Network audit Campina UK Horsham November 10th, 2004-1 -
Contents Contents... 2 Problem description... 2 Problem description... 3 Current infrastructure... 4 Test... 5 Test setup... 5 Test results... 9 LAN... 9 Router... 10 Advise... 13 Conclusions... 13 Advise... 14-2 -
Problem description The site of Campina International located in Horsham (UK) experiences low performance on the connection with the corporate network (CMNet). The performance does hinder the employees in their daily work. The main applications for which this connection with the corporate network is being used are: - SAP, the SAP servers of Campina UK are located at PinkRoccade den Bosch (NL); - Email, several times a day, mail exchange take place between the email server in Horsham and the email server located in den Bosch; - Internet, for the connection to the internet, the same connection to the corporate network is being used; The poor performance is experienced most when accessing the Internet. The employees in Horsham use the internet mostly for marketing and commercial purposes. Due to the nature of the websites the employees access, the bandwidth requirements are quite high (many graphical components and downloads). - 3 -
Current infrastructure Horsham has a 100 Mbps switched Ethernet LAN infrastructure in place. This infrastructure is based on Cisco and Alcatel switches. Approximately 40 workstations, a moderate number of printers and a couple of servers are connected to the LAN. The connection to the CMNet (corporate network) is established via a Cisco router that is connected to a 256 Kpbs frame relay network of MCI. The router itself is connected via a 100 Mpbs connection to the LAN. Additionally there is a connection via a leased line with an external warehouse. SAP Servers Campina UK External WH Den Bosch MCI Internet 256Kbp LAN 100Mbps Switched ethernet Horsham - 4 -
Test Test setup MCI claims there are no performance problems in the MCI LAN-to-LAN connection between Horsham and den Bosch. PinkRoccade in den Bosch does not experience any performance issues in the LAN and the IAS infrastructure in den Bosch. Based on these two statements and the fact that similar performance problems are reported in the other Campina International locations in Moscow, Warsaw and Barcelona, Campina Headquarters decided to perform LAN measurements in Horsham. FW infra Den Bosch MCI Internet LAN 100Mbps Shared ethernet 256Kbp Fluke Optiview probe LAN 100Mbps Switched ethernet Horsham - 5 -
During the audit a so-called Fluke probe was installed between the MCI router and the LAN segment of Horsham. While measuring, MCI and PinkRoccade were contacted to ensure no vital information was missed: PinkRoccade monitored the LAN and IAS infrastructure in den Bosch; MCI performed a LAN-to-LAN monitor on the connection between den Bosch and Horsham; During testing not all users were at the location. Nevertheless the usage of the infrastructure can be marked as representative. During testing approximately 10 users were working with SAP, 6 were active on the internet. This covers the average usage of the main applications. The audit was performed with a Fluke Optiview Integrated Network Analyzer and a Fluke Network Inspector (V5). Network Inspector Console Hub Network Inspector Agent (probe) Internet Optiview (probe) Switch Andere hosts In segment The Network Inspector Console constantly gathers information that is collected by the Inspector Probes: the Network Inspector Agent and the Optiview. From this data, the Optiview builds several reports on an hourly basis. These reports cover the last two hours of data that is collected. - 6 -
During the audit the following steps were followed: - At first an audit over a small period of time of the LAN segment. This audit was used to have the equipment discover all the components in the network and to quickly discover possible general performance issues. - A second longer audit (approx 5 hours) in which all the traffic on the segment was measured and analyzed in detail. From this audit, the Optiview produced the following reports on an hourly basis: o Number of collisions; o Number of errors; o Ethernet usage (bandwidth); o IP inventory; o NetBIOS inventory; o Protocol mix; o Top protocols; o Top talkers/top receivers/top broadcasters; - The priority was set on monitoring the ports of the MCI router. Both the Ethernet as the serial port were closely monitored. Usage and possible errors on these ports were registered. - A final short audit of the LAN segment to again get an overview of all components and possible errors was performed for comparison and reference; - 7 -
Following reports were created: o Ethernet Collision Summary : number of Ethernet collisions during the time of the audit; o Ethernet Error Summary : number of Ethernet errors during the time of the audit; o Ethernet utilization : bandwidth usage during the audit; o IP inventory : discovery of all IP enabled devices in the LAN segment (due to the usage of VLANs this might not be complete); o NetBIOS inventory : discovery van all NetBIOS devices in the LAN segment (due to the usage of VLANs this might not be complete); o Protocol mix : all protocols and there volume that were measured during the audit; o Top Protocols and Applications by Host : most used protocols per host during the audit; o Top talkers/top receivers/top broadcasters : hosts with their respective volume of traffic sent, received and broadcasted during the audit; o Summary of the following parameters per report spanning a period of two hours: Packet rate (Ethernet packets per second); Broadcast packet rate (Ethernet broadcast packets per second); Number of collisions during audit; Number of errors during audit; Average bandwidth usage (Mbps) during audit; Average percentage Citrix protocol during audit; Average percentage SNMP protocol during audit; Average percentage HTTP protocol during audit; Average percentage traffic sent by top talker; Average percentage traffic received by top receiver; - 8 -
Test results LAN The LAN segment is considered Healthy. Some small remarks are nevertheless necessary (see the Optiview reports in the appendix): Netbeui is still being used. This should be removed as soon as possible. This protocol has poor performance and is considered unsafe; IPX is still being used. De-activate if not necessary; The switches need configuration. Because of the fact that they are un-configured, measurement on switch level was very hard or impossible. A missing Spanning Tree Configuration on some of the switches can cause network problems; The usage of the HTTP protocol on the LAN segment is very high. This indicates a high usage of Internet and / or Intranet. Indeed these applications are the mostly used on the LAN and generate the most traffic on the MCI router; - 9 -
Router The MCI router was monitored in detail: both the LAN port (100 Mbps) as the WAN serial port (256 Kbps). This resulted in the following conclusions: The LAN port is only being used for a fraction of the total capacity. The fact that this is a 100 Mbps port means that a tiny bandwidth usage on this port will already complete flood the WAN port. No errors were found on this port; LAN poort router < 1% utilisation - 10 -
The WAN port utilization is constantly over the 30%. No errors were found on the port; As soon two or more users are accessing the internet, the utilization will be over the 80 or 90%; WAN poort - 11 -
Proxy in Den Bosch 2 HTTP users At PinkRoccade in Den Bosch no performance problems of any concern were found. Also no errors were found when using a packet sniffer; At MCI a high load on the line is measured but no 80 to 90% as measured by the Optiview probe; - 12 -
Advise Conclusions - The demand for Internet access in Horsham is very high. The usage of sites that need a high bandwidth (marketing and other commercial information will have higher bandwidth demands in future); - The available 256Kbps at present is not sufficient. The connection already is being utilized for 80-90% for most of the time as concluded in the preceding chapter; - We cannot detect if MCI delivers the promised the 256Kbps at all times. We do assume they do. Because of the different rates in speed between the serial and the Ethernet port, a 0.25% utilization of the latter one will completely flood the WAN port. This was basically the case the whole time; - Authentication / authorization problems as reported by the uses in Warsaw and Moscow are not found in Horsham. It is advisable to audit these sites in detail to find out what is causing the problems over there; - 13 -
Advise The following options are available to upgrade the performance in Horsham: 1. Upgrade of the present MCI line. The costs and the possible upgrade options must be discussed with MCI or another operator. Advantage: Easy and quick to deploy; Disadvantage: Expensive; Unclear how much the line must be extended as this is dependent on the usage of the different applications; 2. Split tunneling (connections). This means that only the business applications like SAP, Email and intranet are routed over the MCI line. The traffic destined for the Internet is handled by a local internet connection. Advantage: Relatively cheap; In control: by implementing these techniques centrally, decentralized and unknown / unmanaged (do-it-your-self) initiatives will be avoided resulting in a much more secure environment; Guaranteed bandwidth for the business applications; No need for upgrading international dedicated lines when Internet bandwidth requirements grow; For Horsham: the leased line to the warehouse can be eliminated as traffic can be redirected via a VPN internet connection. The warehouse connection would then be in-line with the Campina security policies; Disadvantage: Requires a firewall (managed centrally) and an additional internet connection (DSL low costs). This is a new approach for Campina and needs some investigation; Although new for Campina, this split tunneling techniques is used by many companies. Implementation therefore can be accomplished with common of the shelf products and do not require Campina specific solutions. - 14 -
SAP Servers Campina Den MCI Internet External WH LAN 100Mbps Switched Horsham - 15 -