Integration between OptiView Console and Network Associates Sniffer Technology

Transcription

1 Integration between OptiView Console and Network Associates Sniffer Technology Fluke Networks offers solutions to maintain network uptime and performance. The OptiView product line utilizes several approaches at the same time to create an integrated, encompassing view of the network through network discovery, statistical analysis, and protocol analysis. This application note will discuss how network managers can leverage OptiView Console to tightly integrate with existing Network Associates Sniffer analyzers. The Sniffer and Distributed Sniffer Systems are widely used tools in many enterprise organizations. The latest release of OptiView Console will: Discover Sniffer systems Automatically collect RMON statistics Launch the remote Sniffer console Leveraging the troubleshooting and monitoring capabilities of both Fluke Networks products and Sniffer technology allows you to better maintain and control your networks from a central location. Network managers face daily challenges building and maintaining the infrastructure and technology that runs their business. Unfortunately, current economic factors are forcing many IT groups to reduce their staff. While head count has gone down, the quality of the networks and associated services have been expected to increase in order to support new business applications; voice over IP deployments and multimedia usage. In addition, corporations are experiencing a greater number of mergers and acquisitions that require IT departments integrate geographically and technologically distinct groups. Whether on the acquiring side or the acquired side, IT managers need to prove their operations are integrated and running smoothly, or face post-merger downsizing. The challenge is to support multiple networks built and designed by different organizations. It s no wonder network management systems and tools need to be utilized in order to keep up with the demands of these jobs. Network Associates Sniffer technology Network Associates sells a popular PC-based protocol analyzer commonly known as Sniffer. As the first PC-based protocol analyzer, Sniffer is a mature technology well recognized in the networking community. While other recently released protocol analyzers provide users with an updated UI, extensive protocol decodes, faster processing and expert analysis, legacy Sniffers can still be found throughout many enterprise networks. Sniffer technology comes in two flavors, the Portable Sniffer and the Distributed Sniffer System (DSS). OptiView Console has the greatest integration with the distributed versions. OptiView Console will automatically discover Sniffer systems on the network, launch Sniffer console software with the click of a mouse, manage alarms from multiple Sniffer systems, and view monitoring information from multiple Sniffer data sources. The OptiView solution OptiView s key advantage over other network management solutions is the multi-vector view of the network using network discovery, statistical analysis, and protocol analysis. This provides an integrated means for viewing and controlling Fluke Network products, third party network management tools and third party traffic monitoring data sources. The integration of products and tasks within OptiView Console gives you added visibility and control over your network by fully utilizing the multiple tools and data sources you already own, no matter which vendor those products are from. Application Note A total view of your LAN

2 A component of the OptiView Console solution includes OptiView Console Service Manager Agents. These software modules are installed on remote PCs to discover and monitor remote network segments, then send that information back to the central OptiView Console. Once a device has been discovered, OptiView Console and the Inspector Agents maintain regular communications with that system ensuring administrators will have updated status. Depending on what type of system it is, OptiView Console ensures connectivity, collects MIB II statistics, aggregate RMON statistics and even receives SNMP traps. If RMON tables are available in the device, OptiView Console can import those statistics and make them available for statistical analysis or troubleshooting investigation. If a device isn t discovered (because it is outside of the broadcast domain), then users can manually enter the IP address of systems they want to monitor and OptiView Console will make the connection and add it to the list of systems to monitor. Users can also designate certain devices as key devices for a higher grade of service. Active Discovery NETWORKSUPERVISION Statistical Analysis The OptiView multi-vector approach Packet Capture Sniffer discovery with OptiView Console In today s economy, IT organizations are managing not only their networks, but head count reductions and employee turnover. Most importantly, key personnel, or knowledge keepers, who maintain the IT systems and architecture, are leaving organizations without replacement. When these people leave, certain systems have a tendency to disappear from visibility and become ghostware on the network. This is especially true for network management and troubleshooting tools which are used intermittently. Equipment that is initially installed with fanfare disappears into obscurity when not regularly used and configured, or when administrators leave the organization. This is unfortunate since managing networks with a decreased head count can be offset with proactive use of network management tools. Effectively using these tools allows companies to maintain network uptime and ensure user productivity. For Sniffer installations, the OptiView Console identifies and tracks Sniffer systems on a network for easy access and a consolidated view. OptiView Console will even locate Sniffer systems that were previously unknown, moved unwittingly, or deployed without authorization. OptiView Console Service Manager discovers portable Sniffers and Distributed Sniffer Systems and then sends that information back to the OptiView Console. OptiView Console Service Manager Agents automatically discover Sniffers using a combination of ARP, Ping, and SNMP query and response messages. Because DSS has built-in RMON and SNMP, it will respond to these inquiries. OptiView Console Service Manager also discovers portable Sniffers, but since they don t respond to SNMP system group inquiries, a portable Sniffer will show up under the general device group in OptiView Console. Discovery and management Inside broadcast domain Remote broadcast domain Remote broadcast domain with Agent without agent Distributed Sniffer System OptiView Console will automati- OptiView Console and Agent OptiView Console will monitor cally discover the DSS will automatically discover DSS DSS once user enters IP address Collects RMON stats Collects RMON stats Collects RMON stats Portable Sniffer OptiView Console will discover OptiView Console and Agent OptiView Console will monitor Sniffer as a node on network will discover Sniffer as a node Sniffer as a node on network on network once user enters IP address Table 1: Sniffer discovery with OptiView Console

3 Steps for discovering Sniffer with OptiView Console 1. Ensure your OptiView Service Manager is running 2. Launch OptiView Console Viewer 3. Highlight the Sniffer Device Category 4. Portable Sniffer devices will be listed as a host and can easily be identified with the NAI prefix to the MAC address RMON monitoring Sniffer technology is best known for packet capture and protocol decode capabilities. Additionally, Distributed Sniffer devices have built in RMON that can be used with OptiView Console s trending and reporting. The RMON1 and RMON2 MIBs allow these Sniffer devices to become a data source for data link, network layer, and application layer statistics and trending reports. This information is helpful in two ways: RMON statistics can be used to help baseline and trend network traffic for future capacity planning and alarm threshold discovery RMON statistics can be used as a starting point for network troubleshooting and problem resolution Network Associates provides Sniffer Reporter, a reporting application, with DSS systems. Sniffer Reporter is adequate for basic trending and capacity planning purposes on a system by system basis. However, when you need to troubleshoot network problems using statistics, Network Associates doesn t provide a cost effective way of creating consolidated statistical information from multiple Sniffer RMON data sources. Additionally, RMON data from other network devices (except a few Cisco switches) can t be collected and displayed with any Network Associates products. Sniffer device group showing DSS appliances OptiView Console is vendor neutral and views all RMON data as a valuable source of network troubleshooting information. A user can view network utilization and error data from a DSS located on a main switch trunk, and then with a single click of the mouse look at RMON data from an OptiView Integrated Network Analyzer, OptiView Workgroup Analyzer or RMON data source located on a server switch port. Simply provide the necessary community string information for OptiView Console and all this data will be regularly collected and presented to the user. This seamless accessibility to network data allows you to extend visibility through the integration of multiple network management data sources. Configuring RMON on Distributed Sniffer appliances 1. From the Start menu on the Distributed Sniffer PC, choose Programs/ Distributed Sniffer Pro/ ProbViewer 2. In the Sniffer Agent dialog box, click the Configuration tab 3. Next, select the Start tab (below the Adapter pull-down list) 4. Check the boxes that enable RMON 1 and RMON 2 data collection. This ensures that RMON stats are being collected on the Distributed Sniffer appliance

4 Configuring RMON trending in OptiView Console Using OptiView Trending Tab 1. Select Properties on a Sniffer device or an RMON data source 2. Select the Interface Tab 3. Mark the check box next to each of the interfaces you wish to trend. 4. Close the Properties window 5. Select the Trending tab in the OptiView Console Viewer screen 6. Use the device pull-down menu and the interface pull-down menu to display the trending information you would like to see 7. Note that these graphs trend Utilization, Broadcasts, Collisions/Fragments, and Errors 8. By simply toggling between Sniffer devices and interfaces you can get a quick view of network performance from multiple locations 9. Long-term trending information will be saved in the archive pull-down menu OptiView Console integrates network management products from Fluke Networks and other vendors to better maintain network performance and uptime. Utilizing the discovery, collection, analysis and display process, you are continually kept up to date on the systems, alarms, and statistics throughout the enterprise. This information makes averting network trouble easier. When an issue does present itself, you ll find fast answers with the point and click access to troubleshooting tools, such as the Networks Associates Sniffer and the Fluke Networks Protocol Expert. Whether you are responsible for an enterprise size or a campus network, OptiView Console ensures you will be able to gain the maximum return on all your past and future investments in network management solutions. Interfaces Tab Trending information using the OptiView Console Trending Tab

5 FAQ Why should I use the OptiView Console to manage my Sniffer installations instead of just the Sniffer Console? The Sniffer Console is fine for networks utilizing only Sniffer technology for network management. However, since most networks utilize a variety of tools and solutions, the OptiView Console ensures that a single application will integrate them all for simple access and control. In addition, OptiView Console provides network discovery and mapping capabilities that can t be found in any of the Sniffer products. Doesn t NAI offer a way to centrally view real-time RMON statistics from DSS and Sniffers? No, Sniffer users can view real-time statistics from the dashboard of a single DSS, or launch connections to multiple DSSs to view more than one set of statistics. The NAI npo Visualizer will aggregate statistics from multiple DSS units, but won t collect any other data collection sources. For portable Sniffers, there isn t any way to view realtime statistics except from the screen of that system alone. What s different between the Sniffer reporting application and the OptiView Console reporting capability? Sniffer offers a couple of reporting solutions. The Sniffer Reporter is designed as a reporting solution for single Sniffer/DSS systems. Information from each reporter isn t aggregated into a single database. Additionally, Sniffer Reporter runs on the same PC as the Sniffer software, and therefore utilizes system resources that would otherwise be managed for packet capture, analysis and troubleshooting purposes. npo Visualizer is a long-term trending and baselining appliance that will collect RMON and DSS data for the creation of web based reports. Should I use OptiView Console instead of a full fledged network management system? This depends on your organization. Network management systems such as HP OpenView, CiscoWorks, Tivoli and CA UniCenter provide advanced features and scalability. However, many companies can t designate adequate resources to keep these systems configured with the most up-to-date information. OptiView Console does not require this type of management in order to provide valuable and up-to-the-minute information about your network and the systems on it. For this reason, many organizations use OptiView Console as a supporting network management system for small branch/campus networks, or as their main network management system for small to medium size networks. What Fluke Networks products integrate with the OptiView Console? OptiView Console can discover, poll and/or launch controls for the: OptiView Integrated Network Analyzer OptiView Workgroup Analyzer OptiView Protocol Expert OptiView Link Analyzer OneTouch OptiView WAN Analyzer What other networking products are tightly integrated with the OptiView Console? OptiView Console integrates and discovers a wide range of systems, nodes and products. Following is a limited list of the types of devices that will be discovered by OptiView Console: Routers Switches Wireless access points RMON devices Hosts Cisco Switches and Routers SNMP devices Printers Cisco Works Servers What is the difference between Sniffer s Switch Expert and the OptiView Console Switch Integration? OptiView Sniffer Switch Expertise Console Systems Number of switches supported 42 9 Collecting private MIB information Yes Yes Set thresholds on switch port variables Yes Yes Create alarms and alerts based on Yes Yes switch port traffic Discovers switches Identify closest switch Identify trace switch routes Map trace switch route Identify switch port attached to a device Identify devices attached to a switch port Integrated MIB browser Configuring Span port Yes Yes Configuring VLAN span Yes Yes Start a capture for specific Span port Yes Yes Store trended data and reports for indi- Yes Yes vidual switch ports

6 Switch / Model OPV-C Private MIBs Sniffer 3Com LinkSwitch 1000 Superstack 610 Superstack 1100 Superstack 3000 Series Cisco C1900/2820 Yes Yes C2900 Yes Yes Yes C3100/3200 Yes Yes Yes C3500 Yes Yes Yes C4000 Yes Yes Yes C5000/5500 Yes Yes Yes C6000 Yes Yes Yes C8500 Yes Yes Yes GigaStack Cluster Configurations Yes Yes Yes Enterasys (Cabletron) SmartSwitch 2000 Series SmartSwitch 6000 Series SmartSwitch 9000 Series SmartStack Extreme Summit 24/48 Alpine 3808/3904 Summit 1i,4, 5i, 7i BlackDiamond 6808 Foundry FastIron II FastIron II Plus ServerIron XL Hershman ALS Switches support for non-std forwarding database MIB No Lucent Cajun P110/120 Yes Bridge MIB support requires firmware version or higher No Cajun P220/550/770 Yes Bridge MIB support requires firmware version or higher No Nortel Baystack 70 Baystack 350 Baystack 450 Passport (Accelar) 700 support for non-std Bridge MIB No Passport (Accelar) 8000 support for non-std Bridge MIB No Centillion 50 support for non-std Bridge MIB No Centillion 100 support for non-std Bridge MIB No Centillion 1000 support for non-std Bridge MIB No Series Yes Private MIB support No Yes Private MIB support No Dell Powerconnect 3012 Yes Private MIB support for VLAN configuration No Powerconnect 3024 Yes Private MIB support for VLAN configuration No Powerconnect 3048 Yes Private MIB support for VLAN configuration No Powerconnect 5012 Yes Private MIB support for VLAN configuration No

7 OptiView Console s ability to discover switches and report VLAN, port/slot, and device list information is impacted by a vendor s use of private MIBs and protocols, versus standard MIB and protocol implementations. What the analyzer can discover is dependent on how devices are configured and to what degree the standards have been implemented. The analyzer supports some vendors private MIBs, but not all. The analyzer discovers switches through active SNMP queries and traffic monitoring. Switches are discovered using the following methods: Monitor management frame types Cisco Discovery Protocol (CDP), Bay Network Management Frame (SONMP) Monitor spanning tree frame types 802.1d BPDU, DEC Bridge Spanning Tree, Bay Network Bridge (Lattice) Spanning Tree SNMP queries 802.1d Bridge MIB Private MIB queries Cisco, Nortel LAN Switch List In an effort to offer more information about the switch VLAN number, port/slot number and devices on a port the analyzer draws first from a vendor s Private MIB if supported, second from the Bridge MIB (Standard MIB) and third from the Interface Table. If a device supports VLANs, the vendor has generally implemented a private MIB. If private VLAN or a non-standard Bridge MIB is not supported, the analyzer behaves as follows: May not find VLAN #, Slot #, Port # No listing of addresses residing on a port (non-standard Bridge MIB) Trace SwitchRoute fails (OptiView and OptiView Inspector Console) The slot and port information found in the interface table may not be easily correlated to information provided in the private MIB. What switches are discovered by OPV-C vs. Sniffer Switch Expert? See Table 3 on the previous page. What is network visibility? Fluke Networks believes that network visibility is a necessity to manage, troubleshoot and maintain the networking technologies that keep businesses running. When you have visibility, you can easily identify the components of your infrastructure that require management. Visibility also provides you with information that makes management of those components easier. Visibility includes the ability to discover and use advanced management tools to help troubleshoot and monitor the network. However, large networks have an ability to take on a life of their own. They grow, evolve and develop without a single source of oversight. When asked if they can identify each component that needs management, many IT organizations would not be able to reply with an adequate answer. So when a problem develops on the network and troubleshooting is required, many organizations won t have the ability to locate the affected area and the management tools to help isolate problems. Distributed troubleshooting tools like the Distributed Sniffer System require users to know an IP address in order to access the device s capabilities. Whether the device is in its original location or has been moved, OptiView Console will provide quick access to your troubleshooting tools and the networks around them. How can I get more information or a demo version of the OptiView Console? Contact your local Fluke Networks representative, or call NETWORKSUPERVISION Fluke Networks P.O. Box 777, Everett, WA USA Fluke Networks operates in more than 50 countries worldwide. To find your local office contact details, go to Fluke Corporation. All rights reserved. Printed in U.S.A. 10/ D-ENG-N Rev A