Design challenges for distributed LAN analysis - local area networks, HP ProbeView software, HP LanProbe monitors - includes related article on poor network partitioning - Technical

Hewlett-Packard Journal, Feb, 1992 by William W. Crandall

[NOTE: SOME FORMULA'S HAVE BEEN OMITTED]

The design of a distributed local area network management system is primarily a problem of data reduction, data transmission, and data presentation. HP ProbeView software and LanProbe monitors continuously monitor the health of an Ethernet or IEEE 802.3 network to allow the diagnosis of complicated problems without dispatched equipment.

Intermittent faults that cripple Ethernet local area networks (LANS) often cannot be detected by traditional network problem-solving techniques. By the time a traditional tool like a cable tester or protocol analyzer is rolled out to monitor the network, the problem has vanished. Users suffer from unreliable LANs while network managers suffer from the wrath of angry users for problems the managers are unable to diagnose.

One solution is distributed LAN analysis. A distributed LAN analysis tool taps into a network segment and continuously monitors it, tracking use, logging important events, detecting errors, and raising alarms over major problems. To minimize this tool's interaction with the network, it is independent of other nodes on the network. Using a network management console, network managers can retrieve information gathered by the distributed LAN analysis monitors that have been placed throughout the network. Because the monitors provide a history of network activity, the sources of transient faults can be discovered even after the network has returned to good health. The data gathered by the monitors can be analyzed to plan for the future of the network. Designing a good distributed LAN monitoring system is difficult. With several megabytes of data flowing across a typical Ethernet segment every minute, keeping track of all of the data that appears on the network would be impossible. Thus the distributed monitor must be able to filter and store only important information and send it quickly and efficiently to the network management console. The console must be able to combine the reports of many distributed monitors into an expansive view of the network's health. Only then will the network manager be able to solve specific problems and plan for the network's future growth.

To demonstrate the utility of distributed LAN analysis, we will describe how a typical customer of Hewlett-Packard's 4990S LanProbe distributed LAN analysis system might use the system to find intermittent network faults. We will then discuss the challenges that were faced in designing the LanProbe system.

Case Study: Acme, Inc.

We begin our study of distributed IAN analysis by looking at a typical large Ethernet-based network run by a hypothetical firm: Acme, Inc. Acme's networking problems are a conglomeration of the problems seen on the networks of HPs medium-size and large customers. As shown in Fig. 1, Acme's network is made up of a variety of cabling technologies (thick and thin coaxial cable, twisted pair, and fiber optic cable) that are tied together by different interconnect devices (repeaters, bridges, routers, and gateways). The network is spread around the world in engineering, marketing, manufacturing, and sales offices.

The Acme network is managed with tools like protocol analyzers, cable test equipment, and local diagnostic and monitoring software. Most of these tools are reactive, that is, they are not used until someone calls in with a complaint. Only then, for example, is the protocol analyzer wheeled out of the closet, connected to a network segment in the next building, and the problem found and fixed. Uncovering the source of many problems requires physically breaking the network so that the strategy of "divide and conquer" can be used to pinpoint the exact location of the physical fault or errant node. This type of network management is costly. Users suffer the expense of frequent and unpredictable network downtime. The company pays the price of having the network management group dedicated solely to debugging the network rather than planning for its growth and improving its efficiency.

Acme decided to place an HP 4991A LanProbe on every segment in the network. The LanProbe is a passive monitor that listens to all of the traffic flowing past it on the network. It collects and analyzes this data and sends it to a central management console running the HP ProbeView software. HP 4990A ProbeView is a PC-based, Microsoft Windows 3.0 application that provides a number of tools for examining the data that ProbeView gets from LanProbe. These tools include network and segment maps, statistics, packet trace, event log, cable test, and alert manager. Each of these tools provides useful information. The network map is a logical picture of the layout of the Ethernet segments, repeaters, bridges, routers, and gateways that make up the network. Each segment on the network map can be examined in detail by opening the segment map. This window shows the name and type of each node attached to that segment.

The statistics tool is made up of four charts that provide different views of traffic on the network over time. The QuickView (Fig. 2), trends (Fig. 3), and packet size distribution charts show what has been happening on the segment as a whole while the node traffic chart Fig. 4) breaks down the traffic on a node-by-node basis.