November 2, 1999 www.wwgsolutions.com Network Troubleshooting with the LinkView Classic Network Analyzer Network Troubleshooting Today The goal of successful network troubleshooting is to eliminate network problems or alternatively, to minimize the effects of network problems. Few important product categories are available to network managers to deal with these issues. Since a significant number of network faults occur at the network layer, companies with large to medium size networks own and use sophisticated diagnostic systems such as Wavetek Wandel Goltermann s Domino family of Internetwork Analyzers or similar products to detect, isolate and diagnose network problems. These sophisticated, hardware-based analyzers play an important role in network management and troubleshooting. Another popular category of network troubleshooting tools are network analyzers. Network analyzers are typically software-based products that interface with standard third-party network adapter cards. Some companies also provide optional hardware extensions to provide analysis capabilities, such as wire speed traffic generation, that can not be accommodated by thirdparty network adapter cards. An example is WWG s Advanced Ethernet Adapter. The primary advantage of network analyzers is that they are relatively inexpensive, provide reasonable error detection facilities and network traffic analysis, and are easy to use. Network analyzers may include sophisticated features for real time traffic analysis, packet capture, decoding, and packet transmission. The LinkView Classic Network Analyzer builds on, and improves upon, WWG's previous LinkView network analyzer offerings. LinkView Classic Features LinkView Classic is designed for monitoring, troubleshooting and protocol analysis of LAN networks. It combines the power of LinkView's traffic and protocol analysis with new features such as the extensive protocol decoding capabilities of Examine, which supports more than 350 protocols (see Figure 1), pre- and post-capture filters, and many others. With LinkView Classic users can understand daily network utilization patterns, determine the heaviest network users, understand the composition of protocol traffic, determine where bottlenecks exist and their cause and decode almost any LAN protocol. Users can also apply LinkView Classic s traffic generation capabilities to study the amount of additional traffic that a network can support. A reactive benefit of this exercise is knowing where to look when performance problems occur. Proactive benefits also accrue, including how to best spend money to improve network performance.
Figure 1: Examine s Protocol Decode window As a result of analyzing the network s traffic patterns, users can make critical decisions regarding where to partition the network for optimal throughput and response time, and how to allocate resources. Despite the fact that these performance management techniques are sometimes merely the result of common sense, most organizations still do not believe they have time to engage in this type of exercise. Unfortunately, this way of thinking often leads to emergencies that force companies to spend significant time and financial resources later. One of LinkView Classic s analytical utilities is WWG s protocol decode engine, called Examine. Protocol software is just as error-prone as any other kind of software and users usually cannot do more than identify these problems. An incompatibility among protocol software from different vendors is not uncommon, and LinkView Classic s decoder is very helpful in detecting these and a variety of other problems. The LinkView Classic network topology map provides a real time graphical view of the network and identifies who is using an IP or MAC address. It can also automatically retrieve NetBIOS, NetWare login and DNS host names. Network devices are displayed on an easy-to-use map of the network, which is updated continuously. The topology map views the network as devices or individual segments, and delivers an end-to-end picture. It automatically highlights problem areas in red, and the intuitive point and click approach allows users fast and easy access to the information they need, when they want it. LinkView Classic runs in Microsoft Windows 95/98 and NT environments, is user friendly, and does not require the level of sophistication required by traditional LAN analyzers because it automatically displays required information in an easy-to-interpret fashion (Figure 2).
Troubleshooting is not LinkView Classic s only proactive feature. It also provides the ability to compile statistics over time to build a history of network behavior. The product can be used to perform predictive analyses of network performance. For example, if network traffic is increasing by 10% a month, that trend will most likely begin to affect network performance or response times. LinkView Classic s Alarm capability monitors over 30 different critical parameters and ensures instant notification of problem areas. LinkView Classic automatically alerts users to high network bandwidth utilization, network errors, unknown workstation connections (possible intruders) and many other critical network parameters. It also supports standard paging and email interfaces for alerting a network manager in a remote location. A user-configurable Report Wizard provides customized reports for individual stations or the entire network. LinkView Classic works with any third-party Ethernet or Token Ring Network Interface Card (NIC) that supports promiscuous mode and, depending on the NIC, may support a 4 or 16 Mbit/s data rate for Token Ring networks, and a 10 or 100 Mbit/s data rate for Ethernet networks. Figure 2: LinkView Classic Analyzing Switched LANs Using LinkView Classic Windows NT Server Environment Troubleshooting a switched media environment involves a new approach in order to obtain the same level of traffic information as in a shared media environment. In many switched networks a shared resource, such as a file server, sits alone on a port and receives or transmits most of the data traffic. If the file server runs Windows NT applications, LinkView Classic can be installed on the file server. It will see all of the traffic to and from the file server, enabling the network manager to diagnose problems related to the file server.
Non-Windows 95/98/NT Environment When a workstation sits alone on a switch port and the workstation is not running Windows 95/98 or NT, a shared media hub must be added between the switch port and the server to allow a LinkView Classic-enabled Windows PC to be installed, as shown in Figure 3. If a non-95/98/nt workstation sits on a segment with multiple host candidates, LinkView Classic can be installed on any of the hosts to monitor the traffic through this server, even if it is a Unix or Netware server. The technique described above allows the LinkView Classic software to see all the traffic to and from the server, which enables the network manager to diagnose problems related to the performance of the server. Figure 3: Connecting LinkView Classic using a Shared Media Hub Using LinkView Classic in a Switched Environment The single most difficult problem that plagues any switched environment is the inability to monitor traffic inside a switch. Consequently, troubleshooting of a switched environment depends entirely on how much control the user has over the switch. Most vendors provide port mirroring to allow a monitoring device to be connected to a designated monitor port on the switched hub, although implementation details vary from vendor to vendor. Described on the following page are three common implementation techniques.
Port Tap The traffic received or transmitted from a specified port is sent to the destination ports and also to the monitor port. By connecting a LinkView Classic-enabled PC to a monitor port, remote monitoring of the traffic sent to the monitor port is possible. The monitor port traffic information can then be viewed with LinkView Classic. Figure 4: Connecting LinkView Classic in a Port Tap Implementation Circuit Tap The traffic exchanged between two specified ports is sent to the monitor port. By connecting a LinkView Classic-enabled PC to a monitor port, traffic sent to the monitor port can be viewed with LinkView Classic. Figure 5: Connecting LinkView Classic in a Circuit Tap Implementation
Switch Tap The traffic on any port is sent to the monitor port. By connecting a LinkView Classic-enabled PC to a monitor port, traffic sent to the monitor port can be viewed with LinkView Classic. Figure 6: Connecting LinkView Classic in a Switch Tap Implementation The port tap and circuit tap techniques limit the amount of traffic that is delivered to the monitor port. The forwarding technique employed by the switch can filter data sent to the monitor port. This means that for most switches many of the errors are filtered by the switch and do not appear on the monitor port. The major disadvantage of the switch tap technique is that the monitor port can easily become overloaded and consequently drop packets. This technique works best in circumstances where overall use of the switch is low. Conclusion LinkView Classic is a real-time data monitoring and analysis system that provides continuous visibility down to a single node in small to large networks. The LinkView Classic software runs on a standard, minimumconfiguration Pentium PC with 64 MB of RAM. The LinkView Classic software can run in the background while other applications are being used. LinkView Classic delivers the sharp focus that network managers have been looking for. It views the network as devices or as individual segments, and delivers an end-to-end picture. LinkView Classic runs in Microsoft Windows 95/98 and NT 4.0 environments and is user friendly. It does not require the level of sophistication needed by traditional command based network analyzers because it automatically displays information in an easy-tointerpret fashion. An intuitive graphical interface allows users to quickly assess the status of the network instead of drowning in detailed data.
Troubleshooting switched environments requires a good understanding of these environments, and more planning than when troubleshooting in a shared media environment. Several techniques are effective for using LinkView Classic in a switched environment, such as port tapping, circuit tapping, or switch tapping. For other vendor-specific techniques, consult the vendor s documentation. There are also techniques for troubleshooting switched environments when the vendor has not implemented any monitoring technology. Troubleshooting in a switched environment requires the use of an additional shared media hub with a crossover cable, or a hub with a crossover port. There are many small, portable hubs that are ideal for this application. 1999 Wavetek Wandel Goltermann. Written by Ron Mazereeuw, Enterprise Networks Division.