We rolled out a dedicated NPAS sensor to capture traffic in one of our data centers. We doing some monitoring for SQL traffic for a couple of servers, HTTP for a few web boxes, and a print server. While trolling the data I noticed that I get gaps in the data in some of the graphs for some of the servers. (See below.) The interesting thing is that I *don't* see those same gaps in the Application Response Time graphs for the same sensor and applications.
I thought that the Application Response Time (Time to First Byte) included the TCP handshake time, but unless I'm dropping data from my NPAS (which I don't see in other graphs) I must be wrong.
This is what I found on the interwebs about TTFB - "This TTFB value is the DNS lookup time + the initial TCP handshake + the time it takes to receive the first HTML header response." In my case the HTML header response would be SQL application response, but the idea fits.
What say ye?
