BROCADE IP PRIMER

Chapter 2: TCP/IPWireshark used to be known as Ethereal. It is very similar in functionality totcpdump, but it adds a graphically-based interface. It still automatically putsyour NIC in promiscuous mode. It has capture filters and can dump frames tofiles. The big difference is that through windows and menus, it provides amuch more graphically-rich analysis tool for the administrator.Both programs are available to run on most popular operating systems. They'revery valuable tools to have in your tool belt as a network administrator or networkengineer.sFlow (RFC 3176)Brocade actually gives us one more very valuable tool for capturing frames.sFlow is an open standard defined by RFC 3176. It is a protocol for capturing asampling of frames and transmitting that information to a central location(usually, a server) for analysis. The beautiful part? Brocade integrates this protocolinto the ASIC (hardware) of every port on their switches. This means thatany of the ports of a Brocade switch can be monitored through sFlow, withoutincreasing the resource load on the switch.With sFlow integrated into the ASIC, the switch's CPU is not involved, and canfocus on its primary functions. sFlow uses an adjustable sample rate. This is anumber that tells sFlow how many packets (of all the packets) to capture. Thisrate can be as high as 1 packet out of every 2,147,483,648 packets, or as lowas 1 packet out of every 2 packets. You can also change the size of the sample.For example, using 128 bytes as your sample size will typically show youall of the headers, enough to see what type of traffic is being sent. You maywant to see part of the data, so you can increase the size.68 Brocade IP Primer