Network and Protocol Analyzers Part 4

Capture Triggers

After you create a capture filter, you can begin to capture data based on it by selecting Capture, Start. When using a narrow filter to look for a specific problem that doesn't occur often, you can set up an event to notify you when a matching frame is finally detected instead of having to sit at the console and wait. To set a capture trigger, select Capture, Trigger.

The Network Monitor allows you to monitor overall traffic on the network by watching the graphs displayed in the Capture Window, and it allows you to look at specific frames to determine where problems exist. Similar to a hardware LAN analyzer, a good software LAN analyzer can be a valuable tool for determining network use or for troubleshooting specific protocol problems. Still, to view all network traffic, you'll need another network monitor, such as that included with Microsoft's SMS, or a third-party-product.

Other Software LAN Analyzer Products

The fast microprocessors used in today's desktop and laptop computers allow for a wide range of software products to provide functionality that used to be primarily the domain of hardware-based analyzers. The preceding section looked at the built-in LAN monitoring tools available as part of the Windows operating system. However, a large market exists for software-based LAN analyzers, and they are usually much less expensive to deploy than their hardware counterparts.

Before investing in a software LAN analyzer, you should try before you buy. Following is a list of a few good products that allow you to either download a demonstration version or order a CD that you can use to evaluate the product before making a purchase. Don't buy the first product you look at. Instead, determine whether the documentation is up to par, whether the company provides good technical support, and, most important, whether the product is intuitive and easy to use.

Ethertest LAN Analyzer for Windows—This LAN analyzer from Frontline Test Equipment, Inc. (FTE), runs on systems ranging from Windows 95 to Windows XP. You can download a demo of this product at www f t e com. If you're in the process of deploying Bluetooth technology in your LAN, you might also want to download a demo of FTE's SerialBlue Bluetooth.

Observer, Expert Observer, and Observer Suite from Network Instruments—These products perform everything from simple network protocol analysis to SNMP (Simple Network Management Protocol), RMON (Remote Monitoring) console, and probe reporting. The software also runs on systems ranging from Windows 2000 to Windows Server 2003. Additionally, the Observer product line also includes support for IEEE 802.11a and 802.11b wireless networking.

Wildpackets—An assortment of network analysis tools can be downloaded, ranging from the highly rated EtherPeek LAN analysis tool to AiroPeek for wireless LAN analysis. You can download demos for these and other valuable tools by visiting www . wild p a ck et s .com.

This is only a short list of the large number of products available, and they are not rated as to which is best because it depends on your needs and how your network is laid out. However, you should download the demos listed here so that you can get an idea of what you can expect from a software- based LAN analyzer. If you're going to spend money on such a product, make sure it's an informed purchase.

Hardware Analyzers

This type of instrument can cost as much as tens of thousands of dollars. Hardware analyzers, however, provide functionality in a critical situation that might not be obtainable from a software-based product. A hardware LAN analyzer can be taken to the location where a problem exists and be connected to the network to perform its functions. A hardware instrument will most likely be better able to cope with a high-speed environment, such as 100BASE-T and 1000BASE-T, than a software application that relies on a standard network adapter card to get traffic from the network medium. Hardware analyzers contain special circuitry that is used to perform many functions must faster than can be done via software, and are usually more reliable.

Another thing to consider when comparing hardware to software analyzers is that when you use a PC or a workstation to act as your LAN analyzer, it might be limited as to what the NIC can do. For example, some ordinary adapter cards have built into their firmware a function that automatically discards certain kinds of packets that contain errors. If you are trying to detect what errors are causing problems on your network while troubleshooting, a software product running on a workstation might not be able to help you.

Also, although it's true that network adapter cards can literally see every packet on the network as it zips by, that doesn't mean that the cards are capable of capturing the data and passing it up to higher- level protocols. When a card does capture all frames and pass them up the protocol stack, it is operating in promiscuous mode. Some cards are designed specifically not to do this, so be sure to check the documentation that comes with the one you might want to use on a workstation that will host LAN monitoring software.

Hardware analyzers are expensive because they usually do a very good job and are designed specifically for what they do. Most have built-in disk drives to store captured data, including a floppy disk drive that can be used to exchange data with PC workstations. Be sure that the instrument has enough memory to buffer significant amounts of data. Another feature to look for is a good display so that you can monitor utilization graphically as well as display the contents of individual frames.

A hybrid analyzer that combines the best of the hardware and software products is also available. This type of device implements the capturing and filtering functions in a hardware component that attaches to a workstation, which then provides the display and storage functions. The hardware component has dedicated circuitry and processing power to capture data from the wire, and a software application on the PC is used to filter, calculate, and display the data. This type of device can be external to the PC, although some are implemented as cards that plug into the system's bus.

From Bridges to Routers continue...

Using a Router to Segment the Network

Like bridges, routers can be used to isolate traffic between network segments. Unlike bridges, routers further reduce network bandwidth use because they do not pass broadcast messages from one segment to another unless programmed to do so. A router also does not have to take time to learn which nodes are connected to each segment. The information it needs is configured in advance—the administrator assigns protocols and addresses to each port. Routing protocols also use various methods to update each other about network topology as it changes.

One very important reason why routers are used to help organize a network into segments is that routers enable you to connect many network segments. Whereas bridges are limited to a few thousand nodes, depending on the topology used, routers can enable the LAN to be connected to an infinitely larger WAN, such as the Internet.

The internal processing that routers must perform make them slower than bridges (although that might not be the case with most high-end routers being manufactured today), which need to examine only a small amount of data in the packet header. Although this performance difference will not be noticed on network segments with only moderate traffic use, you might find that you need to place routers at only strategic locations throughout the network, retaining switches for connecting other computers or network segments. Remember that you can connect individual computers to a switch port or use the port to connect to other switches.

The method you use will depend on the usage patterns that can be monitored for each segment and the cost of the links used to connect different segments. Another thing to consider is that many of the high-end routers available today operate at what is called "wire speed." That means they can route packets at virtually the same speed as the network medium, with just the very slightest delay for processing time.

Connecting to a Larger WAN or the Internet

When connecting the LAN to a WAN, a router is required. When connecting to the Internet, for example, you cannot use a bridge or a repeater. The Internet is composed of a hierarchical IP address space and a router is needed to participate in this hierarchy. Or you might plan to use a dedicated line of some sort to connect to a larger corporate network. In that case, placing a router between your LAN and the WAN hardware, such as an ATM switch connection, will help reduce the traffic that crosses the expensive dedicated connection by keeping local traffic confined to the local network segments.

Note

There are two situations in which a router is not needed to make an Internet connection. The first is if you have a modem- based dial-up connection. Although it's possible to set up routing tables in operating systems such as Windows and Unix/Linux, this isn't really a practical method for connecting a small office IAN to the Internet due to the very limited speed.

The other situation is when you use a broadband connection, such as a cable or DSL modem. In this case, you can connect the high-bandwidth modem to a single computer and then set up routing tables so that other computers can send and receive traffic through the computer, which operates as a router. However, there's a better idea in a Small Office/Home Office (SOHO) or Remote Office Branch Office (ROBO) environment or a home environment where everyone from the parents to the kids have their own computers: Purchase an inexpensive 4-6 port router (for less than $100 in mast cases) that you can connect to the cable/DSL modem. These types of routers require very little knowledge about computers and can usually be set up in less than a half-hour.

Although you'll certainly have to configure the ports that connect the local LAN and the WAN interface, you might have to reconfigure addressing information on clients. For example, if you're already using a valid TCP/IP network address, possibly a subnet of the corporate network address space, you'll need to configure only routers.

If your business has just been acquired by a larger concern, however, you might find that your LAN has been assigned a new subnet by the larger corporation. In such a case, you'll probably have to plan on downtime for end users in order to make changes to important servers, such as Domain Name System (DNS) servers. DHCP servers (which workstations can find themselves) are used to translate between user-friendly names and IP addresses. Although DHCP can dynamically assign configuration information to workstations, important servers, such as DNS servers or gateways to other networks (usually routers), must have a static (unchanging) address. This is because part of the configuration information that DHCP supplies to clients is those addresses! If the address of a DNS server changed with every reboot of the server, you would have to reconfigure the information on each workstation client—a tedious effort even in a small network!

By using DHCP, you can overcome client configuration headaches such as this. Just reconfigure the DHCP server with the address range for the new subnet, add in the DNS servers and default gateway, and reboot your client computers. This is a simple explanation of the information supplied by DHCP servers. Indeed, you can use DHCP to provide configuration information for many other network parameters.

From Bridges to Routers

Routers are inherently slower than bridges when it comes to forwarding network packets. This is because a router must read further into each network frame to get Network layer addressing information, whereas a bridge merely looks at a fixed location for the MAC address. Hubs, bridges, and switches can be set up in a short amount of time and usually require little or no configuration.

Routers require that the network administrator configure networking information for each port that's used. The command set available to configure a router is quite large because it's a very flexible device and can be confusing for a novice. The kinds of information you need to configure a new router are

1. A list of the network protocols for which you'll be using the router. For example, TCP/IP or IPX/SPX.
2. The routing protocol that you'll use for each network protocol. For example, RIP.
3. Whether or not you'll need to set filters to block certain addresses or IP or UDP ports—a tech• nique used to create a simple firewall.
4. Information about the address space used on each segment the router will connect.

Network Protocol Issues

In many networks, more than one network protocol is used on the same medium. To do their job, routers need configuration information about each protocol for each port. For example, because each port on the router connects to a different network segment, each port must have a unique network address that it can use to communicate on the segment. If you plan to restrict some segments for security or other reasons, you'll need to create a set of access control lists (ACLs) for each port, which indicate which frames are allowed through, in both directions.

When using a router to connect to a larger WAN, you'll probably be faced with having to configure a port on the router that uses a WAN protocol, such as Frame Relay, in addition to protocols you're already familiar with on your network. With a WAN connection, you'll have to coordinate your activities with other system administrators to ensure that the router is configured with the correct information for the larger network.

Network Addressing Issues

Because the router makes decisions based on a higher-level networking protocol, such as IP, you'll have to take into consideration your current address space when you decide to introduce a router into the network. If you're adding new segments to the LAN and have the freedom to choose a new network address, this can be an easy task. If you're going to take an existing LAN and use a router to separate it into more manageable segments, you have two possible choices. You can use your original network address for one segment and create new networks on the remaining segments or you can use subnetting.

Regardless, you'll have to then reconfigure each client with new addressing information. If you're using DHCP, the process is made simpler because you can make the changes at a central location and have clients request the new information after the changes have been made. DHCP is the most prevalent method used today to configure workstations and other non-server devices on a network.

If you're going to use a router to connect your LAN to a larger corporate network, you might not have to make any addressing changes on your network, depending on the company's overall network plan. You'll still have to configure the ports, however. If you're going to connect the LAN to the Internet, using a router configured as a firewall might be something to consider.

Other Router Management Issues

Routers are very much like smart PCs that have been customized to perform the routing function efficiently. They have CPUs, memory, and I/O ports just like an ordinary PC. They also have an operating system, which is subject to periodic updates by the manufacturer. So, in addition to learning how to configure the router, you'll also need to become familiar with the commands used for such functions as saving a copy of the system image to a server for backup purposes and performing troubleshooting and testing.

Managing a network that uses routers can seem a difficult task at first. However, by enabling you to organize your network according to the hierarchical network address spaces used by upper-level network protocols, the initial configuration problems will be worth the effort.