Network Monitoring with SMS

Display Panes
When you use the Network Monitor, keep an eye on the Total Statistics Pane, which contains ASCII information on network statistics and captured frame statistics. In particular, watch % Buffer Utilized. If this number exceeds 100 percent, you will begin to lose capture data in your buffer, and you probably need to design a tighter capture filter or increase the buffer size.

The Graph Pane provides five different graphical representations of the activity on your network: percent of network utilization (from 0 to 100), number of frames per second, number of bytes per second, number of broadcasts per second, and number of multicasts per second. Three numbers under each bar represent, from left to right, the minimum, average, and maximum number achieved in the category.

With the Graph Pane, you can quickly assess which category network activity originates from. For instance, if your network shows a high percent for utilization, you can use the Graph Pane to examine traffic classification. Is the traffic normal or showing a large number of multicasts or broadcasts? With the data on the bar graphs, you can determine the type of traffic on your network. For example, if you see high utilization (resulting in slow network throughput) but a high number of broadcasts, determining and correcting the broadcast problem will improve performance.

To identify stations consuming a great deal of network bandwidth, refer to the Station Statistics Pane at the bottom of the window. This pane summarizes all traffic on the network on a station-by-station basis. It shows the network address, number of frames sent and received, number of bytes sent and received, and number of broadcasts from the station. Review the information on the line appropriate for the station in question. For example, assume that your users are complaining of sluggish output. A review of the Graph Pane shows you have a significant amount of activity but nothing extraordinary (such as a significant numbers of broadcasts). How do you determine the source of the problem?

Double-click any column header within the Station Statistics Pane to sort in ascending order all rows by the values in the column. Double-click a column title a second time to re-sort all data in descending order. Thus, to identify users consuming a large amount of bandwidth, you can double-click on the Bytes Sent or Bytes Received columns to observe the stations consuming the most bandwidth.

The Session Statistics Pane contains information about the individual sessions running on your network and other useful details. It tells you where the packets originate and their destinations, with a packet count from the originating station sent to the destination and vice-versa. This pane also lists various system addresses, such as the NetBIOS multicast and IP Broadcast addresses, so you can identify stations that are sending a lot of packets in those categories.

Once you identify the offending station, you may have to take the process one step further and retrieve the machine name for the station (if the Network Monitor does not provide the machine name by default) so you can determine which user is causing the traffic. You can obtain this name through the SMS database and determine whether the traffic you observe is normal or a potential problem.

Buffer Review
Statistics collection and review are only two of Network Monitor's capabilities. By far, Frame Viewer Window is a more powerful feature. With it, you can review the contents of the packets traversing your network.

To access the Frame Viewer Window, stop the Network Monitor's packet collection: Click Stop on the toolbar and then View, or use the Network Monitor shortcut key (Shift+F11) to stop and immediately view the capture buffer contents.

The Frame Viewer Window consists of three panes, as Screen 2 shows: the Summary Pane, Detail Pane, and Hex Pane. The Summary Pane displays a summary of packets in the capture buffer. The Detail Pane displays the frame's contents, including protocol information. The Hex Pane shows a hexadecimal and ASCII representation of the captured frames.

To use the Frame Viewer Window, you first shuffle through the overview of frames in the capture buffer listed in the Summary Pane. The data in this pane includes a frame number, time of capture, source and destination MAC addresses, the protocol used to transmit the frame, and a description of the frame's contents.

From the Summary Pane, identify the frame you want to view, and click it. The data in the Detail and Hex panes will change to reflect the frame you selected. The Detail Pane uses an Explorer-like, drill-down method for viewing capture data. When you select a packet from the Summary Pane, the Detail Pane will automatically show you the packet components. Each component will have a plus or minus symbol next to it to show whether you have exploded the view of that component. Each time you click an entry in the Summary Pane, you highlight the hexadecimal data the Network Monitor uses to decode the frame.

For example, for a typical Ethernet packet, you'll view three or more packet components. The first component is the base frame properties, the second consists of flags marking the packet as an Ethernet packet (including which Ethernet frame type is in use, such as 802.2 or 802.3), and finally the components of the particular protocol (FTP, DNS, etc.). When you click the plus symbols, you expand the individual components and can view their structure. Here you might discover that a TCP checksum or message became corrupt during transmission.

The true power of the Frame Viewer Window is that it lets you view firsthand the data traversing your network. This feature is powerful for advanced network administrators who want to view the types of requests and data from both source and destination addresses. When you selectively target individual workstations, you can inspect transmissions to look for telltale problems such as data corruption in frame headers or data packets. In these instances, you might have a physical-layer networking problem where an outside influence, such as electromagnetic interference, is causing your network problem.

Monitor Caveats
Network Monitor's limitations include its small default capture buffer and the need to have this capture buffer in real memory. The default size is 1MB, a value that causes the buffer to rapidly fill up if you have a busy network. To change this value, choose Capture from the menu-bar and select Buffer Settings. Because the capture buffer must consume real, not virtual, memory (and thus avoid potentially losing network frames), keep this buffer size to a small, reasonable value (based on a percentage of your total system memory) to prevent system degradation.

Another Network Monitor limitation is its ability to capture statistics only on the first 128 nodes it detects on the network. If your network has more than 128 nodes, the network monitor will detect only the first 128 nodes and generate statistics from them. This data might falsely show less activity on your network than you have.

Another potential problem is segmented network traffic. If you segment your network using an Ethernet switch, the Network Monitor will see only packets that transmit over the leg of the network that the monitor is physically connected to. Again, this data might show an apparent decrease in the amount of traffic, especially if you use workgroup features on a segmented leg of a network where you don't run the Network Monitor. To combat this problem and obtain more precise statistics on your network's performance, install Monitor Agents on qualifying client machines on each leg of your segmented network. You can then interrogate and collect statistics from those agents with the centralized Network Monitor utility.

Even with these caveats, SMS's Network Monitor utility is powerful and flexible. A network administrator will find it helpful in diagnosing network problems.