Monitoring the Network Using Traffic Monitor and Protocol Monitor

In this chapter you will learn to use the TrafficDirector general monitoring tools:

Both these tools give you an overview of network activity by converting raw network data gathered by agents and switches into easy-to-read graphical displays--displays you can transpose and invert to get two different views of the same data. These monitoring tools graphically display network traffic statistics simultaneously for a number of selected agents, providing you with an at-a-glance comparison of multiple network segments.

Using Traffic Monitor and Protocol Monitor

Traffic Monitor and Protocol Monitor are excellent places to start monitoring or diagnosing your network. Both these applications let you monitor multiple sites simultaneously. While Traffic Monitor lets you monitor aggregate traffic statistics at the MAC level, Protocol Monitor supports seven-layer protocol monitoring, letting you track protocol statistics at the network level. Monitoring the traffic on your network with both Traffic and Protocol Monitors gives you a complete picture of your network's operation.

You can use these tools to establish a baseline of normal or expected performance and note any deviations from that performance that might signal broader network problems. You can then launch additional TrafficDirector tools to examine these suspect areas or to simply monitor certain aspects of your network in greater detail.

Traffic Monitor

The TrafficDirector Traffic Monitor is the most general network monitoring tool. It gives you a top-level view of your network by monitoring selected MAC-layer statistics for the agents or switches you select (agents must contain the RMON domain). By monitoring statistics such as utilization, multicasts, and network errors with Traffic Monitor, you can quickly assess network performance and functionality. Traffic Monitor gives you several graphical views of network traffic parameters, so you can see the flow of data through your network as it is happening. You can use Traffic Monitor to monitor network traffic patterns and see where bottlenecks are occurring; this can help you isolate and eliminate whatever is causing problems. You might use Traffic Monitor to detect high collisions, error packets, and broadcast storms, among other conditions.

Running Different Traffic Monitor Modes

One strength of Traffic Monitor is flexibility. To ensure that you can monitor traffic on your network, regardless of its complexity, Traffic Monitor runs in three different modes, depending on what you select from the TrafficDirector main window lists (agent, frame relay agent, agent group, or switch). This means that Traffic Monitor intelligently launches the correct application, depending on what you choose to monitor.

Regardless of whether your network is a switched environment, contains WAN frame relay circuits, or has shared/legacy LAN traffic, you can use Traffic Monitor to view traffic, just as you would in a less complex network. The interface you work with in all modes is identical, yet Traffic Monitor does all the background work for you, gathering useful statistics without more configuration required from you. Even though there are multiple applications running in the background, the only difference you will see when you run different Traffic Monitor modes is the application name on the title bar of each window in the GUI. The three available Traffic Monitor modes are as follows:

Protocol Monitor

Protocol Monitor lets you monitor multiple sites by protocols. It lets you view selected statistics, such as utilization, byte rate, and packet rate in terms of the protocols that make up your network traffic. Using Protocol Monitor, you can see at a glance the protocol breakdown of your network's traffic and get a real-time picture of your network's operation.

Protocol Monitor also provides a narrowed focus, letting you view parent/child protocol relationships in detail and see how specific protocols are being used on your network.

Common Features of Protocol Monitor and Traffic Monitor

While these two TrafficDirector monitoring tools differ in the type of network data they monitor, they do have many features in common. This section reviews these similarities and explains them in further detail later in the chapter.

Display Properties

As mentioned earlier, both Traffic Monitor and Protocol Monitor display selected network information as graphical displays. These displays give you an at-a-glance overview of your network. You will notice a Properties menu heading in each of their main windows. Under this heading, you can choose to display selected network data as a 2-D bar graph, a 3-D bar graph, or a 3-D pie chart. In addition to these three graphical display choices, you can also transpose or invert the displays.

Transposing Displays

This powerful feature lets you transpose both bar-graph and pie-chart displays to get two different views of the same data. In the default display of both Traffic Monitor and Protocol Monitor, the statistics you select are displayed as functions of different agents. But when you choose to transpose the bar-graph or pie-chart display, the agents are displayed as functions of the statistics.

Inverting Displays

You can choose to view a bar graph in inverted form. This inverts the axes of the two bar-graph displays (2-D and 3-D). Depending on the data you are displaying, you may choose to switch the x and y axes as a matter of viewing preference. Sometimes when you manipulate and resize a bar graph window, inverting the graph provides a clearer picture of the data and devices you are monitoring.

Manipulating 3-D Graphs

In any 3-D graph, such as a bar graph or pie chart, you can manipulate the elevation, depth, and angle of the displayed graph directly with the mouse. This lets you increase or decrease the three-dimensional effect of the graph according to your preference.

Manipulating Graphs

Use the following procedure to manipulate the displayed 3-D graph with your mouse.

Step 1 Move the cursor over the 3-D graph you want to manipulate.

Step 2 Do one of the following:

• If you have a three-button mouse, press and hold down the middle mouse button.

• If you have a two-button mouse, simultaneously press both mouse buttons and hold them down.

Step 3 Drag the cursor to manipulate the graph. When the graph is positioned the way you want it, release any mouse buttons you have pressed.

Resetting Graphs

Use the following procedure to reset any graph you have manipulated back to the original positions.

Step 1 On the graph you want to reset, put the cursor anywhere in the graph.

Step 2 To restore the original positioning of the graph, enter the following:

+

TrafficDirector redisplays the graph in its original display position.

Printing the Display

You can print any bar graph or pie chart you are viewing in Traffic Monitor and Protocol Monitor to either a printer or a file. To print the display, make sure the window containing the bar graph or pie chart you want to print is current, and use the following procedure.

Step 1 Select File>Print from the menu bar.

The Printing Options window is displayed (Figure 4-1).

Figure 4-1: Printing Options Window

Changing the Sample Rate

In Traffic Monitor and Protocol Monitor, you are monitoring samples collected by network agents or switches you have added to the TrafficDirector client software. When you choose to monitor selected data in Traffic Monitor or Protocol Monitor, TrafficDirector polls the agents or switches you select at intervals you specify and updates the display. You can change this interval in either Traffic Monitor or Protocol Monitor by selecting the Sample menu from the application menu bar and selecting the sample rate you want.

Launching Additional TrafficDirector Tools for a Closer Look

As mentioned earlier, Traffic Monitor and Protocol Monitor are the TrafficDirector general monitoring tools. Both give you an excellent overview of your network, based on the data you choose to monitor. But there may be times when you want to take a closer look at a particular aspect of your network for more detailed monitoring or network diagnosis.

To do so, you can launch additional tools available under the Tools menu in either the Traffic Monitor or Protocol Monitor main window. Tools such as Segment Zoom (available from Traffic Monitor) and Segment Statistics (available from both Traffic Monitor and Protocol Monitor) let you zoom in on aspects of your network and the data flowing through it for a more detailed analysis. See the "Monitoring and Troubleshooting Single Domains" chapter for information about these and about additional TrafficDirector tools.

Operating Independent Displays

The TrafficDirector console is actually an applications suite where you can launch multiple TrafficDirector software applications. Because of this, you can bring up several windows of the same TrafficDirector application. For example, although Protocol Monitor lets you monitor several types of data, you can only monitor one type of data at a time. You can, however, bring up several different Protocol Monitor windows and select different data types to monitor for each; Protocol Monitor displays operate independently of the other. You can also bring up several Traffic Monitor windows the same way, but remember each window you open uses additional TrafficDirector resources.

Viewing MAC-Layer Statistics Using Traffic Monitor

In this section, you will learn how to start and use Traffic Monitor to monitor network traffic patterns and MAC-layer statistics. The following discussion steps you through each procedure and includes a detailed explanation of every available option and feature.

Displaying Traffic Monitor

Use the following procedure to display Traffic Monitor from the TrafficDirector main window. Once you display the Traffic Monitor application, you can begin to monitor network traffic by MAC-layer statistics.

Step 1 If you have not already done so, log in to the network management station where TrafficDirector is installed, and run the TrafficDirector application.

Step 2 Select an agent, agent group, or switch from those shown in the lists in the TrafficDirector main window and click the Traffic Monitor icon, or select Application>Traffic Monitor from the menu bar. Depending on your selection, you will see one of two displays.

• If you selected an agent or agent group, you will see one graph cluster or pie chart for each agent in the group. On the Traffic Monitor main window, the default Vital Signs 3-D bar graph is displayed (Figure 4-2).

• If you selected a switch, you will see one graph cluster or pie chart for each port and roving agent (if any), as well as any server and trunk port probes (Figure 4-3).

The Traffic Monitor window for the selected agent, group, or switch is displayed. From this main window, you can now work with Traffic Monitor in a variety of ways, described by the procedures in this chapter.

Figure 4-2: Traffic Monitor Main Window Agent Display

Switch Traffic Monitor Main Window

Viewing MAC-Layer Statistics

You can now select the type of data you want to monitor, the type of display, and the sample interval. Although you can only monitor one data type at a time, you can simultaneously launch a number of Traffic Monitor windows, each monitoring a different statistic independent of the other windows.

Selecting the Display

To select the type of graphical display you want to view the data in, select the Properties menu and then the type of display. You have three graphical display choices:

• 2-D bar chart

• 3-D bar chart

• Pie chart

Transposing and Inverting the Display

To either transpose or invert the display, do one of the following:

• To transpose the display, as described in the "Transposing Displays" section, select Properties>Transpose from the menu bar.

• To invert a bar graph display, as described in the "Inverting Displays" section, select Properties>Invert from the menu bar.

Selecting the Data Type

You can now choose the type of data that you want to monitor by selecting the View menu from the menu bar and then selecting the data type. The following list gives a brief description of the data types you can monitor:

Changing the Sample Rate

The sample rate is the interval of time TrafficDirector waits before polling the selected agents and updating the information displayed. You can change this sample rate to meet your needs, as follows:

• 15 seconds

• 30 seconds

• 1 minute (default rate)

• 2 minutes

• 5 minutes

To change the sample rate, select Sample and then select one of the rates described above. TrafficDirector immediately uses the new sample rate to poll the segment and then update the information in the graphical display.

Using Scope to Monitor Specific Agents in an Agent Group

Scope lets you edit your display to include only specific agents when monitoring an agent group. For example, if you are monitoring an agent group consisting of five agents, you can change the scope of your display to focus on only three of those agents. To change the scope of your display, use the following procedure.

Step 1 Select Scope from the menu bar. The Scope window, containing an Agents list of the agents you are currently viewing, is displayed (Figure 4-4).

Figure 4-4: Scope Window (Agent Group)

Using Scope to Monitor Specific Switch Ports and Roving Probes

If you selected a switch before launching Traffic Monitor or Protocol Monitor, Scope lets you edit your display to include:

• Specific ports of the switch

• The roving agent assigned to the switch (if any)

• All attached server and trunk port probes (if any)

Use the following procedure to see only specific ports, agents, or attached server or trunk port probes.

Step 1 Select Scope from the menu bar.

The Scope window, containing a list of all ports on the switch, is displayed (Figure 4-5). Any server and trunk port probes are included in the list.

Figure 4-5: Scope Window (Switch Information)

Launching Other Tools from Traffic Monitor

You can launch other segment and domain monitoring tools directly from Traffic Monitor. To do so, first select Tools and then any of the following:

Getting Agent Information

When you want to see basic information about a selected agent, use the following procedure.

Step 1 Select Tools>Agent Info from the menu bar. The Launch Application window (Figure 4-6) is displayed.

Figure 4-6: Launch Application Window

Step 2 Highlight Agent Info in the Application list and the agent you want basic information for in the Agents list, then click the Launch button. The Agent Information window (Figure 4-7) is displayed.

Figure 4-7: Agent Information Window

Exiting Traffic Monitor

To exit Traffic Monitor at any time, select File>Exit from the menu bar.

Monitoring Remote Sites Using Protocol Monitor

In this section, you will learn how to start and use Protocol Monitor to monitor your network in terms of its protocol composition. The following discussion steps you through each procedure and includes a detailed explanation of every available option and feature.

Displaying Protocol Monitor

Use the following procedure to display Protocol Monitor from the TrafficDirector main window. Once you display the Protocol Monitor application, you can begin to monitor network traffic in terms of protocol information.

Step 1 Log in to the network management station where TrafficDirector is installed, and run the TrafficDirector application.

Step 2 Select an agent, agent group, or switch from those shown in the list boxes in the TrafficDirector main window and click the Protocol Monitor icon, or select Application>Protocol Monitor from the menu bar.

In the Protocol Monitor main window are three displays with one bar graph cluster or pie chart for each agent or agent group (Figure 4-8).

Step 3 From this main window, you can begin to monitor your network in terms of protocol makeup and behavior, using various procedures described in this chapter.

Figure 4-8: Protocol Monitor Main Window

The Protocol Monitor Display

The Protocol Monitor display consists of three separate-but-related displays, as shown in Figure 4-8. The display shows:

Viewing Protocol Relationships

To give you a more detailed analysis of how your network is utilizing specific protocols, Protocol Monitor lets you narrow your focus from the network layer protocols and view parent protocols and their respective children.

To view the children of a specific parent protocol, click the corresponding color box in the Parents' legend. The children of that particular protocol are then displayed in the Protocol-type children display area as shown in Figure 4-8.

Defining Protocol Parents and Children

You will only see the children of a particular parent protocol if the relationship has been defined in the text file c:\traffdir\domtree.inf. TrafficDirector comes with a number of protocol parent/child relationships already defined in this file, but in rare cases, you may want to redefine or add new parent/child relationships to better suit your network monitoring needs. Figure 4-9 shows an example of the domtree.inf configuration file.

#
# Protocol parent-children relationship (File: domtree.inf)
#
RMON	IP NOVELL DECNET ATALK VINES SNA
NOVELL	NCP
IP	TCP UDP ICMP
TCP	FXTP XWINDOW HTTP
UDP	SNMP NFS

Viewing Network Statistics in Terms of Protocol

You can now select the type of data you want to monitor, the type of display, and the sample interval. Remember, although you can only monitor one data type at a time, you can simultaneously launch a number of Protocol Monitor windows, each monitoring a different statistic independent of the other windows.

Selecting the Display

To select the type of graphical display you want to view the data in, select the Properties menu and then the type of display. You have three graphical display choices:

• 2-D bar chart

• 3-D bar chart

• Pie chart

Transposing and Inverting the Display

To either transpose or invert the display, do one of the following:

• To transpose the display as described in the "Transposing Displays" section, select Properties>Transpose from the menu bar.

• To invert a bar graph display as described in the "Inverting Displays" section, select Properties>Invert from the menu bar.

Selecting the Data Type

You can now choose the type of data that you want to monitor by selecting the View menu and then selecting the data type. You have a choice of three data types:

Changing the Sample Rate

The sample rate is the interval of time that TrafficDirector waits before polling and updating the information displayed in the list. You can change this sample rate to meet your needs, as follows:

• 15 seconds

• 30 seconds

• 1 minute (default rate)

• 2 minutes

• 5 minutes

To change the sample rate, select Sample, and then select one of the rates described above. TrafficDirector immediately uses the new sample rate to poll the segment and then update the information in the graphical display.

Launching Other Tools from Protocol Monitor

You can launch other segment and domain monitoring tools directly from Protocol Monitor. To do so, first select Tools and then any of the following:

Exiting Protocol Monitor

To exit Protocol Monitor, select File>Exit from the menu bar.