Network and Protocol Analyzers Part 1

The first level of network testing consists of making sure that the underlying physical cabling structure is performing as expected. The next level is to monitor and test the network traffic and messages generated by the network protocols to be sure that you have a healthy network. Network analyzer products operate by monitoring the network at the Data Link and Transport layers in the OSI reference model.

Again, you will find that the tools you can select for protocol analyzers range from the very inexpensive (free) to the very expensive (several thousand dollars). One difference between these kinds of tools and those used to check cables, however, is that you need to have a good understanding of the network structure and protocols used before you can make meaningful judgments about the data you collect. The LAN analyzer allows you to intercept network traffic as it passes through the wire in real- time and save the data for analysis. A good analyzer should be able to produce meaningful statistics about the traffic on the network, decode the protocols that are used, and provide a good filtering capability so that you don't get bogged down in an overwhelming amount of data.

You should consider many factors when deciding on a network analyzer product. The most basic factor is whether you want a portable device that can be transported to different sites or one or more devices that can be placed at strategic locations in the network to perform continuous monitoring. Other features to consider include the following:

• Price—Of course, this is always a factor when purchasing equipment for a network.
• Software or hardware—Do you need a dedicated hardware instrument that can perform intense analysis and connect to multiple segments, or can you live with a software implementation that runs on an existing network workstation?
• Network interface—Do you need to connect to just a 100BASE-T (or even higher bandwidth devices) environment, or do you need a device that connects to other topologies such as FDDI or Token-Ring?
• Protocol stack support—Is your network homogeneous, or does it support multiple network protocols?
• Statistics—What kind of statistical data does the instrument support? The most basic is frames-per-second. Others include utilization and usage. Utilization is a measurement of the actual amount of bandwidth that your network media is supporting at any point in time. Usage statistics can tell you what is using that bandwidth—from protocol statistics to such things as the number of collisions on a shared Ethernet segment.
• Memory and buffers—Does the instrument provide enough buffering capacity to capture frames on a high-speed network such as 100BASE-T? How about Gigabit Ethernet?
• Filters—Does the analyzer provide sufficient filtering capabilities to allow you to look through large volumes of data to get to the frames that really matter?
• Import and export—Does the device allow you to save files to a disk or another medium so that you can transfer them to other workstations for further analysis?

A good LAN analyzer allows you to monitor network traffic in real-time mode, using filters to narrow the scope of your view. You can set up capture filters, store part or all of the frames that match in a buffer, and perform further analysis.

Growing Beyond a Small LAN

The basic devices used to interconnect network segments: repeaters, bridges, switches, and routers. Each of these devices builds on the one previous to it so that together they span a continuum of functionality that you can use to solve problems with a LAN or WAN. Standard bridges were developed to enable you to extend the reach of a LAN and to limit traffic to local segments, therefore building on the function of repeaters. Switches took this concept further by enabling each workstation or server to have its own physical LAN segment, thus limiting the broadcast domain (just the workstation and the switch). Routers enable you to extend the reach of a LAN by connecting it to a wide area network.

Note

A switch that operates in full-duplex mode eliminates the collision domain between the switch port and the device attached to it. Instead of using the same set of wires for transmitting and receiving data (half-duplex), full-duplex switches use separate wires for transmitting and receiving, so both ends of the path can be sending information at the same time. Thus, a switch port and network card operating in full-duplex mode can essentially double the network bandwidth.

To quickly summarize:

1. Repeaters are simple devices that connect network segments (usually two segments). They repeat all traffic by regenerating and attenuating a signal, allowing the standard distance limitation to be extended. They do not, however, do anything to help segment network traffic patterns. Repeaters are used to expand a LAN when it grows beyond the limitations imposed by a single network segment. Multiport repeaters function in the same way, but resemble a hub in that more than one segment can be connected to a multiport repeater. However, multiport repeaters are typically used in much older environments that use coaxial cables for the network media and use BNC connectors. Most hubs have RJ-45 jacks and receive twisted-pair wiring with RJ-45 modular connectors. If your network still uses repeaters of this type, you're long overdue for an upgrade.

2. Bridges are similar to repeaters except that they apply a little intelligence to the packet- forwarding process: Bridges learn MAC addresses of devices on each segment when they make an initial transmission. From then on, a bridge will not pass traffic to another segment if it knows the recipient is on the segment local to the transmission. Bridges are helpful for expanding a LAN and can be used to group collections of computers and servers that commonly interact to lower overall bandwidth consumption.

3. Routers work like bridges in that they're selective about which packets get forwarded on which ports. However, whereas bridges operate at layer 2 of the OSI reference model (the Data Link layer) and look only at the flat namespace provided by the MAC addresses, routers operate at layer 3 (the Network layer) and make decisions based on the addressing scheme provided by a higher-level networking protocol. Bridges are typically used to create larger local area networks. Connecting a LAN to other LANs or to a larger WAN can be done using a router.

4. Switches are the current technology for connecting network LAN segments as well as for connecting individual network nodes to the network. Switches operate like bridges in that they keep track of which network node is located on each port by remembering MAC addresses kept in system memory. When retransmitting an incoming packet, the switch will send it out only on a port that will get it to its destination, provided that it has already learned the destination's MAC address. Whereas bridges usually have only two ports, switches are like hubs and contain many ports. Most switches will allow for full-duplex operation, thus effectively doubling the available network bandwidth for a single node connected on a segment. In a sense, a switch operates like a collection of bridges. And don't forget that you can connect one switch to another to further localize network traffic. A LAN today can consist of multiple layers of switches that eventually connect to a router.

From this summary, you can see that it's easy to use repeaters or bridges to grow the small LAN, but when it becomes necessary to expand beyond certain limits or when it becomes necessary to make a connection to a larger LAN, you must incorporate routers or switches. Growth is not the only reason you might want to use a router or switch, however. These devices also can be used in a small LAN. For example, a small LAN that's experiencing network traffic congestion might find relief by replacing the hubs in the LAN with switches to cut down on the overall network traffic. Indeed, if you look at the price of a switch today, the benefits you will achieve in network bandwidth are well worth the price. When users begin to complain about network response time in a network that uses hubs, you should definitely consider replacing hubs with switches.

In addition to connecting LANs to larger networks such as the Internet, routers can be used in a campus LAN to allow network administrators to logically group network segments using the addressing scheme provided by TCP/IP (subnetting), for example.