Analyze an expanding system: getting a clear picture of the network put out daily network fires - Testing and Diagnostics

Communications News, August, 2002

For the past four years, the city of Vero Beach, FL, has been stretching its network from a two-hub system with no interbuilding connectivity to a WAN system spanning the municipality's eight locations--from City Hall to the local power plant to the police department. Along the way, network problems threatened to thwart its expansion plans.

"As we incorporated remote LANs and far-flung employees, the burden of file sharing and print jobs really slowed the network down," says Paul Mills, supervisor of voice and data networks, information systems (IS). "Data storms and collisions added to the already sluggish network when the city deployed e-mail and Internet access to all employees."

To determine what was wrong, Mills started with the most basic diagnostics--and evolved to a point where he could not identify issues without using a network analysis tool. "We had multiple problems to deal with, but no clear picture of what was wrong and--worse yet--no immediate way to find out," Mills says.

He and his IS team evaluated an array of hardware and software solutions. The city's varied and remote locations also dictated the purchase of a portable tool that installed easily on remote computers. Observer, a software-based protocol analyzer from Network Instruments, had the analytical capabilities the group needed, and was able to run on the city's existing NT workstation, as well as a PC or laptop in the field. It also was priced lower than competitive products, with a one-time licensing fee.

The initial test run unveiled protocols, such as AppleTalk, that were no longer being used in their current configuration coming from the various print servers. All of the Windows stations had NetBIOS turned on as a default, creating double traffic every time someone logged on as it searched for a Microsoft server. The team promptly eliminated or turned off the extraneous traffic, and experienced an immediate increase in response times for log-ins, print times, e-mail and Internet access.

At the time of the original network analysis, the city had a flat network with one collision domain. Then, as it added switches, analysis of its remote LANs became necessary. Mills turned to Observer probes, installed on remote stations to analyze data and report back to the PC in the main office.

An upgrade to Observer Suite allowed the city to manage its SNMP devices, such as switch port utilization and UPS monitoring. Web reporting, another feature, allows reports to be generated on a request-by-request basis from any browser.

Mills and the IS group have put the daily network fires behind them, and are now approaching their network needs proactively. "It sure is nice to alleviate a problem before users call," says Mills.

One example is the city's recent purchase of PC-audit software. Before setup, Mills wanted to know its impact on the network. Should it run on all 270 machines at once, or be broken up by department and run on 10 to 20 machines at a time? Did it pose any danger of bringing the network down?

Using Expert Observer, Mills and his group identified log-in peak times, executed a packet capture on the log-in sequence with the audit running and determined that the odds of more than 20 people logging in at the same time over the one- to three-minute audit run were remote. An analysis showed they could set up the audit to run on all stations in the background upon user login. "We've had no network hiccups since we began running the audit," says Mills.

The ability to map and display network issues has helped the Vero Beach IS team create a more efficient network, but it remains limited in its authority over how other departments use the network. "Having hard data certainly helps," Mills says, "and often, people are astounded by what network analysis can find, but they have ultimate control over their network space. We can only make suggestions as to what they do with it."

For more information from Network Instruments: www.rsleads.com/208cn-250