09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Pro<strong>to</strong>col analyzers exist for FDDI, E<strong>the</strong>rnet, Token Ring, and WAN <strong>network</strong><br />

interfaces. The analyzer is essentially a computer with special software and<br />

hardware that provides <strong>the</strong> analysis and capturing functionality. Analyzers function<br />

much like regular end-stations, but <strong>the</strong> difference is that a regular end-station<br />

listens <strong>to</strong> <strong>the</strong> <strong>network</strong> segment and only copies packets destined for itself. A<br />

pro<strong>to</strong>col analyzer copies all <strong>the</strong> packets on <strong>the</strong> segment that pass across its <strong>network</strong><br />

interface. In <strong>the</strong> earlier discussion of pro<strong>to</strong>col analyzers, it was mentioned that this<br />

was known as "promiscuous mode." LAN pro<strong>to</strong>col analyzers generally use standard<br />

<strong>network</strong> interfaces for data collection and operate in a non-intrusive mode. WAN<br />

pro<strong>to</strong>col analyzers, however, need <strong>to</strong> be in some part of <strong>the</strong> transmission path. To<br />

use a WAN analyzer, <strong>the</strong>re will be some minor service disruption. To listen <strong>to</strong> <strong>the</strong><br />

transmission path, WAN analyzers come with passthrough interface cards that sit<br />

between <strong>the</strong> computing device (for example, a router) and <strong>the</strong> DSU/CSU. This<br />

allows <strong>the</strong> analyzer <strong>to</strong> see all of <strong>the</strong> traffic on <strong>the</strong> transmission path and keep <strong>the</strong> link<br />

in operation. The service intrusion comes when <strong>the</strong> analyzer is installed and<br />

removed.<br />

As mentioned earlier, <strong>the</strong> most popular pro<strong>to</strong>col analyzer is <strong>the</strong> Network Associates<br />

(formally Network General) Expert Sniffer and Distributed Sniffer products. The<br />

Expert Sniffer comes as a software/NIC bundle ei<strong>the</strong>r for lap<strong>to</strong>ps and desk<strong>to</strong>p PCs or<br />

as a reconfigured system using a Compaq, Toshiba, or Dulch computer. The<br />

Distributed Sniffer System (DSS) product functions as an RMON collection system<br />

or as a real-time analyzer. The DSS uses a collection of analyzers installed on<br />

different <strong>network</strong> segments. The analyzers are <strong>the</strong>n available through a central<br />

console. The Expert and Distributed Sniffer System pro<strong>to</strong>col analyzers provide a<br />

large collection of reporting and capturing capabilities. There are also a number of<br />

third-party developers that have created extensions and add-on scripts for<br />

enhanced collection and reporting capabilities.<br />

Along with Network Associates, a number of software and hardware pro<strong>to</strong>col<br />

analyzers are manufactured by <strong>the</strong> following vendors: Telecommunications<br />

Techniques (LANHAWK), IBM (LAN Manager), FTP software (LANwatch Network<br />

Analyzer), Microsoft (included with Windows NT), and Hewlett-Packard (Network<br />

Advisor).<br />

Time Domain Reflec<strong>to</strong>rs<br />

Time Domain Reflec<strong>to</strong>rs (TDR) devices are used for diagnosing cable failure and<br />

associated problems. TDRs work by sending a test signal down <strong>the</strong> cable segment<br />

and listening for an "echo" or reflection. The TDR signal is sent at a specific<br />

amplitude and rate; if no echo is detected, <strong>the</strong> cable is free of errors. If an echo is<br />

detected, <strong>the</strong> TDR scope can determine <strong>the</strong> type of problem based on <strong>the</strong> type of<br />

reflection or Cable Signal Fault Signature (CSFS) detected. Depending on <strong>the</strong> type

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!