Network Monitoring: Active & Passive

• Covers Network Monitoring
• Active monitoring
• Passive monitoring
• Monitoring categories:
• Network specifications (Ethernet),
• Network traffic and protocols,
• Platforms and operating systems

Network Montoring Definition

• Describes the use of a system that constantly monitors a computer network for slow or failing components
• Sends notifications to the network administrator via email, SMS or other alarms in case of outages
• It is a subset of the functions involved in network management
• Also includes monitoring an active communications network to diagnose problems and gather statistics for administration and fine tuning

Types of Network Monitoring

• Active Monitoring
• Passive Monitoring

Monitoring Categories

• Network Specifications
• Network Traffic and Protocols
• Platforms and Operating Systems

Establishing an Ethernet Baseline

• Things to monitor:
• Network utilization
• Collision rate
• Errors

Ethernet Utilization

• A network performance measure that specifies the amount of time a LAN spends successfully transmitting data
• Performance monitoring tools provide average and peak utilization times, reported as a percentage
• Delays occur 40% to 50% due to increased collisions
• Should achieve 15% to 25%

Peak Utilization

• Means that a certain percentage of the LAN's capacity was utilized
• Need to look at Protocols, Devices, and Users
• Determine when peaks occur

Average Utilization

• Means that, on average (e.g., 10 hours), a certain percentage of the LAN's capacity is used for successfully transmitting data
• Calculated level over longer time

Additional Resources for Utilization Monitoring

• PDFs include:
• Extracted_from_Networking_Explained_Part_1.pdf (2 pages)
• Extracted_from_Networking_Explained_Part_2.pdf (2 pages)
• Understanding_the_bits_per_second.pdf (3 pages)

Broadcasts

• Rate should not exceed 5-10%
• Excessive amounts of broadcast or multicast traffic is a concern

Multicasts

• Communication between small groups of devices
• Same rules as broadcast

Examining Ethernet Errors

• Collisions
• Short frames
• Bad FCS
• Long frames
• Ghosts

Collisions

• If two frames are transmitted simultaneously by two stations, they overlap in time, resulting in a garbled signal
• Collisions are normal
• Use CSMA/CD and Jam signal
• Captured in the output 1790 collisions

Short Frames

• Are smaller than the minimum legal size of 64 bytes, with a good frame check sequence

Bad FCS (Frame Check Sequence)

• Also referred to as a checksum or CRC error
• Differs from the original transmission by at least one bit
• The header information is probably correct and the frame may also have a valid size
• The checksum calculated by the receiving station does not match the checksum appended to the end of the frame by the sending station
• The frame is then discarded

Long Frames

• Larger than the maximum legal size of 1518 bytes
• Does not consider whether frame had a valid FCS checksum

Ghosts

• Classified as energy (noise) detected on the cable that appears to be a frame, but lacks a valid SFD
• The frame must be at least 72 bytes long, including the preamble
• Slows network but doesn't increase utilization

Network Traffic

• Measure the amount and type
• Need hardware tools

Possible Types to Monitor

• Number of Nodes/Users
• Protocols
• Broadcast/Multicast/Unicast
• Conversations
• Errors

Number of Nodes/Users

• Workstations
• Servers
• Peripherals
• Routers and switches
• Who is on the network
• Physical access

Protocols

• Device-dependent
• Segment dependent

How Much Traffic Is Overhead Protocols

• ARP (Address Resolution Protocol): Find the physical address for a given logical address
• DNS (Domain Name Service): Find the IP address for a given domain name
• ICMP (Internet Control Message Protocol): Core protocol of the Internet Protocol Suite used primarily for sending error messages
• LDAP (Lightweight Directory Access Protocol): Access and maintain distributed directory information services
• RIP, EIGRP, OSPF: Managing network devices

Connections

• Used to determine who is talking to who
• What is the flow of data (how much?)
• Assess if traffic is from routers or servers
• Applications - know what is on the network
• Which protocols are used and by whom

Error Locations

• 65% to 75% of network errors occur in the first three layers
• Causes: Duplicate addresses, Host/Station/Network unreachable, Time-To-Live (TTL) exceeded

Server Workload Characterization

• In a network, workload is the amount of work assigned to or done by a client, workgroup, server, or internetwork in a given time period
• Workload characterization observes, identifies, and explains phenomena in a way that simplifies understanding the client, workgroup, server, or internetwork's usage
• Things to consider: Server type, Workload characterization, Isolate components that restrict data flow, and Set expectations

Common Server Problems

• Disk Subsystem
• CPU
• Memory
• Network Adapters

Common Server Problems: Disk Subsystem

• Is more than the disk itself
• Problems can occur with any components in the subsystem
• In NT based Windows server environments it has two parts: physical and logical
• physical disk for high-level overall analytics
• logical disk for individual partition analysis

Common Server Problems: CPU

• Most server machines support 1-4, 1-8, or up to 1-16 processors
• Each processor can have up to 18 CPU cores
• Common problems: Overheating due to incorrect thermal bonding with heat sink, Mismatches between CPU and memory speeds, Different CPUs populated with different numbers and sizes of memory modules

Common Server Problems: Memory

• Server machines have one or more memory modules per processor
• Some stations support up to 96 memory modules
• Common problems include: different module sizes for all CPUs, improperly seated memory modules, modules with different speeds, unsupported memory modules for the particular server model

Common Server Problems: Network Adapters

• Stations support a large number of NIC ports, up to 16 ports
• Larger port numbers increase complexity of troubleshooting
• Common problems include: incorrect firmware for adapters, improper configuration/restrictions on supported combinations

File and Print Servers

• Manage the storage of data and printers on the network (e.g., Windows Server 2008, Mac OS X Server, Red Hat Linux Server, Ubuntu Server Edition)
• Key concern is Disk I/O or the number of user's attempting access to the server
• Focus on the number/type of users accessing the server concurrently

Web Servers

• Allow internet users to attach to your server to view and maintain web pages
• Primary problem areas to focus - Memory >> Network
• Must fulfill requests from cache for maximum performance

Application Server

• Handles all application operations between users and backend business applications or databases, also known as an appserver
• Features include built-in redundancy, monitoring for high-availability, high-performance distributed application services, and support for complex database access
• Primary problem areas to focus - Memory >> Other
• Smaller, more frequent requests than file and print server environments

Logon Server/System Services

• Authenticates users to the domain
• Can provide convenient authentication features such as Single Sign-On (SSO). This enables users to access multiple applications/services using the same username and password
• Primary problem areas to focus - Processor >> Disk
• Monitor - Activity generated between Servers and user peak activity

Factors Affecting Performance

• Performance degradation is proportional to the problems
• Problems occur in ares that affect performance
• Disk Subsystem
• Memory
• CPU
• Network

Common Hard Disk Measurements

• Current Disk Queue Length
• % Disk Time
• Avg. Disk Queue Length
• Disk Reads/sec
• Disk Reads Bytes/sec
• Avg. Disk Bytes/Transfer
• Avg. Disk sec/Transfer

Paging

• Moves individual pages of a process to the disk to reclaim memory. The paging algorithm tracks when each page was last used and tries to keep recently used pages in memory.

Swapping

• Moves an entire process to disk to reclaim memory
• When the system runs the process, it must copy it from the disk swap space back into memory

Paging and Swapping

• Paging moves individual process pages to disk, the paging algorithm tracks used pages in memory
• Swapping moves the whole process to the disk

Common Memory Measurements

• Page Faults/sec
• Pages Input/sec
• Pages Output/sec
• Pages/sec
• Page Reads/sec
• Page Writes/sec
• Available Memory
• Nonpageable memory pool bytes
• Pageable memory pool bytes
• Committed Bytes
• Pool Paged Bytes
• Pool NonPaged Bytes
• Working Set
• Paging File, %pagefile in use

Common Processor (CPU) Measurements

• % Processor Time
• Interrupts/sec
• % Interrupt Time
• % User Time
• % Privilege Time
• % DPC Time
• % Processor Time
• Processor Queue Length
• System Calls/sec
• % Total Processor Time
• % Total User Time
• % Total Privilege Time
• % Total Interrupt Time

Common Network Card Measurements

• Bytes Sent/sec
• Bytes Received/sec
• Bytes Total/sec
• % DPC Time
• DPCs queued/sec
• % Broadcasts
• % Multicasts
• Segments Sent/sec
• Segments Received/sec
• Segments/sec
• Segments Retransmitted/sec
• Connection Failures
• Connections Reset
• Connections Established
• Server Sessions
• Output Queue Length