Workshop

scantily, and still others are not available at all! (For example, I don’t know of anybody who makes a
decoder for the popular Internet chat package ICQ. ICQ is a fairly proprietary service.)
Is this a disaster? Not really. Even though the analyzer can’t decode the service so that you can read it,
it’s still capturing what’s going on. If you’re working with tech support for a proprietary service, you can
bet that they’ll be able to read your trace using in-house decoders. After all, for our purposes, one of the
primary reasons to use a network analyzer is to capture evidence to submit to a vendor, and if the vendor
can’t decode its own service, we’re all in trouble.
Dave, I’m Afraid I Can’t Analyze That
Some network analyzers have an “expert” mode, which, during packet capture, makes a guess at what
could be wrong with your network. In theory, this is wonderful. You and I can’t sort through hundreds of
conversations at once; this is the sort of job that’s well suited to a computer.
In practice? Well, my experience with “expert” analyzers has convinced me that they’re somewhat less
than expert. Sure, they pick up on workstations that are running slowly—they’re very good at seeing that
a workstation has a significant delay in responding to a request. They’re also good at seeing duplicate IP
addresses and other simple problems. But expert? Not really. Idiot savant would be more like it. In my
opinion, a complex network problem must be dealt with by a human; there are just too many unknowns,
too many guesses, and too much intuition involved to have a computer do it. Teaching a computer how to
solve complex network issues would probably be just as hard as teaching a computer how to think.
I definitely don’t want to run down analyzers with an “expert” feature—they can be really useful for
common simple problems. Just don’t think of an expert analyzer as a panacea for all your hard network
problems. However, in combination with your own situation analysis, expert analyzers can be very
powerful allies in your troubleshooting wars; they tend to point you to bona fide problems that need
further investigation.
Previous Table of Contents Next