Workshop

More documents

Recommendations

Info

Summary Previous Table of Contents Next A network analyzer is a tool that listens to network packets on a shared segment and decodes them into human-readable format. Some are horrendously expensive, some are not. The neat thing about them is that they run on most PCs if you have the right type of network card—that is, a “promiscuous” network card, which is able to listen to all network packets. Depending on the analyzer, you can expect to see many functions that will help you analyze the raw data that the analyzer captures. Some of these functions include capture filtering, sortable statistical displays, “expert” analysis of data, and customizable views. There’s more than one analyzer available on the market, because there’s more than one problem out there. Different analyzers are good for different things. In particular, Token-Ring needs certain features not present on generic analyzers. Knowing what and when to filter is a really important part of learning how to use an analyzer. Once you learn how to take small manageable trace files, you’ll be able to quickly go through them and find what you need in order to vanquish your problems—or to entice your vendor to help out. Analyzers, like any tool, have limitations, but if you have your wits about you, they’re a powerful addition to your troubleshooting arsenal. <strong>Workshop</strong> Q&A Q C’mon, Jonathan! Network analysts spend years learning how to sift through protocol data. How do you expect me to learn this in an hour? A The key here is to limit the scope of what you’re expecting to accomplish. True, although you’re probably able to learn the various protocols and service nuances that underlie the everyday programs and services that you know and love, why would you want to? Analyzers are simply an effective way for you to apply your black box troubleshooting skills. Don’t get discouraged if you don’t understand everything you see on the decode screen—just remember to keep asking yourself questions such as “which of these things is not like the other?” and you’ll do very well. If you feel you need or want to dig deeper, grab a protocol book and have fun. However, in many cases, that won’t be necessary.
Q Where can I get an Ethernet mini-hub or Token-Ring node doubler? A The same place you can get a mini-switch: Just visit one of the various network supply houses that have homes on the Net. I’ve had good luck with www.networksnow.com and www.datawarehouse.com, but any of them can supply these items to you. Quiz 1. True or false? The difference between a cable scanner and a network analyzer is that a cable scanner can solve all network-level problems. 2. Most analyzers have which two modes of operation? A. Capture the flag and a secret decoder ring B. Packet capture and packet decode C. Capture of data and decode of Ethernet D. View and sort 3. A network analyzer requires a computer and a __________ network card. A. promiscuous B. promethean C. amorous D. packetized 4. True or false? Identifying how and when to filter is a highly important part of learning how to use an analyzer. 5. A filter can be _____________________. A. workstation related B. protocol related C. Both A and B D. Neither A nor B 6. True or false? If your analyzer does not gather network names (such as DNS or NetBIOS), it’s impossible for you to identify whose computer corresponds to a particular MAC address. 7. You’re about to connect an analyzer to a network segment. For best results, what should you have done first? A. Sniffed packets B. Formed an option C. Come up with a theory D. Decided not to use a filter Answers to Quiz Questions 1. False 2. B 3. A 4. True
Page 1 and 2:
To access the contents, click the c
Page 3 and 4:
Workshop Q&A Quiz Answers to Quiz Q
Page 5 and 6:
Eminent Domain TCP/IP Graffiti DHCP
Page 7 and 8:
Configuring Your Proxy Proxy Troubl
Page 9 and 10:
Socks Stuff AOL Instant Messenger A
Page 11 and 12:
Table of Contents Introduction: Get
Page 13 and 14:
about your more complex network iss
Page 15 and 16:
Tell Us What You Think! Table of Co
Page 17 and 18:
with me when I was first getting st
Page 19 and 20:
NIC (network interface card) The te
Page 21 and 22:
MAC Attack Previous Table of Conten
Page 23 and 24:
Routers Previous Table of Contents
Page 25 and 26:
technology as the future of local a
Page 27 and 28:
for a TCP/IP address in a large net
Page 29 and 30:
Sprechen Sie DLC? Previous Table of
Page 31 and 32:
socket 80 of the TCP/IP address 167
Page 33 and 34:
program in a name entry; entering t
Page 35 and 36:
WINS Previous Table of Contents Nex
Page 37 and 38:
kind and spit them out as fast as p
Page 39 and 40:
Previous Table of Contents Next Hou
Page 41 and 42:
Figure 2.1 A simple logical map. If
Page 43 and 44:
Figure 2.4 A physical documentation
Page 45 and 46:
the room). This way, you can read t
Page 47 and 48:
un on the server at 9:50 on Monday
Page 49 and 50:
Previous Table of Contents Next Par
Page 51 and 52:
Beware of Vendor Your vendor probab
Page 53 and 54:
call the risk/benefit ratio—the a
Page 55 and 56:
Workshop Q&A Previous Table of Cont
Page 57 and 58:
Page 59 and 60:
If you determine that it’s just o
Page 61 and 62:
(see Figure 4.2). Figure 4.2 An Eth
Page 63 and 64:
Division of Labor Previous Table of
Page 65 and 66:
just that the network itself is at
Page 67 and 68:
A Each situation is obviously diffe
Page 69 and 70:
Page 71 and 72:
Ruling out is particularly effectiv
Page 73 and 74:
Drive duplication can be a big help
Page 75 and 76:
Previous Table of Contents Next Aft
Page 77 and 78:
5. When you log problems on a given
Page 79 and 80:
if they have a plan, they are going
Page 81 and 82:
Is It a Virus, Doc? Previous Table
Page 83 and 84:
O: Only have tried two other Intern
Page 85 and 86:
A Remember that what a user says is
Page 87 and 88:
Page 89 and 90:
Previous Table of Contents Next Loo
Page 91 and 92:
Figure 7.1 Searching several sites
Page 93 and 94:
You’ll also find forums run by th
Page 95 and 96:
Previous Table of Contents Next
Page 97 and 98:
a server but you think it should be
Page 99 and 100:
Workshop Q&A Previous Table of Cont
Page 101 and 102:
Page 103 and 104:
Name Brand Versus Generic PCs The c
Page 105 and 106:
static electricity that may have bu
Page 107 and 108:
SIMMs and DIMMs There are two kinds
Page 109 and 110:
Page 111 and 112:
This is called looping back, becaus
Page 113 and 114:
Windows Previous Table of Contents
Page 115 and 116:
Figure 8.4 The NT Task Manager’s
Page 117 and 118:
UNIX Previous Table of Contents Nex
Page 119 and 120:
Probably the most important thing t
Page 121 and 122:
Hour 9 Ethernet Basics Previous Tab
Page 123 and 124:
which translates into lots of colli
Page 125 and 126:
it currently requires fiber-optic c
Page 127 and 128:
designation is simply an industry-s
Page 129 and 130:
Down, Down, Down Previous Table of
Page 131 and 132:
A Collisions cause other errors, su
Page 133 and 134:
Follow the Rules: Share and Enjoy!
Page 135 and 136:
Previous Table of Contents Next Err
Page 137 and 138:
Token Analyzers Finding a NAUN is r
Page 139 and 140:
Token-Ring does not have any hard-a
Page 141 and 142:
Down Town Previous Table of Content
Page 143 and 144:
C. 1, 16 D. 4, 16 Answers to Quiz Q
Page 145 and 146:
Going Native Although Windows allow
Page 147 and 148:
Eminent Domain Previous Table of Co
Page 149 and 150:
machine with the username Administr
Page 151 and 152:
protocol. They therefore relied on
Page 153 and 154:
Previous Table of Contents Next Fol
Page 155 and 156:
Most of the time, you’ll not want
Page 157 and 158:
allows you to manage them and check
Page 159 and 160:
Binding Previous Table of Contents
Page 161 and 162:
Figure 11.6 Showing bindings for al
Page 163 and 164:
Informational Commands Previous Tab
Page 165 and 166:
Figure 11.8 A monitor session. We k
Page 167 and 168:
case you need them. 2. What does SM
Page 169 and 170:
a great example of client/server. W
Page 171 and 172:
Previous Table of Contents Next Alt
Page 173 and 174:
The first number is the process ID
Page 175 and 176:
tcp 0 0 frotz.frob.com.telnet 200.1
Page 177 and 178:
Name Game Previous Table of Content
Page 179 and 180:
The next thing you need to find out
Page 181 and 182:
A UNIX security and file permission
Page 183 and 184:
Page 185 and 186:
the amount of time used or data sen
Page 187 and 188:
NLMs In addition to accepting comma
Page 189 and 190:
NLM Party Previous Table of Content
Page 191 and 192:
Again, make sure you are running th
Page 193 and 194:
Big Monitor Is Watching Previous Ta
Page 195 and 196:
Then, eureka! During one session of
Page 197 and 198:
Protocol Problems Previous Table of
Page 199 and 200:
Figure 13.10 UNICON will configure
Page 201 and 202:
Summary Previous Table of Contents
Page 203 and 204:
7. The TCP/IP protocol and basic se
Page 205 and 206:
ivory-tower stuff, but some of it i
Page 207 and 208:
Configuring in Comfort Previous Tab
Page 209 and 210:
Router 1 in Figure 14.3 is shown in
Page 211 and 212:
to that network. Instead, the next
Page 213 and 214:
Route in Peace: Routing Protocols P
Page 215 and 216:
get to a network segment that until
Page 217 and 218:
Figure 14.4 How two stations talk v
Page 219 and 220:
Tree Trunks Previous Table of Conte
Page 221 and 222:
garbage characters like these on a
Page 223 and 224:
A. Add Router 99 to Router 88’s r
Page 225 and 226:
Let’s lay out some definitions he
Page 227 and 228:
Packet-Filtering Routers Previous T
Page 229 and 230:
eceptionist hangs up one line (the
Page 231 and 232:
from the proxy server without causi
Page 233 and 234:
Proxy Trouble Previous Table of Con
Page 235 and 236:
3. The proxy server resolves the na
Page 237 and 238:
Q My vendor says that its firewall
Page 239 and 240:
Page 241 and 242:
• Make checklists of tasks that m
Page 243 and 244:
Joe User Previous Table of Contents
Page 245 and 246:
groups | grep -q -w network && { ec
Page 247 and 248:
If you’re going to add or replace
Page 249 and 250:
Policies Previous Table of Contents
Page 251 and 252:
in this hour—will pay off as you
Page 253 and 254:
Q Which duplication software is rig
Page 255 and 256:
Hour 17 Where Do I Start? Previous
Page 257 and 258:
As optimistic as we’d all like to
Page 259 and 260:
• PCAnywhere • ReachOut • Rem
Page 261 and 262:
IPX/SPX Previous Table of Contents
Page 263 and 264:
Q What happens if I ping the loopba
Page 265 and 266:
correlations? A. netstat -a B. trac
Page 267 and 268:
equire that the application files t
Page 269 and 270:
The File and Print Blues Previous T
Page 271 and 272:
With five potential points of failu
Page 273 and 274:
In some cases, a slight difference
Page 275 and 276:
Application Celebration Previous Ta
Page 277 and 278:
Proto Local Address Foreign Address
Page 279 and 280:
printer 515 Line Printer Daemon (ne
Page 281 and 282:
Page 283 and 284: Connected to 167.195.160.6. Escape
Page 285 and 286: Workshop Q&A Q What in the blazes i
Page 287 and 288: 3. A 4. B 5. False 6. B 7. True 8.
Page 289 and 290: Intranet = Internal The word intran
Page 291 and 292: Internet Identification Previous Ta
Page 293 and 294: If an outside machine is “on the
Page 295 and 296: Here I Ping Again Previous Table of
Page 297 and 298: Figure 19.6 DNS zones, like the fol
Page 299 and 300: [rs.internic.net] Registrant: John
Page 301 and 302: For example, I ran an NFS server on
Page 303 and 304: • SMTP—Simple Mail Transfer Pro
Page 305 and 306: Dialout DNS Previous Table of Conte
Page 307 and 308: 3. What does DMZ stand for? A. DNS
Page 309 and 310: • It’s a way to avoid a Dilbert
Page 311 and 312: Socks Stuff Previous Table of Conte
Page 313 and 314: Figure 20.2 The AOL Instant Messeng
Page 315 and 316: RealPlayer Previous Table of Conten
Page 317 and 318: external client for proxy support,
Page 319 and 320: Previous Table of Contents Next Hou
Page 321 and 322: Typical Operation Previous Table of
Page 323 and 324: scantily, and still others are not
Page 325 and 326: Not every kind of filter is availab
Page 327 and 328: important. Your relative or interpa
Page 329 and 330: Application Antics Previous Table o
Page 331 and 332: Broken Ring Previous Table of Conte
Page 333: creating a segment between the swit
Page 339 and 340: Figure 22.1 The MG-Soft MIB browser
Page 341 and 342: the probe has picked up what’s go
Page 343 and 344: Previous Table of Contents Next Her
Page 345 and 346: information without the overhead th
Page 347 and 348: A. Broadcast B. Baseline C. Brag D.
Page 349 and 350: • Application efficiency • Serv
Page 351 and 352: Application and Protocol Efficiency
Page 353 and 354: and so on—is to measure. Everythi
Page 355 and 356: it a point to say, “Would you sho
Page 357 and 358: Here are the two types of performan
Page 359 and 360: Network Statistics Previous Table o
Page 361 and 362: Q About that latency analysis metho
Page 365 and 366: Router Configuration Previous Table
Page 367 and 368: For the second option, you’ll hav
Page 369 and 370: Automatic for the People Previous T
Page 371 and 372: are in an unknown location) to conn
Page 373 and 374: Previous Table of Contents Next The
Page 375 and 376: C. SYS:SYSTEM\AUTOEXEC.BAT D. SYS:P
Page 377 and 378: active hub An active hub is one tha
Page 379 and 380: A TCP-based authentication service
Page 381 and 382: applications and protocols are base
Page 383 and 384: An extremely fast network cable tha
Page 385 and 386:
See Internet Group Management Proto
Page 387 and 388:
A device that converts (modulates)
Page 389 and 390:
providers. Point-to-Point Tunneling
Page 391 and 392:
security audit An examination (ofte
Page 393 and 394:
An essential part of a network inte
Page 395 and 396:
Index Symbols A 100 Megabit Etherne
Page 397 and 398:
C new product, 45-46 burned-in addr
Page 399 and 400:
DLC (Data Link Control), 17 DMZ (de
Page 401 and 402:
F fat finger factor, 42-43, 46 fata
Page 403 and 404:
ICQ, 335-336 IMAP (Internet Mail Ap
Page 405 and 406:
M filters, 347-352 LANDecoder, 347
Page 407 and 408:
NetBIOS (Network Basic Input/Output
Page 409 and 410:
network card. See NIC Network Contr
Page 411 and 412:
power supply check, 66 troubleshoot
Page 413 and 414:
Q-R qualitative problems, 58 quanti
Page 415 and 416:
names, 393-394 NetWare, 202 paging
Page 417 and 418:
T dumb terminal mode, 211, 224 full
Page 419 and 420:
isolating soft errors, 135-136 LANa
Page 421 and 422:
U standardizing configuration, 245
Page 423 and 424:
V W upstream, 134 Usenet newsgroups
Page 425 and 426:
autodetection problems, 159 broadca
show all

Workshop

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?