Chapter 15 Chapter 15: Network Monitoring and Tuning

Chapter 15 Learning Objectives n Establish network benchmarks n Install Network Monitor Driver n Install, configure, and use Network Monitor, including setting up filters and triggers n Install and configure SNMP service

Chapter 15 Learning Objectives (continued) n Use System Monitor to monitor a network n Troubleshoot and tune a network

Chapter 15 Network Monitoring n Networks are dynamic with changing patterns of activity and rapid growth toward more high-bandwidth demand n Monitoring a network is important to be able to distinguish between problems due to the network and problems due to servers connected to the network

Chapter 15 Network Benchmarks n Plan to obtain network benchmarks to help with problem diagnosis and planning, such as: u Slow, average, and peak network activity in relation to the work patterns of an organization u Network activity that is related to specific protocols u Network activity that is related to specific servers and host computers

Chapter 15 Network Benchmarks (continued) u Network activity that is related to workstations u Network activity on individual subnets or portions of a larger network u Network traffic related to WAN transmissions u Network traffic created by particular software

Chapter 15 Windows 2000 Network Monitoring Tools n Network monitoring and management tools in Windows 2000 include: u Network Monitor Driver u Network Monitor u SNMP service u System Monitor

Chapter 15 Network Monitor Driver and Network Monitor n Network Monitor Driver: Enables a Microsoft-based server or workstation NIC to gather network performance data for assessment by the Microsoft Network Monitor n Network Monitor: A Windows NT and Windows 2000 network monitoring tool that can capture and display network performance data

Chapter 15 Server Activities to Monitor Figure 15-1 Using Network Monitor Driver to gather network performance information on two separate networks

Chapter 15 Installing Network Monitor Driver n To install Network Monitor Driver: u Open the Network and Dial-Up Connections tool u Right-click Local Area Connection u Click Properties u Click Install u Double-click Protocol u Double-click Network Monitor Driver

Chapter 15 Installing Network Monitor Driver (continued) Figure 15-2 Installing Network Monitor Driver

Chapter 15 Using Network Monitor n Network Monitor tracks information such as: u Percent network utilization u Frames and bytes transported per second u Network station statistics u Statistics captured for a specific interval of time u Transmissions per second

Chapter 15 Using Network Monitor (continued) u Broadcast, unicast, and multicast information u NIC statistics u Error data u Addresses of network stations u Other network computers running Network Monitor and Network Monitor Driver

Chapter 15 Installing Network Monitor n The general steps to install Network Monitor are: u Open the Add/Remove Programs tool u Double-click the component, Management and Monitoring Tools u Check Network Monitor Tools

Chapter 15 Installing Network Monitor (continued) Figure 15-3 Installing Network Monitor tools

Chapter 15 Starting Network Monitor n The general steps for starting a capture session in network monitor are: u Start Network Monitor from the Administrative Tools menu u Select the network to monitor u Click the Capture button to start capturing information u Click the Stop Capture button to stop capturing information

Chapter 15 Capturing Network Data Figure 15-4 Network Monitor capturing data Total pane Graph pane Session pane Station pane

Chapter 15 Monitoring Tip n As is true of other monitoring tools, Network Monitor can create an extra load on a server

Chapter 15 Network Monitor Display n Data captured in Network Monitor is displayed interactively in four window panes, but can be customized to show only one, two, or three panes

Chapter 15 Network Monitor Panes

Chapter 15 Viewing a Line-by-Line Report n After data is captured, you can view a line-by-line capture summary report by clicking the Stop and View Capture button

Chapter 15 Viewing a Line-by-Line Report Figure 15-5 Viewing capture summary data

Chapter 15 Capture Summary Window Information Table 15-2 Capture Summary Window Information

Chapter 15 Capture Summary Window Information (continued)

Chapter 15 Finding Specific Capture Summary Information n Use the Find button in the capture summary display to find specific information

Chapter 15 Using Find Figure 15-6 Finding Transmission Events Associated with Server Lawyer

Chapter 15 Monitoring Filter n Network Monitor has a built-in ability to configure a filter u Filter: A capacity in network monitoring software that enables a network or server administrator to view only designated protocols, network events, network nodes, or other specialized views of the network

Chapter 15 Creating a Filter n To create a filter in network monitor: u Click the Edit Capture Filter button and click OK u Set the specific parameters by double- clicking any of: SAP/ETYPE, Address Pairs, and Pattern Matches u Click OK u Continue Capturing data

Chapter 15 Selecting Filter Options Figure 15-7 Creating a filter

Chapter 15 Configuring SAPs and ETYPEs Figure 15-8 Selecting a protocol to capture in a filter

Chapter 15 SAP and ETYPE n Server Access Point (SAP): A service access point, which specifies the network process that should accept a frame at the destination, such as TCP/IP n Ethertype (ETYPE): A property of an Ethernet frame that includes a specialized two-byte code used for particular vendor functions

Chapter 15 Capture Trigger n Besides filtering, Network Monitor supports using capture triggers u Capture trigger: Used as a way to have Network Monitor perform a specific function when a predefined situation occurs, such as stopping a capture of network data when the capture buffer is 50% full

Chapter 15 Setting up a Trigger Figure 15-9 Setting up a trigger

Chapter 15 Troubleshooting Tip n Check the Graph pane for a quick assessment of performance statistics for: u % Network Utilization u Frames Per Second u Bytes Per Second u Broadcasts Per Second u Multicasts Per Second

Chapter 15 Diagnosing Common Problems n Use Network Monitor to diagnose problems such as: u A NIC creating a broadcast storm u Inefficient multimedia applications u Problems with bridges, switches, and routers u Problems with particular a workstation u An overloaded server

Chapter 15 Finding a Broadcast Storm n A broadcast storm is a situation in which one or more devices, such as a failing NIC, are saturating the network with traffic n Use the Network Monitor Broadcasts Per Second statistic to help determine if there is a broadcast storm and then check the Session and Station panes for the device(s) sending the broadcast(s)

Chapter 15 Locating Unauthorized Network Monitor Users n Network Monitor can create problems when it is used by network intruders or unauthorized users n You can view all of the Network Monitor users by clicking the Tools menu and then clicking Identify Network Monitor users

Chapter 15 Viewing Network Monitor Users Figure Identifying all Network Monitor users

Chapter 15 SNMPSNMP n The Simple Network Management Protocol (SNMP) is used to gather standardized network performance information and to control network devices

Chapter 15 SNMP Stations n SNMP uses two kinds of network stations: u Network Management Station (NMS): Monitors and manages devices configured with SNMP and collects information u Agent: Any device configured for SNMP from which an NMS can collect data – SNMP agents include servers, workstations, routers, switches, and hubs

Chapter 15 Microsoft Systems Compatible with SNMP n The following systems can be managed through SNMP: u Windows 2000 and NT servers u Windows 2000 and NT workstations u WINS servers u DHCP servers u IIS servers u Microsoft RAS and IAS servers

Chapter 15 Installing SNMP n To install SNMP: u Open the Add/Remove Programs tool u Click Add/Remove Windows Components u Double-click Management and Monitoring tools u Check Simple Network Management Protocol and click OK u Click Next and then click Finish

Chapter 15 Configuring SNMP n After installing SNMP, configure one or more community names for security u Community name: In SNMP communications, a password used by network agents and the network management station so that their communications cannot be easily intercepted by an unauthorized workstation or device

Chapter 15 Configuring SNMP (continued) Figure Configuring the community name

Chapter 15 SNMP Trap n SNMP enables you to configure a trap u Trap: A specific situation or event detected by SNMP that a network administrator may want to be warned about or to track via a network management station, such as when a network device is unexpectedly down or offline

Chapter 15 Troubleshooting Tip n If a trap that you set does not work, make sure that the SNMP Trap Service is started and set to start automatically in Windows 2000 Server

Chapter 15 Monitoring a Network with System Monitor n System Monitor contains a wide range of objects for monitoring a network n Some objects only appear in System Monitor if you have a particular protocol installed

Chapter 15 System Monitor Network Monitoring Objects Table 15-3 System Monitor Network Monitoring Objects

Chapter 15 System Monitor Network Monitoring Objects (continued)

Chapter 15 System Monitor Network Monitoring Objects (continued)

Chapter 15 System Monitor Network Monitoring Objects (continued)

Chapter 15 Monitoring NICs, Servers, and Network Devices n System Monitor can be used to monitor the NIC at the server to make sure that it is working properly n System Monitor is also used to monitor for network problems at the server and between the server and network devices

Chapter 15 Using System Monitor Objects to Monitor the NIC, Server, and Network Devices Table 15-4 Using System Monitor Objects and Counters to Monitor the NIC, Server, and Network Devices

Chapter 15 Using System Monitor Objects to Monitor the NIC, Server, and Network Devices (continued)

Chapter 15 Using System Monitor Objects to Monitor the NIC, Server, and Network Devices (continued)

Chapter 15 Using System Monitor Objects and Counters to Monitor Protocols Table 15-5 Using System Monitor Objects and Counters to Monitor Protocols

Chapter 15 Using System Monitor Objects and Counters to Monitor Protocols (continued)

Chapter 15 Using System Monitor Objects and Counters to Monitor Server and Network Bottlenecks Table 15-6 Using System Monitor Objects and Counters to Monitor Server and Network Bottlenecks

Chapter 15 Using System Monitor Objects and Counters to Monitor Server and Network Bottlenecks (continued)

Chapter 15 Using System Monitor Objects and Counters to Monitor a Web Server Table 15-7 Using System Monitor Objects to Monitor a Web Server

Chapter 15 Using System Monitor Objects and Counters to Monitor a Web Server (continued)

Chapter 15 Using System Monitor Objects and Counters to Monitor a Web Server (continued)

Chapter 15 Using System Monitor Objects and Counters to Monitor SMTP Services

Chapter 15 Using System Monitor Objects and Counters to Monitor SMTP Services (continued)

Chapter 15 Network Tuning Tips n Keep NIC drivers updated n Replace slow NICs n Tune the network access order n Implement TCP/IP exclusively, if possible n Purchase servers that are equipped to keep up with the server load

Chapter 15 Network Tuning Tips (continued) n Monitor for excessive BPDU broadcasts n Monitor the network for saturation from broadcast storms n Replace aging, slower network devices with newer, faster devices n Use multimedia applications that support multicasting n Upgrade bandwidth to match the load

Chapter 15 Chapter Summary n Monitoring a network is as important as monitoring a server n Establish network benchmarks to help in preventing and diagnosing problems n Install the Network Monitor Driver and Network Monitor together to enable network monitoring from Windows 2000 Server

Chapter 15 Chapter Summary n Install Microsoft SNMP service to take advantage of SNMP-based network management station monitoring n Use the System Monitor’s network- related objects, counters, and instances for in-depth network monitoring, particularly of protocols