationships to exchange information about available routes. The key peerings are normally between organizations so the source of your network problem can be outside your control. Corvil’s BGP plug-in auto-discovers peerings, provides real-time alerting about routing changes that affect your network and maintains a detailed record of all BGP messages so that root-cause analysis is quick and definitive.

  • Route withdrawal alerts with contextual information such as the name of the originating AS.
  • Multiprotocol extensions - support for standard extensions such as IP-VPN
  • Route flap detection
  • Convergence latency - measure how quickly updates are republished by BGP routers.