Tracking End-User Node Information

Acquiring Network Information

Discovering End-User Nodes on Your Network

Discovering a Subnet

Scheduling UserTracking Discoveries

Using Ping Sweeps with Discovery

Displaying End-User Node Information

Displaying the Database Entries

Constructing a Query

Appending Data to the Display

Finding an Entry in the Screen Display Table

Locating Devices on the CWSI Campus Network Map

Updating the CWSI Campus Database

Tracking End-User Node Information

You can use the UserTracking application to acquire network information about end-user nodes. This chapter describes how to perform the following tasks:

Acquiring Network Information

Before using the UserTracking application to query and display information from the CWSI Campus database, run the UserTracking discovery process to obtain the most up-to-date network information. When you run the UserTracking discovery process, Asynchronous Network Interface (ANI) queries the agents in switches, routers and Domain Name Server (DNS) hosts for information about end-user nodes on the network. The UserTracking application provides two ways to run discovery:

Discover immediately---See "Discovering End-User Nodes on Your Network" and "Discovering a Subnet" for more information.
Discover at regularly scheduled times or time intervals---See "Scheduling UserTracking Discoveries" for more information.

Discovering End-User Nodes on Your Network

To ensure that the switch and router information is current before you run the UserTracking discovery process, first enable ping sweeps by selecting Action>Ping Sweeps>Enable from the UserTracking main window. See "Using Ping Sweeps with Discovery" for more information.

To run UserTracking discovery on the entire network:

Select Action>Discover>End-User Nodes from the UserTracking main window.

The discovery process discovers end-user nodes in all VTP domains that are known to ANI and updates the CWSI Campus database. This procedure is equivalent to a major acquisition; see "Scheduling UserTracking Discoveries" for information about acquisitions.

The UserTracking application does not delete previous entries if the end-user nodes are not found in a discovery. End-user nodes may not be found for a number of reasons:

There is a power failure.
The user turns off the workstation.

If the UserTracking application deleted these entries then the VMPS information would be lost. Therefore, if you want to delete these end-user nodes you must manually remove the entry from the UserTracking table.

Discovering a Subnet

You can initiate the UserTracking discovery process for a particular subnet. For example, you may want to do this if you know that changes have been made that affect end-user nodes on a specific subnet.

To limit the discovery process to a particular subnet, follow these steps:

Step 1 Select Action>Discover>Subnet from the UserTracking main window.

The Discover Subnet window opens (Figure 2-1).

Figure 2-1: Discover Subnet Window

Step 2 In the Host Name or IP Address field, enter the name or IP address of a known end-user node on the subnet you want to discover.

Step 3 Enter the subnet mask for the IP address you specified.

The subnet mask is applied to the IP address to determine the subnet you want to discover.

Step 4 If you want the UserTracking application to perform a ping sweep check Perform Ping Sweep.

Step 5 Click Discover.

The UserTracking discovery process discovers node and user information about the specified subnet and updates the CWSI Campus database.

Scheduling UserTracking Discoveries

Using the UserTracking scheduling feature, you can schedule when UserTracking acquires network information through the discovery process. You can schedule both full and limited acquisitions.

If you run discoveries outside normal business hours when users have turned off their workstations or disconnected their laptop computers, the UserTracking application might not be able to obtain up-to-date information from the switches and routers about those nodes. Therefore, you may want to schedule discoveries at times when most of your users are on the network.

By default, the UserTracking application performs major acquisitions at 10 a.m. and 2 p.m. daily.

Step 1 Select Action>Acquisition Schedules from the UserTracking main window.

The UserTracking Network Acquisition Schedule window opens (Figure 2-2).

Figure 2-2: Network Acquisition Schedule Window

Step 2 If you do not want to schedule minor acquisitions, enter zero.

A minor acquisition is limited to all IP subnets that are known by ANI to have been active since the last acquisition.

Step 3 Enter a time interval in minutes for the frequency of acquisitions.

Step 4 Specify a schedule for performing major acquisitions. If you do not wish to perform major acquisitions, remove all entries from the list of major discovery times.

A major acquisition is an acquisition across all IP subnets known to UserTracking. Most of these subnets come from information acquired from switch and router tables. If you want to ensure that the switch and router information is current before performing the acquisition, enable ping sweeps (see "Using Ping Sweeps with Discovery"). A major acquisition is equivalent to running discovery by selecting Action>Discover>End-User Nodes.

You specify a schedule by selecting days, dates, and times to include or exclude from the acquisition schedule. You can make the following selections:

In the When box, select Every to specify days or dates to always perform major acquisitions, or select Not On to specify days or dates not to perform acquisitions. When you want to prevent an acquisition from being performed at any time on a day or date, select Anytime in combination with the Not On option.
In the Day or Date box, select Daily, Weekdays, Day, or Date. Use the popup lists to select a day of the week, or month and date.
In the Time box, use the popup lists to select hour, minute, and AM/PM.

You can repeat these steps to configure another time to perform acquisitions. Each time you do this, the scheduling information you have specified appears in the text box. For each entry, you must click Add before configuring the next entry.

Step 5 Click Add when you have specified the above items.

Step 6 Review the schedule you have made and make any adjustments.

Acquisitions are performed according to the priority in the order of the schedule entries, so the order may make a difference. For example, if you want to schedule daily acquisitions and exclude Sundays, the daily entry should come first, followed by the entry to exclude Sundays. To move an entry up or down, select the entry and click Up or Down. To delete an entry, select the entry and click Delete. You can select multiple, contiguous entries to move or delete.

Step 7 Click Apply to apply your acquisition schedule.

Using Ping Sweeps with Discovery

Existing information in routers and switches provides the source for information for UserTracking discovery. To make sure that this information is up to date, UserTracking offers the option of doing a ping sweep. A ping sweep sends a ping to every IP address in subnets that you have selected. By default, ping sweeps are disabled.

You can run UserTracking discovery with or without ping sweeps. If you do not use ping sweeps, an acquisition is made from each router and switch mapping table. If you run the process with ping sweeps, a ping is sent to every IP address, and the acquisition is made from the updated tables in the routers and switches.

Ping sweeps are performed based on how many hosts are possible in a subnet. If the number is less than or equal to 256, then ping sweeps will be performed in that subnet. If the number of hosts in a subnet is greater than 256, then ping sweeps will not be performed. If ping sweeps are not performed, during a major acquisition information is still obtained from the router or switch mapping tables.

The advantage of using ping sweeps to obtain the most current network information must be weighed against the traffic in the network that ping sweeps cause.

To enable ping sweeps:

Select Action>Ping Sweeps>Enable from the UserTracking main window.

To disable ping sweeps:

Select Action>Ping Sweeps>Disable from the UserTracking main window.

Note These options do not show the current state of ping sweeps. They only send a request to ANI to enable or disable ping sweeps.

Displaying End-User Node Information

The UserTracking application provides two ways to display information from the CWSI Campus database:

Display operator entries, network entries, or all entries in the database---See "Displaying the Database Entries" for more information.
Display entries that match your query---See "Constructing a Query" for more information.

The UserTracking application also allows you to:

Further limit or broaden your search by adding or removing search criteria---See "Appending Data to the Display" for more information.
Find an entry by searching for a string in the screen display table---See "Finding an Entry in the Screen Display Table" for more information.
Locate and highlight devices using the CWSI Campus network map---See "Locating Devices on the CWSI Campus Network Map" for more information.

Displaying the Database Entries

If you want to display all the entries in the database without performing a query, use one of the following commands under the Action>Display submenu:

All Operator Entries---Displays only entries made by the operators of UserTracking.
All Network Entries---Displays only entries discovered on the network by the UserTracking discovery process.
All Entries---Displays both network and operator entries.

If you check Append Results then the results of the first action will remain in the table while the new information will be added to it. If Append Results is not checked, the currently displayed information is replaced with the new information.

Note As the number of entries in the database reflects the number of users in the network, displaying all entries may result in a very large table.

Constructing a Query

You can also query specific user information, and display this information using the User Tracking application. To query user information from the CWSI Campus database, you specify one or two query criteria. For example, you may want to find the user associated with a particular MAC address, or you may want to display all the users on a particular VLAN or subnet. The UserTracking application responds to your query by displaying in a table the database entries that match your criteria. The database contains information that was obtained through UserTracking discovery or information that was manually entered from the UserTracking application.

To query the CWSI Campus database, follow these steps:

Step 1 In the Query Selector Items box of the UserTracking main window, expand the list of fields.

Step 2 Select the field that corresponds to the type of information you want to search for. These fields are described in Table 2-1.

Step 3 Enter the first value for your query in the field to the right of the arrow.

Searches are not case sensitive. For example, the search value "bank" matches Bank, Interbank, Inter-bank, and BANKERS, but does not match ban-ker. An entry in the database matches if the entry contains the search value anywhere in the entry.

Step 4 To specify a second query criterion, select a second field to query and enter a value.

If you only want to query one value in one field, leave the second field blank and go to Step 6.

Step 5 Select the And or Or radio button to combine or expand the two query fields.

Note

Step 6 Click Query or select Action>Query.

The results of your query are displayed in the screen display table in the lower part of the main window (Figure 2-3). These results represent the current user information in the CWSI Campus database that match your query items. They include information gathered when the UserTracking discovery process was last run, as well as any information that has been manually entered using the UserTracking application.

Figure 2-3: Query Results Window

You can further customize the table that displays the results of your query by sorting, resizing columns, and designing your own the screen layouts. See Chapter 4, "Working with UserTracking Tables" for more information.

Table 2-1 lists the contents of the screen display table and indicates which fields you can modify from the UserTracking interface.

Table 2-1: Screen Display Table Fields

Field Description Format Can Be Modified?

User Name

Name assigned by UserTracking operator to identify the listed end station.

string

Yes

MAC Address

MAC address of the network interface card in the end-user node. This information is stored in the CWSI Campus database.

Ethernet:

xx-xx-xx-xx-xx-xx

Token Ring:

xx:xx:xx:xx:xx:xx

Can be modified for Ethernet.

VLAN

Name of the VLAN to which the MAC address is assigned.

string

Can be modified for Ethernet.

VLAN Type

Type of VLAN: Ethernet, Token Ring, FDDI, unassigned, or unknown.

string

No

Ring

Ring number for Token Ring VLANs. Field is blank for non-Token Ring VLANs.

0xnnn

No

trBRF VLAN

Name of the parent VLAN for Token Ring VLANs. Field is blank for non-Token Ring VLANs.

string

No

VTP Domain

Virtual Trunking Protocol domain in which this port is located.

string

Can be modified for Ethernet.

Host Name

DNS of the node with this IP address.

string

No

IP Address

IP address of the node with this MAC address.

xxx.xxx.xxx.xxx

No

Subnet

Subnet of this IP address.

xxx.xxx.xxx.xxx

No

Device

IP address or host name of the device to which the end-user node is attached.

xxxx or string

No

Port

Port number in the switch. If the port is in a particular module, the module is shown.

string

No

Port Name

User-assigned port name.

string

No

Port State

Configured mode of port.

static or dynamic

Yes

Last Seen

Date and time when UserTracking last found an entry for this end-user node in a switch.

yyyy/mm/dd hh:mm:ss

No

Notes

Annotation entered by the person using UserTracking.

string

Yes

Src

Source of this entry (discovered by network or entered by operator).

N or O

No

Field	Description	Format	Can Be Modified?
User Name	Name assigned by UserTracking operator to identify the listed end station.	string	Yes
MAC Address	MAC address of the network interface card in the end-user node. This information is stored in the CWSI Campus database.	Ethernet: xx-xx-xx-xx-xx-xx Token Ring: xx:xx:xx:xx:xx:xx	Can be modified for Ethernet.
VLAN	Name of the VLAN to which the MAC address is assigned.	string	Can be modified for Ethernet.
VLAN Type	Type of VLAN: Ethernet, Token Ring, FDDI, unassigned, or unknown.	string	No
Ring	Ring number for Token Ring VLANs. Field is blank for non-Token Ring VLANs.	0xnnn	No
trBRF VLAN	Name of the parent VLAN for Token Ring VLANs. Field is blank for non-Token Ring VLANs.	string	No
VTP Domain	Virtual Trunking Protocol domain in which this port is located.	string	Can be modified for Ethernet.
Host Name	DNS of the node with this IP address.	string	No
IP Address	IP address of the node with this MAC address.	xxx.xxx.xxx.xxx	No
Subnet	Subnet of this IP address.	xxx.xxx.xxx.xxx	No
Device	IP address or host name of the device to which the end-user node is attached.	xxxx or string	No
Port	Port number in the switch. If the port is in a particular module, the module is shown.	string	No
Port Name	User-assigned port name.	string	No
Port State	Configured mode of port.	static or dynamic	Yes
Last Seen	Date and time when UserTracking last found an entry for this end-user node in a switch.	yyyy/mm/dd hh:mm:ss	No
Notes	Annotation entered by the person using UserTracking.	string	Yes
Src	Source of this entry (discovered by network or entered by operator).	N or O	No

Appending Data to the Display

The UserTracking application provides the option to keep currently displayed data on the screen and add the results of a new query to the display.

Step 1 Click Append results in the Query Selector Items area of the UserTracking main window.

Step 2 Specify a new query as described in "Constructing a Query" for more information.

When you click Query, any new entries that match your query and are not already displayed are appended to the screen display table. If Append Results is not checked, the currently displayed information is replaced with the results of the new query.

Finding an Entry in the Screen Display Table

You can locate an entry in the currently displayed table by searching for a string.

Step 1 Select Edit>Find on Screen.

The Find window opens (Figure 2-4).

Figure 2-4: Find Window

Step 2 Enter the string to search for in the Find field.

A value entered in the Find field matches a table entry if the entry contains the search value anywhere in the entry. Searches are not case sensitive.

Step 3 Select Down Columns or Across Rows from the popup menu to specify the direction of the search.

Step 4 Click one of the following buttons to start your search:

Find From Top---Finds the first occurrence of the string beginning at the top left-hand cell of the screen display table.
Find Next---Finds the next occurrence of the string.
Find All---Finds all occurrences of the string.

Found occurrences of the search string are highlighted in the screen display table.

Locating Devices on the CWSI Campus Network Map

From the UserTracking application window you can locate and highlight the device to which an end-user node is connected on the CWSI Campus map.

Step 1 Select one or more entries in the device column in the displayed screen table.

Step 2 Select Action>Highlight Devices on Map.

The switches connected to the selected devices are highlighted on the CWSI Campus network map.

Updating the CWSI Campus Database

After you make changes to a screen display table, the changes remain local to the workstation where you are running the UserTracking application until you send the information on the screen to the CWSI Campus database.

To update the CWSI Campus database:

Click Save in the UserTracking main window, or select Action>Save.

The CWSI Campus database is updated with the data in your screen display table.

If you enter a new MAC address or change an existing one and then update the CWSI Campus database, the UserTracking application checks to see if the MAC already exists in the database. If the MAC address does not already exist, the MAC address and related fields are added to the CWSI Campus database.

Note Updating the CWSI Campus database makes the current information available to the network and to network management applications. Updating the CWSI Campus database does not update the information stored on the VMPS server and does not affect MAC-to-VLAN port mappings and related information.

Table of Contents