BEST PRACTICES Network Setup of LAN-XI Systems This document is intended for all users of Brüel & Kjær LAN-XI systems. It can be read end-to-end as an introduction to networking, or used to look up specific problems or scenarios. Terminology and Quick Hints The following terms and concepts are all supported by LAN-XI unless otherwise stated. Term Auto-MDIX Auto-IP Cables DHCP DNS Firewall Flow Control Front-end Setup Description and Hints A concept in which standard or cross-over Ethernet cables may be used. This is standard on Gigabit devices A Microsoft concept in which hosts configured as DHCP clients can talk together (get IP addresses that match). This is also known as link-local. Auto-IP has a 2 minute start-up time before DHCP is abandoned Always use CAT 5e Ethernet cables or better Dynamic Host Configuration Protocol allows dynamic IP addressing Domain name service. This is what pairs URLs such as www.bksv.com with IP addresses. It is not needed in a LAN-XI network that uses IP addresses directly A device or piece of software that blocks certain programs and/or types of network package. There is no firewall in LAN-XI as we consider it to be a server, but there is most likely one on your PC. If it causes problems, you can try to set it to default, and then start PULSE. It will ask whether to open connections to LAN-XI say yes Flow control prevents congestion. TCP gives end-to-end flow control, but we also need flow control between Ethernet nodes. This is ruled by 802.3x and is known as PAUSE frames. This must be enabled in the switches used as well as on the PC The program that comes with PULSE LabShop, PULSE Reflex Measurements and PULSE Data Recorder Type 7708 and needs to be run when a LAN-XI configuration is changed. The Help in this program contains useful information. A Network Diagnostics Tool with digital and analogue self-tests is included
Gateway Host IDASync IP Address IP Mask LAG Link Aggregation NAT Network Config NIC PoE Private IP range The gateway is the router that connects to the Internet. If a network interface card (NIC) is used for the Brüel & Kjær equipment alone, this NIC needs no gateway. The gateway address on the NIC connected to the company network is usually set when the NIC gets its other settings (IP address and mask, DNS server) via DHCP In network terms, a PC as well as a LAN-XI device is a host in contradiction to, for example, routers and switches Synchronization between frames based on BNC cables. Remember terminators at the ends (built-in on some IDA e equipment) Ensure that the network interface card (NIC) and all LAN-XI modules have the same network ID (the part of the IP address that corresponds to 1-bits in the mask) Ensure that the NIC and LAN-XI modules have unique host IDs (the part of the IP address that corresponds to 0-bits in the mask) Note that the Front-end Setup program can easily apply a range of IP addresses and masks if the LAN modules have been found. The current version of LAN-XI supports IPv4 (not IPv6) The safe way is to have the same mask on all LAN-XI modules and the NIC to which they are connected. To make exceptions to this, you need a good reason and knowledge of subnetting Traffic from many LAN-XI devices to a PC via a switch network is like a river where smaller rivers merge as they get closer to the PC. At first 1 Gbps is fine further downstream more is needed. As described in this document, several wires from a switch to the PC can be used. This can be done by subnetting or by doing Link Aggregation. This feature is supported by the SRW-2008MP switch as well as larger switches and many multi-port NICs. Note that LAG inhibits PTP and thus can only be used for the link to the PC not between LAN-XI devices. In reality, this means that a huge switch can sit in the centre of a star configuration getting data from LAN-XI devices. Most of the traffic will go from this centre to the PC. Here LAG makes sense Network Address Translation. Allows many users on an intranet to share public IP addresses. Not something in LAN-XI but may be implemented in your router Ensure that the Brüel & Kjær traffic is isolated from the company network in one of the following ways: Have one NIC for the office network and one for the Brüel & Kjær network (and not bridging these) Have a switch between the PC, the modules and the office network (will still issue a few broadcasts to the office net) Network Interface Card (Net card). In high-end applications this should be of the PCI express type Power Over Ethernet IEEE 802.3af. Allows the power needed for each module to be carried by screened shielded twisted pair (S/STP or S/FTP) CAT6 LAN cables rather than by separate power cables. Note that PoE has a start-up time during which power-source and -sink negotiate A range of IP addresses that by definition are non-routable on the Internet, and therefore may be reused over and over, in private networks: 10.*.*.* 172.16.*.* 172.31.*.* 192.168.*.* We recommend the following concept: 192.168.<frame-no>.<slot-no> with Netmask = 255.255.0.0 The PCs relevant IP address might be 192.168.1.100 Remember to allocate IP addresses for managed switches if these are to be used 2
PTP Precision Time Protocol IEEE 1588 v2 makes it possible to synchronize the clocks in the system components with sub-microsecond accuracy. Notice: Please observe that LAN-XI frames have two LAN connectors. When using PTP the leftmost of these seen from the rear must be used to carry this traffic. All frames/modules participating in a setup must be able to see each other through switches. After power up, a PTP network may take a few minutes before it is in sync. If multiple switches are used, select the Low Confidence setting in the Front-end Setup program. This allows for a looser control loop. Static IP address VPN The quality is surveyed and compared with a boundary. If the quality is below a certain limit, an error is flagged (in PULSE LabShop, see the Level Meter help for an explanation). The boundary is stricter in High Confidence mode than in Low Confidence mode A concept in which the administrator gives each host a unique, fixed address Virtual Private Network (allows a PC remote access to a company network). This introduces a firewall that may obscure communication with, for example, a private network outside the company s IP range Network Setup Fig. 1 A standard network setup Subnetting or Private Networks with Fixed IP Addresses UL-0265 PULSE Measurement System Switch Internet 192.168.0.200 PC 10.116.0.56* Office net * Insert company IP range 150113 In Fig. 1, a standard setup is shown, where the PC has two NICs (net cards). One of these is connected to the office network, while the other is used for the LAN-XI equipment. The LAN-XI-equipment is connected in a star, around a central switch. In this case the switch also powers the modules using PoE. In the setup in Fig. 1, the LAN-XI equipment uses static IP addresses from a Private Range. There are a number of these ranges (see wikipedia.org). The module addresses are, for example, 192.168.0.1 192.168.0.2, etc. and the network mask on the modules, as well as the connected NIC, is 255.255.255.0. This network mask signifies that the first three bytes are the same for all hosts on this network (including the connected NIC but not the other NIC), while the last byte must be unique. The nice thing about this IP range is that it is never routed on the Internet (except as part of a VPN), so you can use them without worrying about interference. When separated * behind another NIC as in Fig. 1, it can even be used multiple times in the same company. * The two NICs are separated (no transient traffic) as long as they are not setup as a bridge on the PC 3
Fig. 2 Another standard network setup Using DHCP to Assign IP Addresses UL-0265 PULSE Measurement System Switch Internet DHCP Server Cable to office net 10.116.0.56* PC Office net * Insert company IP range 150114 Fig. 2 shows another standard setup, where only one NIC is used. All LAN-XI modules and the NIC on the PC can see the company DHCP server, so it makes sense to use DHCP addressing on all modules (your IT department would probably not like anything else!). Using Auto-IP to Assign IP Addresses A DHCP-based setup will, in fact, work without the cable to office net in Fig. 2. In this case you have a separate Brüel & Kjær analysis network. If all LAN-XI modules and the PC are configured as DHCP clients, they will wait for a setup and eventually use Auto-IP, where they negotiate addresses in the 169.254.*.* range, with net masks becoming 255.255.0.0. Whenever LAN-XI modules are set to use DHCP, they will default to Auto-IP (also known as Link-Local) if there is no DHCP server. This is normally also the case on the PC. This can be checked in the Network Alternate Configuration. To do so: 1. Click Control Panel > (Network and Internet >) Network and Sharing Center 2. Click on the network Connection link. 3. Click Properties and select Internet Protocol Version 4 (TCP/IPv4). 4. Click Properties and select the Alternate Configuration tab. Fig. 3 The PC's NIC is setup to use Auto-IP The minimal use of this is a PC connected directly to a single LAN-XI module practical for small measurements and demos. The downsides of Auto-IP are: The timeout-period at each power up The risk that a DHCP server IS connected after some time. This will change all IP-addresses As a part of the Auto-IP standard, a host (PC or LAN-XI module) that has used this before, will try to start with the same IP address as last time. LAN-XI is enhanced to handle changing IP addresses. This allows PULSE LabShop and Data Recorder Type 7708 to work even though IP addresses have changed since last time. But they cannot handle IP addresses that change while measuring. 4
Synchronizing Modules and Frames PTP (IEEE 1588) is used to synchronize individual LAN-XI modules and frames. Fig. 4 Generic or multiple switches used This works best with a central switch in a star-configuration preferably one of those recommended by Brüel & Kjær. This gives a High Confidence and the system is configured with a tight control loop as High Confidence in the Front-end Setup program see Fig. 4. (Right-click and select Synchronisation Options in the Synchronisation tab of the Front-end Setup program). If your switch is not listed in the LAN Switch Type drop-down, select Generic LAN Switch. If several switches are used in a hierarchy, the control loop needs to be looser select Low Confidence. In this case, the LAN Switch Type is also Generic LAN Switch. Note that with PULSE 19 the synchronization options were extended with: The ability to have several parallel PULSE systems with each their PC but clock-synchronized to the same PTP subdomain. Set one system in Shout Mode and let the others have External PTP Master (see Fig. 4). These options are only visible when Advanced Synch Setup is chosen via Edit > Options in the Front-end Setup. The ability to take advantage of the GPS in newer frames using it as a kind of Grand Master PTP In both the above cases, recordings will have sample-accurate timestamps, and recordings may "meet" in PULSE Reflex where, for example, cross-spectra can be calculated. Setup for Large Bandwidths (More than One Network Interface Card) Fig. 5 Multiple NICs, each with their subnet 192.168.0.1 11 UL-0265 PULSE Measurement System Switch 192.168.0.21 31 192.168.1.1 11 192.168.1.21 31 192.168.0.100 PC 192.168.1.100 All masks: 255.255.255.0 150117 The setup in Fig. 5 demonstrates how multiple NICs can be used for high data rates. In this case PCI Express NICs are recommended. Note how two subnets are used, so that traffic from two frames goes to one NIC, while traffic from the other two frames goes to the other NIC. A single switch is used to ensure that all four frames are on the same PTP-domain. In this case, the switch becomes the bottleneck. There are, however, ways around this. Another way to achieve bandwidths between 2 Gbps and 8 Gbps is to use Link Aggregation where the NIC and the switch are using 2 8 cables between them adding their capacity. In such a setup, there is no need for two subnets. LAG is first set up on the switch then on the NIC (Intel uses the term team ). LAG filters out PTP and may thus only be used between a PC and a central switch. 5
Avoiding Common Errors Setup with More than One Switch In the basic setup, all LAN-XI modules can see each other through a single switch. If more switches are applied in a hierarchy, the PTP synchronization scheme must be relaxed a little to allow for buffers filling and emptying. Selecting Low Confidence in the Synchronisation Setup is recommended in this case. Private Network Connected to a Router/Gateway In Fig. 1 the office network is connected to the Internet via a gateway/router (not shown). This is the typical setup. However, it is also possible to use a router instead of the switch in Fig. 1, with the LAN-XI modules separated from the controlling PC, allowing the LAN-XI private network to be at the other side of the world! This means that the LAN-XI modules will belong to another IP range than the NIC connected to them. The front-end browser, however, is not able to see the modules (because broadcasts cannot pass through a router). But if you know the IP addresses and masks of the modules, this information can be manually entered in the Front-end Setup program. You can also separate the individual modules by a router. This is generally not recommended for two reasons: 1. Routers are normally slower than switches. This can be helped by buying a layer 3 switch which is a term for a fast router. 2. LAN-XI modules (and frames) use UDP multicasts to negotiate PTP time. A router must be configured to let these pass through. A tick in the right column means detectable by using Tools > Diagnostics in the Front-end Setup program. What Symptom if NOT done Diagnostics When using PTP in frames, make sure that the leftmost LAN Bad PTP synchronization connector (viewed from rear) is used When using PTP, make sure that all nodes (frames and modules) can see each other. This might not be the case if, for example, two NICs are used for independent subnets, or the switch blocks multicasts No PTP synchronization When using PTP, make sure that the correct switch and LAN confidence level are selected Disable VPN on NIC used for LAN-XI/IDA e. This is essentially a firewall Set up firewall correctly. Especially on Windows 7: Beware of several domains. Home, Work, Public. Allow Front-end Setup, PULSE LabShop and Type 7708 in all Disable Proxy Server in Internet Explorer At least on local network Make sure NIC speed is not too low for data flow (for example, 10 Mbps due to battery operation, or simply miscalculation of amount of data) With IDASynch: remember cables and terminators Make sure that wrong submask is not used in module or PC Enable Flow Control (802.3x) on NIC + Switch Synchronization errors flagged by PULSE LabShop/Type 7708/Reflex Measurements No connection to modules No connection to modules or empty front-end browser Degraded performance and slow retrieval of module s home pages Front-end Setup program shows firmware version as unknown Front-end setup cannot apply configuration Front-end setup works OK, but PULSE LabShop/ Type 7708/Reflex Measurements quickly stops working No data on IDA e. Bad phase on LAN-XI Modules appear in front-end browser, but no home page or other connection Gaps in data in PULSE LabShop/Type 7708/Reflex Measurements N/A ( ) ( ) 6
PoE: Ensure that the switch powers all used ports Ensure that no dormant PulseService is present from previous PULSE LabShop session Ensure no overlapping IP ranges on NICs Ensure the same firmware on all modules and not older than the PULSE release that uses it. Reported by PULSE LabShop or Type 7708 from version 16.1 Setup Issues Modules restart, for example, when feeding transducers In Front-end Setup modules are Connected but PULSE LabShop/Type 7708 cannot connect Some modules connect others do not Strange phenomena N/A Firewalls A good place to start is Wikipedia, http://en.wikipedia.org/wiki/comparison_of_firewalls, which compares a number of personal firewalls that is, firewalls that are installed on a PC. LAN-XI coexists with many firewalls including the Windows Firewall that is built into the operating system. The first time a program, for example, PULSE LabShop, accesses the network, you are asked whether this is OK. In order for the program to function, you need to respond Yes. On Windows 7, you may need to do this more than once, since Windows 7 has different settings for different scenarios, for example, Public, Private and Work. Windows 7 uses IP addresses to detect which of these scenarios is relevant (and sometimes decides against the user s will!). Some IT departments enforce stronger rules. One case is not allowing ad hoc networks, such as those made with the Auto-IP (Link-Local). In such a case, it will help to use a small switch with a built-in DHCP server. These are sold for the small office/home office market at very reasonable prices. Fig. 6 VPN installs a firewall Virtual Private Network When a PC is remotely connected to the company network using VPN, a firewall is effectively in place. Often the PC is on a private home network with other PCs, printers, etc., but also connected to the office via a gateway/router. If the PC did not include a powerful firewall, this setup would correspond to having all the computers and printers on the company network. This firewall will normally be visible in the Local Area Connection properties that is found by clicking Control Panel > (Network and Internet >) Network and Sharing Center, selecting the Connections link and displaying the Properties. In Fig. 6 this is Check Point SecuRemote. If this is disabled, the PC can run Auto-IP with a LAN-XI module, but it cannot run VPN. Proxy A PC may be setup to use a Web proxy. This proxy is a special in-house server that handles all communication to and from the Web in reality anything to or from port 80 on TCP. It caches this, so that the second user that asks to see a specific home page may get the one recently received. This saves bandwidth. However, this may greatly interfere with LAN-XI, which uses HTTP for retrieval of Web pages as well as for some specific commands (using a concept known as REST). 7
The proxy may be bypassed but note that the checkmark in Bypass proxy server for local addresses is not enough (see Fig. 7, left). Any address that is not an URL on the domain is considered non-private. This includes all IP addresses. For this reason the Advanced page must be used and the IP range used must be entered in the Exceptions field (see Fig. 7, right). Fig. 7 Left: In Internet Explorer, go into Tools > Internet Options > Connections > LAN Settings Right: In the Advanced Proxy Settings, include the range used for LAN-XI Antivirus Programs Traditionally, antivirus programs have a few well-defined functions: 1. Scan hard disk on command or at specific hour. Possibly only specific file extensions. 2. Scan mails before opening (or when retrieved by an email program). 3. Scan executables when opened. Fig. 8 Symantec Network Threat Protection On slows the system Even though item 3 could delay the startup of, for example, PULSE LabShop, it is not really inhibiting. But today some programs also have Network Protection (or similar names). This means that all data sent or received is scanned. Apart from the risk of false virus detection (due to data patterns that look like viruses), this may slow down the PC considerably when using LAN-XI or IDA e. Link Speed NICs, switches and LAN-XI equipment negotiate to find the fastest speed (as well as PoE and Rx/Tx wires). Some NICs have problems with this, and it may be better to configure these statically to a fixed speed (via the PC s adapter settings). If you experience problems on the network, the Windows Task Manager can be used to show the current link speed. This will also reflect the use of Link Aggregation by showing, for example, a 2 Gbps connection if two wires are aggregated. Ethernet Flow Control When possible, the switch/nics should be configured to allow Ethernet Flow Control. This evens out the network traffic. Flow control is always enabled in LAN-XI (but not in IDA e ). 8
Useful Windows Commands When viewing traffic in the Windows Task Manager, the curve will be smoother when using Ethernet Flow Control (compared to not using this feature). The following is a list of practical network-related console commands under Windows, along with the most used command modifiers. Many of these stem directly from Unix and Linux, others are slightly changed and some are Windows specific. arp Command ftp ipconfig (linux: ifconfig) nbtstat netstat nslookup pathping ping route telnet tracert (linux: traceroute) wireshark Usage Show or edit the arp table (known IP addresses and their MAC address): -a shows all -s can be used to add manually FTP client shell (try FileZilla instead) Show current net card configurations: /all gives more info /renew causes a DHCP update Show Netbios table (Netbios is an old Windows discovery protocol) Show current TCP/UDP connections, their state and attached processes: -a shows all including listeners -b shows the executable (warning: slow) -n uses numbers instead of names for ports -o shows process IDs DNS lookup. Shows the correspondence between IP addresses, names, etc. Does a tracert then pings each host on route and generates statistics Simplest way to see if there is hole through to a remote host Show or edit the route table (routes to networks and hosts): PRINT shows the table ADD allows adding Client shell redirects your keyboard commands to remote and see its output Can be used with non-default port numbers to do manual http, etc. Set localecho is useful when simulating, for example, http Trace the route to a given host Network protocol analyzer that lets you see what's happening on your network. See wireshark.org 9
Brüel & Kjær and all other trademarks, service marks, trade names, logos and product names are the property of Brüel & Kjær or a third-party company. ËBR-2313---ÊÎ BR 2313 11 2015-06 Brüel & Kjær. All rights reserved. Brüel & Kjær Sound & Vibration Measurement A/S DK-2850 Nærum Denmark Telephone: +45 77 41 20 00 Fax: +45 45 80 14 05 www.bksv.com info@bksv.com Local representatives and service organizations worldwide Although reasonable care has been taken to ensure the information in this document is accurate, nothing herein can be construed to imply representation or warranty as to its accuracy, currency or completeness, nor is it intended to form the basis of any contract. Content is subject to change without notice contact Brüel & Kjær for the latest version of this document.