| About InfoWorld : Advertise : Subscribe : Contact Us : Awards : Events : Store |
 |
||||
|
||||
 | ||||
 |
|
|||
 | ||||
|
|
|
||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
 NEWSEtherPeek fully tracks net usage By Mike Avery , For InfoWorld Test Center February 18, 2000 AS SOON AS something goes wrong in the deepest levels of your network, you have to fix it fast. Few companies can afford to let their IT staff dally when the network suddenly slows down, a new program crashes half of the servers, or the printers stop printing. EtherPeek 4.0 for Windows, from AG Group, is a software-based packet analyzer that lets technicians, programmers, or network managers immediately determine what is happening on their network at a very low level.
Also, at $995, it costs much less than its competitors. Leading software-based products Network Associates Sniffer Basic and Novell LANalyzer for Windows cost $1,500 per copy. You can also choose from portable dedicated hardware products from many vendors, including Hewlett-Packard, which cost at least $11,000. The extra money you would pay for a dedicated hardware solution buys a tool that won't lose data, a problem common to the software-based products, including EtherPeek. Also contributing to its score of Good is EtherPeek's strange dependency on the dated NE 2000 NIC (network interface card) to handle error monitoring. Nevertheless, EtherPeek's low price and great feature set offer the best value in a packet analyzer that I have seen. AG Group redesigned EtherPeek with Version 4.0, adding many elegant features. It can now have several data capture windows active simultaneously. It also has more complex filtering capabilities, making it easier to separate the data you want from the clutter, and network traffic can be filtered by the originating node, destination node, type of message, or by the contents of the message. Triggers let data capture begin when a condition is met, such as a frame from a particular node with specific information in it. EtherPeek's capability of exporting captured data as HTML reports has been enhanced. Statistics can be exported, even when the statistics windows are closed. This feature made it easy to turn a laptop with EtherPeek into a remote monitor. When I started running EtherPeek, it asked me which NIC in my computer I wanted to monitor. I selected one, and EtherPeek started. EtherPeek will work with almost any NIC supported by Windows. At this point in my testing, I ran into two oddities. Although EtherPeek will monitor dial-up network connections, AG Group won't support that use of the tool. Also, if you want low-level network error information, you must use an NE2000-compatible card, which are 10Mbps cards far from state of the art. The vendor is working to make EtherPeek support the error trapping offered by other NICs, such as Intel and Xircom Cardbus adapters. Similar to LANalyzer, EtherPeek promptly shows a speedometer that reveals the traffic levels. Other displays let me easily look at the trends in the traffic, including the traffic breakdown by protocol and frame size. Subsequently, other options let me investigate my network further. Once I got a feel for EtherPeek's controls, I started capturing data off of the network. In real time, I could see the distribution of data packets based on protocol, the distribution of data packet sizes, and which computers were talking to which. It was easy to have EtherPeek do a RARP (reverse address resolution protocol) lookup on all the nodes that had IP addresses and identify them by name. Nodes that didn't have IP addresses could easily be added to the name table manually. The history window tracked activities on the network, such as the beginning and outcome of FTP sessions and accesses of news and Web servers. This made it very easy to get an idea of what the network was being used for and what needed more investigation. Next, to generate more network traffic, I started running the Synchronized Traffic test portion of Novell's LANTest diagnostic suite on four PCs. I noticed that when the traffic levels on my 100Mbps Ethernet network climbed to more than 93 percent utilization, EtherPeek went to sleep, making it impossible to monitor the network. For a comparison, I started LANalyzer (admittedly a simpler tool) at the same time, and it could track the traffic load. At some point EtherPeek obviously began losing data. By default, EtherPeek enables several network traffic analysis tools, which add to overhead and will eventually cause data to be lost. The technical support staff instructed me to turn off many of the analysis tools, and then EtherPeek was able to monitor data again. EtherPeek's analysis tools were another pleasant surprise. The last time I looked at this network monitoring tool, the plug-in programs that enabled extensions to the base functions were only controllable via obscure text files. Now a console screen controls them, and the changes take effect at once. EtherPeek 4.0 for Windows is a good, flexible network monitor made even more attractive by its low price. Some network managers will find LANalyzer's greater ease of use a compelling argument for that product. However, EtherPeek has capabilities that LANalyzer can't match, including outputting HTML files and advanced filtration options, that will make your job much easier to do when you need to resolve complex network issues. Mike Avery (mavery@mail.otherwhen.com) is a frequent contributor to InfoWorld. A networking consultant based in Beaumont, Texas, he has designed networks of all sizes.
SPONSORED WHITE PAPERS 
SPONSORED LINKS
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||
|
||||||||||
