Analysis of simultaneous multi-point packet capture and display of the analysis

A method for presenting packets captured in a network, the method comprising:

• identifying a first set of packets from a first packet group of a plurality of captured packet groups;
• identifying a second set of packets, that corresponds to the first set of packets, from a second packet group of the plurality of captured packet groups, wherein the second set of packets comprises encapsulated versions of the first set of packets, the first set of packets are captured at a first network element in the network, and the second set of packets are captured at a second network element in the network;
• and
• displaying representations of the plurality of captured packet groups, wherein at least one of the first set of packets and the second set of packets are presented with a different appearance from other packets of their respective packet group.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit presents packets captured at a plurality of points in a traversal through a network, the program comprising sets of instructions for:

• at a controller;
• receiving, from at least one agent operating on a first host computer, a first packet group comprising a first set of packets;
• receiving, from at least one agent operating on a second host computer, a second packet group comprising a second set of packets, that corresponds to the first set of packets, the first and second packet groups comprising packets associated with a logical network implemented by managed forwarding elements executing on host computers including the first and second host computers;
• comparing the two sets of packets to identify a set of issues with the second set of packets;
• and
• displaying representations of the first and second packet groups, wherein at least one of the first set of packets and the second set of packets is presented with a different appearance from other packets of their respective packet group to represent the set of issues with the second set of packets.

A non-transitory machine readable medium storing a program which when executed by at least one processing unit presents packets captured in a network, the program comprising sets of instructions for:

• identifying a first set of packets from a first packet group of a plurality of captured packet groups;
• identifying a second set of packets, that corresponds to the first set of packets, from a second packet group of the plurality of captured packet groups, wherein the second set of packets comprises encapsulated versions of the first set of packets, the first set of packets are captured at a first network element in the network, and the second set of packets are captured at a second network element in the network;
• and
• displaying representations of the plurality of captured packet groups, wherein at least one of the first set of packets and the second set of packets are presented with a different appearance from other packets of their respective packet group.