Application Performance Monitoring (APM) is a set of techniques for measuring how applications perform over the network, using metrics such as connection setup time, response time, retransmissions, and round-trip time. Versa distinguishes passive APM, derived from observed TCP traffic, from active APM, based on synthetic SaaS application tests.
Key takeaways
- Passive APM reads TCP session timing inline; active APM runs synthetic tests.
- Metrics include RTT, retransmissions, connection resets, and response time.
- The Versa application rank scores application quality from 0 (best) to 100.
- Historical APM aggregates every 5 minutes; live APM reports the last 2 minutes.
- APM is resource-intensive, so enable it selectively on traffic of interest.
On this page: Why it mattersHow it worksTypesAPM & VersaFAQ
Why is APM important?
Generic network probes only measure the network layer: an ICMP ping reports round-trip time and packet loss, but says nothing about how an application behaves for the person using it. A healthy ping can coexist with a slow login screen or a stalling SaaS app, because the problem sits above the network layer – in TCP session setup, server processing, or application-layer retries. APM closes that gap by measuring the session itself: connection setup time, server response time, and retransmission rate.
That distinction matters operationally. Teams need to know whether their environment meets performance standards from the application’s point of view, not just the wire’s, without deploying separate agents inside every application. Because VOS devices already see every session passing through them, APM derives this insight from traffic already in flight – turning a network appliance into an application-experience sensor with a metric that reflects what users actually experience.
What is APM?
APM is fundamentally a timing analysis of TCP sessions. As a VOS device forwards a session, it timestamps the TCP handshake – SYN, SYN-ACK, and ACK – and derives the SYN-to-SYN-ACK (SSA) RTT, the SYN-ACK-to-ACK (SAA) RTT, and their sum, the SYN-to-ACK network response time (NRT). It also tracks retransmissions, connection-refused and connection-aborted counts, and – for Releases 22.1.1 and later – response time and an application performance score (APS) for HTTP/HTTPS traffic.
These raw metrics roll up into two composite scores: the Versa Link Rank and Application Rank, each a value from 0 (best) to 100 (worst) that summarizes an application’s or link’s quality. Because measurement happens inline on production traffic, no synthetic probe or client-side agent is required.
Types of APM
Versa splits APM into two complementary methods, both visible on Analytics dashboards. Passive APM is single-ended measurement of live TCP sessions: the VOS device observes handshake timestamps, retransmissions, and response times on real traffic, with no synthetic load generated. It requires enabling TCP performance monitoring under a traffic-monitoring policy rule, and reports both historically (aggregated every 5 minutes) and live (the last 2 minutes, on demand in Releases 22.1.1 and later).
Active APM takes the opposite approach: it runs synthetic tests against specific SaaS applications on a schedule, regardless of whether real users are generating traffic at that moment. That makes it useful for catching a SaaS outage before a user reports it, complementing passive APM’s reliance on organic traffic. Live APM also folds in MOS scoring for RTP/RTCP voice traffic.
APM & Versa
Passive APM is configured per organization through a traffic monitoring policy rule: an administrator selects the applications to match, enables TCP monitoring, and assigns a LEF profile that exports the metrics. SD-WAN or TDF must be enabled first, globally and for the organization. Exported logs land in Analytics as TCP and active application-monitoring records, cataloged in the Analytics Log Collector log types overview.
Results surface on the SD-WAN dashboards in Director, under Analytics > Dashboard > SD-WAN > Sites: a Passive APM tab breaks performance down by application, source, destination, and remote site, an Active APM tab shows synthetic SaaS results over time, and a legacy combined APM tab remains for Releases 21.2.3 and earlier. Because logging APM data is bandwidth- and CPU-intensive, Versa recommends enabling it selectively on traffic of interest rather than globally.
Frequently asked questions
What is the difference between passive and active APM?
Passive APM observes live TCP sessions as they cross a VOS device and requires no synthetic traffic. Active APM proactively tests specific SaaS applications on a schedule. Passive APM reflects genuine user experience; active APM can surface a SaaS outage even when no real user traffic is currently flowing.
What metrics does APM collect?
APM collects TCP handshake timing (SSA RTT, SAA RTT, SYN-to-ACK NRT), forward and reverse retransmission counts, and connection-refused and connection-aborted counts. For HTTP/HTTPS traffic it also derives application response time, server response time, and an application performance score – all rolled into the Versa Link Rank and Application Rank.
What is the Versa application rank?
The Versa application rank is a composite score from 0 (best) to 100 (worst) that summarizes an application’s performance from its underlying TCP metrics – RTT, retransmissions, and resets. Analytics dashboards color-code the rank green, yellow, or red so the poorest-performing applications stand out immediately.
Does enabling APM affect device performance?
Yes. APM logging adds load comparable to running application offload, and aggregating per-tenant, per-application metrics for export consumes bandwidth on both the VOS device and the Analytics node. Versa recommends enabling TCP performance monitoring selectively rather than across every session.
What is the difference between historical and live APM reporting?
Historical APM aggregates performance metrics every 5 minutes and exports them to Analytics nodes for long-term dashboards and trend analysis. Live APM, available in Release 22.1.1 and later, reports the previous 2 minutes on demand from the Director Monitor tab – useful for troubleshooting an issue as it happens.
Related terms
If you’re reading about APM, these are worth looking at next.
| Round-Trip Time | Path | SD-WAN |
|---|---|---|
| A core APM metric: the time for a packet to reach a destination and return. | The end-to-end route whose quality APM and SLA monitoring measure between two branches. | The fabric that steers traffic across paths, often using APM-derived quality scores as input. |