Network Monitoring with SMS

Network troubleshooting is always a complex task for a systems administrator. A myriad of problems can occur on your network, including problems with the network's physical layer (wiring), problems with the NICs running on each machine, and even problems with the logical layer. Diagnosing the exact problem is often a time-consuming, trial-and-error task.

To diagnose network problems, systems administrators generally use a network monitoring tool, sometimes known as a protocol analyzer. These devices can be either hardware or software that lets you review all packet traffic on your network and look for different problems. Basic hardware and software network monitoring tools do not provide diagnosis capability: They often collect only statistics and packets that you must manually sort through to figure out a problem. Advanced, multithousand-dollar hardware devices use built-in artificial intelligence to determine what, if any, network difficulties you have.

Microsoft BackOffice users do not need to spend thousands of dollars on a network monitoring solution. The Systems Management Server (SMS) component of BackOffice includes one. Unfortunately, many administrators are unaware of this feature and its power, because it is not adequately documented in reference sources, third-party SMS books, or training videos available from a variety of sources.

The Network Monitor lets you observe dozens of different protocols traversing your network. These protocols include basic ones Microsoft products use to communicate with one another, such as Server Message Block (SMB) for file sharing, and other protocols such as Dynamic Host Configuration Protocol (DHCP) and NetBIOS. The monitor supports all major TCP/IP protocol components, including low-level TCP, IP, and User Datagram Protocol (UDP) packets, and higher-level protocols such as FTP, NFS, and Domain Name System (DNS). For NetWare-enabled environments, the Network Monitor lets you watch NetWare Core Protocol (NCP), IPX, and SPX traffic. For a complete list of supported protocols, refer to the SMS Administrator's Guide.

Where Is It?
When you install SMS, the Network Monitor component installs on your BackOffice server by default. (You can manually choose not to install the component.) To verify the presence of the Network Monitor, look in the SMS menu from the Programs option on the Start menu (or look in the SMS Program Group if you're running NT 3.51). If an SMS Network Monitor icon is present, the component is available.

Before you use the Network Monitor for interactive debugging, you must install the Network Monitor Agent. Unless you insert this agent into your system's network configuration, you can use the Network Monitor only to view the contents of capture files from other machines that have the Monitor Agent set up. To install the Monitor Agent into your system's network configuration, you must manually run the Network configuration program from the Control Panel and add the Monitor Agent. Once you add the Monitor Agent, reboot to activate the Monitor Agent in the system configuration.

To use the Network Monitor, you must have a NIC that supports promiscuous mode operation. In promiscuous mode, the NIC routes all packets it sees on the network to the controlling network driver. Ordinarily, a NIC disregards any network traffic that does not have the NIC's Media Access Control (MAC) address, a unique 12-character hexadecimal value each NIC manufacturer assigns to every card. Typically, if a packet does not have the correct address, your NIC will not route the packet to your computer's network device driver; the card will discard packet.

You can launch the Network Monitor in two ways. In the first method, select the SMS Network Monitor option from the Systems Management Server Programs menu in NT 4.0. The Network Monitor will launch with no filtering defaults. Or, launch the Network Monitor within the SMS Administrator by double-clicking the Network Monitor option when you are reviewing a personal computer's properties within the SMS Administrator. This approach will automatically set up Network Monitor to filter packets for only that specific machine.

Information Overload
When you first launch the Network Monitor, information overload occurs. The main Network Monitor window, the Capture Window, appears and displays information regarding the network adapter the monitor is observing. If your NT machine is multihoming (i.e., you have more than one network adapter), switch between the adapters to make sure you're monitoring the correct network. To switch adapters, select Capture, Networks from the menu.

The Capture Window consists of four panes--Total Statistics Pane, Graph Pane, Station Statistics Pane, and Session Statistics Pane--and gives you an overview of network performance and information on the monitor's capture status, as Screen 1 shows. Above the four panes, you'll see a toolbar with several option buttons that let you turn individual panes on and off and start, stop, and view the packet capture buffer.

Before you can collect network performance statistics, you must specify a packet filter and tell the Network Monitor to start collecting packets. A packet filter is a set of Boolean rules to tell the Network Monitor the packets you want to capture in the capture buffer and compute statistics with. Packet filters have two components: an origin address and a destination address. You can collect all packets that you plan to send to a particular address or those that originate from a particular address, or a combination of the two. You can also use a wildcard, ANY, to specify any address the Network Monitor observes. By default, if you start the Network Monitor directly from the Start menu, Network Monitor will use the ANY wildcard for both inbound and outbound packets. If you start from the SMS Administrator, the packet filter will select packets only for the particular machine you specify.

Display Panes
When you use the Network Monitor, keep an eye on the Total Statistics Pane, which contains ASCII information on network statistics and captured frame statistics. In particular, watch % Buffer Utilized. If this number exceeds 100 percent, you will begin to lose capture data in your buffer, and you probably need to design a tighter capture filter or increase the buffer size.

The Graph Pane provides five different graphical representations of the activity on your network: percent of network utilization (from 0 to 100), number of frames per second, number of bytes per second, number of broadcasts per second, and number of multicasts per second. Three numbers under each bar represent, from left to right, the minimum, average, and maximum number achieved in the category.

With the Graph Pane, you can quickly assess which category network activity originates from. For instance, if your network shows a high percent for utilization, you can use the Graph Pane to examine traffic classification. Is the traffic normal or showing a large number of multicasts or broadcasts? With the data on the bar graphs, you can determine the type of traffic on your network. For example, if you see high utilization (resulting in slow network throughput) but a high number of broadcasts, determining and correcting the broadcast problem will improve performance.

To identify stations consuming a great deal of network bandwidth, refer to the Station Statistics Pane at the bottom of the window. This pane summarizes all traffic on the network on a station-by-station basis. It shows the network address, number of frames sent and received, number of bytes sent and received, and number of broadcasts from the station. Review the information on the line appropriate for the station in question. For example, assume that your users are complaining of sluggish output. A review of the Graph Pane shows you have a significant amount of activity but nothing extraordinary (such as a significant numbers of broadcasts). How do you determine the source of the problem?

Double-click any column header within the Station Statistics Pane to sort in ascending order all rows by the values in the column. Double-click a column title a second time to re-sort all data in descending order. Thus, to identify users consuming a large amount of bandwidth, you can double-click on the Bytes Sent or Bytes Received columns to observe the stations consuming the most bandwidth.

The Session Statistics Pane contains information about the individual sessions running on your network and other useful details. It tells you where the packets originate and their destinations, with a packet count from the originating station sent to the destination and vice-versa. This pane also lists various system addresses, such as the NetBIOS multicast and IP Broadcast addresses, so you can identify stations that are sending a lot of packets in those categories.

Once you identify the offending station, you may have to take the process one step further and retrieve the machine name for the station (if the Network Monitor does not provide the machine name by default) so you can determine which user is causing the traffic. You can obtain this name through the SMS database and determine whether the traffic you observe is normal or a potential problem.

Buffer Review
Statistics collection and review are only two of Network Monitor's capabilities. By far, Frame Viewer Window is a more powerful feature. With it, you can review the contents of the packets traversing your network.

To access the Frame Viewer Window, stop the Network Monitor's packet collection: Click Stop on the toolbar and then View, or use the Network Monitor shortcut key (Shift+F11) to stop and immediately view the capture buffer contents.

The Frame Viewer Window consists of three panes, as Screen 2 shows: the Summary Pane, Detail Pane, and Hex Pane. The Summary Pane displays a summary of packets in the capture buffer. The Detail Pane displays the frame's contents, including protocol information. The Hex Pane shows a hexadecimal and ASCII representation of the captured frames.

To use the Frame Viewer Window, you first shuffle through the overview of frames in the capture buffer listed in the Summary Pane. The data in this pane includes a frame number, time of capture, source and destination MAC addresses, the protocol used to transmit the frame, and a description of the frame's contents.

From the Summary Pane, identify the frame you want to view, and click it. The data in the Detail and Hex panes will change to reflect the frame you selected. The Detail Pane uses an Explorer-like, drill-down method for viewing capture data. When you select a packet from the Summary Pane, the Detail Pane will automatically show you the packet components. Each component will have a plus or minus symbol next to it to show whether you have exploded the view of that component. Each time you click an entry in the Summary Pane, you highlight the hexadecimal data the Network Monitor uses to decode the frame.

For example, for a typical Ethernet packet, you'll view three or more packet components. The first component is the base frame properties, the second consists of flags marking the packet as an Ethernet packet (including which Ethernet frame type is in use, such as 802.2 or 802.3), and finally the components of the particular protocol (FTP, DNS, etc.). When you click the plus symbols, you expand the individual components and can view their structure. Here you might discover that a TCP checksum or message became corrupt during transmission.

The true power of the Frame Viewer Window is that it lets you view firsthand the data traversing your network. This feature is powerful for advanced network administrators who want to view the types of requests and data from both source and destination addresses. When you selectively target individual workstations, you can inspect transmissions to look for telltale problems such as data corruption in frame headers or data packets. In these instances, you might have a physical-layer networking problem where an outside influence, such as electromagnetic interference, is causing your network problem.

Monitor Caveats
Network Monitor's limitations include its small default capture buffer and the need to have this capture buffer in real memory. The default size is 1MB, a value that causes the buffer to rapidly fill up if you have a busy network. To change this value, choose Capture from the menu-bar and select Buffer Settings. Because the capture buffer must consume real, not virtual, memory (and thus avoid potentially losing network frames), keep this buffer size to a small, reasonable value (based on a percentage of your total system memory) to prevent system degradation.

Another Network Monitor limitation is its ability to capture statistics only on the first 128 nodes it detects on the network. If your network has more than 128 nodes, the network monitor will detect only the first 128 nodes and generate statistics from them. This data might falsely show less activity on your network than you have.

Another potential problem is segmented network traffic. If you segment your network using an Ethernet switch, the Network Monitor will see only packets that transmit over the leg of the network that the monitor is physically connected to. Again, this data might show an apparent decrease in the amount of traffic, especially if you use workgroup features on a segmented leg of a network where you don't run the Network Monitor. To combat this problem and obtain more precise statistics on your network's performance, install Monitor Agents on qualifying client machines on each leg of your segmented network. You can then interrogate and collect statistics from those agents with the centralized Network Monitor utility.

Even with these caveats, SMS's Network Monitor utility is powerful and flexible. A network administrator will find it helpful in diagnosing network problems.