Characteristics of Switched Networks
Traditional LAN technologies commonly use shared media to allow internet work devices to communicate. As illustrated in Figure 2, when a device communicates on shared media, the shared media hub propagates its signal to all other connected devices. Each device in a shared environment is expected to monitor the network to determine when it is legal to send its message. The available bandwidth is then shared by all active stations in the domain.
The switched networking environment attempts to provide equal and unrestricted network bandwidth access to each device on the network. When a device transmits data across a switched network, the switched hub determines precisely which devices require this information and where to forward it. Each port on a switched hub replicates packets destined only for the devices connected to that port, or broadcast and multicast packets destined for all devices. Some switches (single-MAC) allow only one device to be connected to each port. In that case, the switch provides a dedicated, full-bandwidth connection. Switches that allow multiple devices to connect to a single port (multi-MAC) when properly used, can come close to providing dedicated bandwidth for each device.
Shared media hubs are similar in function to multi-port repeaters. They regenerate incoming signals on all ports, without determining which ports actually require the data. A switched media hub is similar to a multi-port bridge. As seen in Figure 3, the switch determines where to send incoming data according to the destination hardware address of the packets.
The overall benefit of this technology is that multiple conversations can occur simultaneously on a single switched hub, because each port is a separate segment.
LAN Switches
New types of network switches are coming to market every month. Switch vendors currently offer many varieties of switches. This section lists some of the common features that you can evaluate to help determine what kinds of switches to use in your network. Each feature can impact performance, functionality, and implementation strategy:
Forwarding Technique : Does the LAN switch use cut-through or store-and-forward technology?
Latency : How much delay does the switch introduce?
Management : How much control does the switch provide to the user?
Single- versus Multi-MAC : Does the switch associate a single address or multiple hardware addresses with each port?
External Monitoring : Does the switch allow you to connect an external device to monitor individual ports, selected circuits, or all switch traffic?
Spanning Tree : Does the switch support the spanning-tree algorithm, or some other technique that detects and eliminates topology loops?
Full Duplex : Does the switch allow ports to send and receive data simultaneously?
High-Speed Integration : Does the switch maintain a higher-speed media port (such as FDDI, Fast Ethernet, or ATM) to access shared resources?
Forwarding Techniques
A network switch usually employs one of two techniques to allow the switch to make forwarding decisions about incoming data. Each technique has unique benefits and disadvantages. Cut-through: This technique requires the switch to hold the packet until the switch receives the destination address (usually not more than six bytes into the frame). At that point, the switch has enough information to make a forwarding decision. The benefit of this feature is that the switch can forward packets at a higher rate, reducing latency and increasing overall throughput. The drawback is that the switch will start to forward a packet before it has seen enough of the packet to determine if there is an error in the frame. The switch could potentially propagate error frames, or even congest the network with “garbage” that the switch may misinterpret as a broadcast. Store-and-Forward: This technique requires the switch to accept the entire frame before making the forwarding decision. The benefit of this feature is that the switch can also determine whether there is an error in the packet before making a forwarding decision. Some Ethernet switch manufacturers are also introducing collision-avoidance techniques to minimize the propagated network errors. The drawback to store-and-forward is that the switch must wait much longer before it is allowed to make a forwarding decision. This increases latency, and thus it can impact overall network throughput adversely.
Latency
Switch latency is the time lapse from when the switch starts receiving data to when it begins to propagate that data to the destination port. There are many factors that can affect latency, such as the forwarding technique that the switch uses.
Switched hubs that employ the cut-through method often have a fixed latency delay. A cut-through switch will always make a forwarding decision after seeing the destination address of the packet, regardless of the overall length of the packet. The latency of a store-and-forward switch is dependent on the packet size, as the switch must receive the entire packet before it begins to forward it.
Management
“Switch management” is how much control the user has over the switch, and how much visibility the user has into the network traffic that passes through the switch. Typically, network switches are controlled via network management software which can control the switch configuration remotely, using SNMP, for example.
Visibility into the switch can consist simply of access to SNMP MIB I/MIB II statistics. In more sophisticated switches, there can be RMON groups embedded within the switch (mini-RMON), or a means of switching an external RMON probe to selected ports (roving RMON). These capabilities are discussed in more detail in the NetScout Unison™ architecture section of this paper.
External Monitoring
Many switch vendors offer a “monitoring port” to allow a network analysis device to be connected to the switch, although their implementation techniques vary from vendor to vendor.
These monitoring techniques are discussed more fully in the section on monitoring and troubleshooting later in this paper.
Single- versus Multi-MAC
Single-MAC switches associate a single hardware address with a port on the switch.Multi-MAC switches can associate multiple hardware addresses on each port. Understanding the address limitations of the selected switch is crucial to useful implementation on the network.
Single-MAC switched hubs are primarily designed to connect directly to an end user, a shared resource (such as a file server or a group of servers), or to interconnect multiple routers that do not implement bridging. They were not designed to interconnect shared media hubs, or network segments containing multiple devices. Figure 4 illustrates the single device to single port relationship of the Single MAC switch.
Multi-MAC Ethernet switches have enough memory to associate multiple hardware addresses with a single port. Such switches can be implemented as a logical “hub of hubs” or in backbone architectures. The total number of hardware addresses that the switch can buffer differs from vendor to vendor. It is important to be aware of the limitations of the switch to ensure that the switch is not exposed to more hardware addresses than it is capable of buffering. Once the number of learned addresses exceeds the available address space, the switch may propagate packets with new addresses to all ports on the switch or even drop the frames altogether. Figure 5 demonstrates how Multi-MAC switches can associate several addresses with each port.
Spanning Tree
Just as shared media hubs operate similarly to multiport repeaters, switched hubs operate similarly to multiport transparent bridges. They are also susceptible to the same types of problems as bridged networks. This includes topology loops.
Topology loops occur when traffic is transmitted on one segment, bridged to another segment, and returned to the originating segment via a different route. The Spanning Tree algorithm and protocol eliminate this occurrence by allowing the bridged devices on a network to be aware of each other. As seen in Figure 6, the switch automatically disables one of the ports that would complete this loop until the topology loop is no longer present. Some switch manufacturers do not implement the Spanning Tree algorithm, but do implement a proprietary solution to prevent network topology loops.
Topology loops may be introduced into a network design by accident or intentionally to provide a redundant backup data path. It is often useful to take advantage of redundant links in mission-critical applications. If the switched hub does not participate in the Spanning Tree process, proper placement of the switch should be considered carefully.
Full Duplex
A switch that maintains full-duplex ports has the capability to simultaneously transmit and receive data across these ports. To take advantage of this feature, both the switch’s port and the connected device must support the full-duplex technology.
There are several benefits to full-duplex operation:
• Throughput: If the switched media hub and the connected device can send data to each other simultaneously, then potentially throughput can double.
• Collision Avoidance: In an Ethernet environment, full-duplex operation can be used to avoid collisions.
• Improved Distance Limitations: In some circumstances, distance limitations are imposed on some media types because of the potential for collisions (for example, Ethernet over fiber optic cable). If collisions cannot occur, distance is limited only by media restrictions.
Currently, the most common topologies able to support full-duplex operation are Fast Ethernet and ATM. The Fast Ethernet standard allows full-duplex operation over 100BASE-T/X cables and 100BASE-F/X cables. ATM standards support full-duplex operation over a wide variety of media.
Network General analyzers are able to monitor and troubleshoot full-duplex circuits on both Fast Ethernet and ATM links.More detailed discussions on full-duplex monitoring are presented later in this paper.
High-Speed Integration
In a small workgroup or domain, connecting all users and file servers to Ethernet switches can potentially improve performance. However, many networks cannot take advantage of this technology on their own, because of their geographic layout. If a network primarily had workstations distributed on various hubs and located all file server resources on a backbone segment, replacing the users’ normal shared media hub with a same-speed switched hub would not provide any benefit. The single connection between the switched hub and the backbone would prohibit more than one user from connecting to the backbone at one time. This eliminates any benefit that the switch might provide.
One solution to this potential problem is to provide a greater bandwidth “pipe” between the switched hub and the backbone segment. Providing a dedicated 10 Mbps connection from each user to the switched media hub, and a high-speed connection from the switched media hub to the backbone, improves or eliminates the previous bottleneck between the user and the backbone network (as shown in Figure 7).
Ethernet switch implementations often provide one or more highspeed ports to provide connectivity between the switched media hub and the backbone or other resources. The most popular high-speed media include FDDI, Fast Ethernet, and ATM. Each media type has its own benefits.
• FDDI has been available for the longest period of time and is widely supported.
• Fast Ethernet is extremely similar in format to standard Ethernet, and requires little translation by the switch between the two topologies. This can reduce latency between the normal switched ports and the high-speed port. However, Fast Ethernet is subject to the same problems in utilization scalability as regular Ethernet.
• ATM is, by definition, a switched topology. ATM also offers the potential for reater speeds than either FDDI or Fast Ethernet.
A Typical ATM Switch
Figure 8 shows a typical ATM switch connected to a set of 10 Mbps and 100 Mbps Ethernet LANs. Data moving across an ATM link consists of a series of ATM cells. Each ATM cell is 53 bytes long — 5 bytes of header and 48 bytes of “payload” data. The header includes the Virtual Path (VP) and Virtual Circuit (VC) identifiers. These identifiers uniquely determine a connection, which is associated with a specific pair of ATM source and destination hardware addresses.
Such connections can be either Permanent Virtual Circuits (PVCs) or Switched Virtual Circuits (SVCs). A PVC is a hardwired connection that continues to exist whether or not it is being used. An SVC is a switched connection that is set up as it is needed, much like an ordinary dialed phone call.When the data transfer session has been completed the connection goes down. In one common type of ATM switch, a few PVC circuits are reserved for signaling and other switch management functions, while the majority are SVC circuits used to carry data.
ATM traffic is full duplex — outbound cells and inbound cells travel on separate conductors, and traffic can move in both directions simultaneously. The most common link speed currently used is 155 Mbps in each direction — a total bandwidth of 310 Mbps.
The traffic in Figure 8 is moving between a set of Ethernet LANs and an ATM link. In the outgoing direction, the Ethernet frames are first converted to sets of 53-byte cells. The Ethernet DLC source and destination addresses in each frame are mapped to the appropriate VP and VC identifiers for the connection involved. The resulting cells are multiplexed with other traffic and sent out over the 155 Mbps link as a serial bit stream.
In the incoming direction, the cells corresponding to a given set of VP/VC identifiers are examined. If the cells comprise LAN traffic, they are reassembled into frames and sent out toward their destination on the appropriate LAN segment. The process of converting LAN frames to cells and cells to LAN frames is performed by the ATM Adaption Layer (AAL). The software that coordinates and maps LAN frames across an ATM link is called LAN Emulation (LANE).
Virtual LANs
The increasing use of LAN switches has led to the development of a new technology — Virtual LANs (VLANs). Organizing an internetwork into VLANs offers advantages in terms of administration, security, and broadcast management.
On a conventional shared-media network, the broadcast domain is the physical network segment. In a switched LAN environment, the broadcast domain can be a virtual LAN created from any set of Layer 2 hardware (MAC) addresses. This allows workgroups to be created based on functionality rather than physical location. For example, suppose that a number of people working on various floors of a building or even in multiple buildings are all assigned to work on a common new project. Their workstations can be organized into a virtual LAN, which will function as if all those workstations were on the same cable or hub, even though they may be attached to many different switches.
Using VLANs gives the performance benefits of physical LAN segmentation, while at the same time it allows traffic patterns based on the actual working relationships among the users, rather than on their physical locations. Properly used, VLANs can decrease the number of subnets and thereby simplify address administration.Workstations can be moved among the segments of a VLAN without the necessity for any address reconfiguration.
Figure 9 shows how a simple VLAN might be constructed. VLAN 1 is defined as ports 3 and 4 on Switch A, and port 5 on Switch B. VLAN 2 is defined as port 8 on Switch A, and ports 9 and 10 on Switch B.
Just as routers on shared-media networks interconnect subnets, routers can be used on switched networks to interconnect VLANs.
VLANs can include a mixture of LAN types and devices, such as 10 Mbps and 100 Mbps Ethernet, token ring, FDDI, and CDDI, workstations, as well as FDDI, CDDI, and ATM servers and backbones.
Typically, VLANs are controlled using sophisticated software that tracks and manages the appropriate information (user, MAC, Port ID, switch, and VLAN) for parts on the network or for the entire network.
The science of defining VLANs is still in its infancy — the majority of VLANs existing at this time are based on tables of MAC addresses. In the future, it will be possible to define VLANs based on protocol, network addresses, applications, or user privileges.
The emerging science of VLAN definition will make it possible, more and more, to create networks based on workflow rather than cable layout, and will support simple and rapid setup and tear-down of functional workgroups.
Monitoring and Troubleshooting Switched Networks
Connecting a network analyzer to a switched hub requires more planning than connecting it in a standard shared media environment. LAN environments and ATM environments will require somewhat different approaches.
LAN Environments
As shown in Figure 10, if a Sniffer Network Analyzer were connected to a switched hub in the same way a user would be connected to a shared media hub, the user would not see most of the traffic. Switched hubs, by design, forward packets only to the specific port to which they are addressed. This would limit the Sniffer Network Analyzer to capturing broadcast packets, multicast packets, or packets in which the switch has not been able to resolve a hardware address.
Fortunately, however, there are several techniques for effectively connecting a Sniffer Network Analyzer to a switched hub. Some of these techniques are specific to particular hub vendors, using techniques such as port tapping, circuit tapping, or switch tapping.
For vendor-specific information consult with your switch vendor, or visit the Network General Web site at www.ngc com.
Single-MAC switches associate a single hardware address with a port on the switch.Multi-MAC switches can associate multiple hardware addresses on each port. Understanding the address limitations of the selected switch is crucial to useful implementation on the network.
Single-MAC switched hubs are primarily designed to connect directly to an end user, a shared resource (such as a file server or a group of servers), or to interconnect multiple routers that do not implement bridging. They were not designed to interconnect shared media hubs, or network segments containing multiple devices. Figure 4 illustrates the single device to single port relationship of the Single MAC switch.
Multi-MAC Ethernet switches have enough memory to associate multiple hardware addresses with a single port. Such switches can be implemented as a logical “hub of hubs” or in backbone architectures. The total number of hardware addresses that the switch can buffer differs from vendor to vendor. It is important to be aware of the limitations of the switch to ensure that the switch is not exposed to more hardware addresses than it is capable of buffering. Once the number of learned addresses exceeds the available address space, the switch may propagate packets with new addresses to all ports on the switch or even drop the frames altogether. Figure 5 demonstrates how Multi-MAC switches can associate several addresses with each port.
Spanning Tree
Just as shared media hubs operate similarly to multiport repeaters, switched hubs operate similarly to multiport transparent bridges. They are also susceptible to the same types of problems as bridged networks. This includes topology loops.
Topology loops occur when traffic is transmitted on one segment, bridged to another segment, and returned to the originating segment via a different route. The Spanning Tree algorithm and protocol eliminate this occurrence by allowing the bridged devices on a network to be aware of each other. As seen in Figure 6, the switch automatically disables one of the ports that would complete this loop until the topology loop is no longer present. Some switch manufacturers do not implement the Spanning Tree algorithm, but do implement a proprietary solution to prevent network topology loops.
Topology loops may be introduced into a network design by accident or intentionally to provide a redundant backup data path. It is often useful to take advantage of redundant links in mission-critical applications. If the switched hub does not participate in the Spanning Tree process, proper placement of the switch should be considered carefully.
Full Duplex
A switch that maintains full-duplex ports has the capability to simultaneously transmit and receive data across these ports. To take advantage of this feature, both the switch’s port and the connected device must support the full-duplex technology.
There are several benefits to full-duplex operation:
• Throughput: If the switched media hub and the connected device can send data to each other simultaneously, then potentially throughput can double.
• Collision Avoidance: In an Ethernet environment, full-duplex operation can be used to avoid collisions.
• Improved Distance Limitations: In some circumstances, distance limitations are imposed on some media types because of the potential for collisions (for example, Ethernet over fiber optic cable). If collisions cannot occur, distance is limited only by media restrictions.
Currently, the most common topologies able to support full-duplex operation are Fast Ethernet and ATM. The Fast Ethernet standard allows full-duplex operation over 100BASE-T/X cables and 100BASE-F/X cables. ATM standards support full-duplex operation over a wide variety of media.
Network General analyzers are able to monitor and troubleshoot full-duplex circuits on both Fast Ethernet and ATM links.More detailed discussions on full-duplex monitoring are presented later in this paper.
High-Speed Integration
In a small workgroup or domain, connecting all users and file servers to Ethernet switches can potentially improve performance. However, many networks cannot take advantage of this technology on their own, because of their geographic layout. If a network primarily had workstations distributed on various hubs and located all file server resources on a backbone segment, replacing the users’ normal shared media hub with a same-speed switched hub would not provide any benefit. The single connection between the switched hub and the backbone would prohibit more than one user from connecting to the backbone at one time. This eliminates any benefit that the switch might provide.
One solution to this potential problem is to provide a greater bandwidth “pipe” between the switched hub and the backbone segment. Providing a dedicated 10 Mbps connection from each user to the switched media hub, and a high-speed connection from the switched media hub to the backbone, improves or eliminates the previous bottleneck between the user and the backbone network (as shown in Figure 7).
Ethernet switch implementations often provide one or more highspeed ports to provide connectivity between the switched media hub and the backbone or other resources. The most popular high-speed media include FDDI, Fast Ethernet, and ATM. Each media type has its own benefits.
• FDDI has been available for the longest period of time and is widely supported.
• Fast Ethernet is extremely similar in format to standard Ethernet, and requires little translation by the switch between the two topologies. This can reduce latency between the normal switched ports and the high-speed port. However, Fast Ethernet is subject to the same problems in utilization scalability as regular Ethernet.
• ATM is, by definition, a switched topology. ATM also offers the potential for reater speeds than either FDDI or Fast Ethernet.
A Typical ATM Switch
Figure 8 shows a typical ATM switch connected to a set of 10 Mbps and 100 Mbps Ethernet LANs. Data moving across an ATM link consists of a series of ATM cells. Each ATM cell is 53 bytes long — 5 bytes of header and 48 bytes of “payload” data. The header includes the Virtual Path (VP) and Virtual Circuit (VC) identifiers. These identifiers uniquely determine a connection, which is associated with a specific pair of ATM source and destination hardware addresses.
Such connections can be either Permanent Virtual Circuits (PVCs) or Switched Virtual Circuits (SVCs). A PVC is a hardwired connection that continues to exist whether or not it is being used. An SVC is a switched connection that is set up as it is needed, much like an ordinary dialed phone call.When the data transfer session has been completed the connection goes down. In one common type of ATM switch, a few PVC circuits are reserved for signaling and other switch management functions, while the majority are SVC circuits used to carry data.
ATM traffic is full duplex — outbound cells and inbound cells travel on separate conductors, and traffic can move in both directions simultaneously. The most common link speed currently used is 155 Mbps in each direction — a total bandwidth of 310 Mbps.
The traffic in Figure 8 is moving between a set of Ethernet LANs and an ATM link. In the outgoing direction, the Ethernet frames are first converted to sets of 53-byte cells. The Ethernet DLC source and destination addresses in each frame are mapped to the appropriate VP and VC identifiers for the connection involved. The resulting cells are multiplexed with other traffic and sent out over the 155 Mbps link as a serial bit stream.
In the incoming direction, the cells corresponding to a given set of VP/VC identifiers are examined. If the cells comprise LAN traffic, they are reassembled into frames and sent out toward their destination on the appropriate LAN segment. The process of converting LAN frames to cells and cells to LAN frames is performed by the ATM Adaption Layer (AAL). The software that coordinates and maps LAN frames across an ATM link is called LAN Emulation (LANE).
Virtual LANs
The increasing use of LAN switches has led to the development of a new technology — Virtual LANs (VLANs). Organizing an internetwork into VLANs offers advantages in terms of administration, security, and broadcast management.
On a conventional shared-media network, the broadcast domain is the physical network segment. In a switched LAN environment, the broadcast domain can be a virtual LAN created from any set of Layer 2 hardware (MAC) addresses. This allows workgroups to be created based on functionality rather than physical location. For example, suppose that a number of people working on various floors of a building or even in multiple buildings are all assigned to work on a common new project. Their workstations can be organized into a virtual LAN, which will function as if all those workstations were on the same cable or hub, even though they may be attached to many different switches.
Using VLANs gives the performance benefits of physical LAN segmentation, while at the same time it allows traffic patterns based on the actual working relationships among the users, rather than on their physical locations. Properly used, VLANs can decrease the number of subnets and thereby simplify address administration.Workstations can be moved among the segments of a VLAN without the necessity for any address reconfiguration.
Figure 9 shows how a simple VLAN might be constructed. VLAN 1 is defined as ports 3 and 4 on Switch A, and port 5 on Switch B. VLAN 2 is defined as port 8 on Switch A, and ports 9 and 10 on Switch B.
Just as routers on shared-media networks interconnect subnets, routers can be used on switched networks to interconnect VLANs.
VLANs can include a mixture of LAN types and devices, such as 10 Mbps and 100 Mbps Ethernet, token ring, FDDI, and CDDI, workstations, as well as FDDI, CDDI, and ATM servers and backbones.
Typically, VLANs are controlled using sophisticated software that tracks and manages the appropriate information (user, MAC, Port ID, switch, and VLAN) for parts on the network or for the entire network.
The science of defining VLANs is still in its infancy — the majority of VLANs existing at this time are based on tables of MAC addresses. In the future, it will be possible to define VLANs based on protocol, network addresses, applications, or user privileges.
The emerging science of VLAN definition will make it possible, more and more, to create networks based on workflow rather than cable layout, and will support simple and rapid setup and tear-down of functional workgroups.
Monitoring and Troubleshooting Switched Networks
Connecting a network analyzer to a switched hub requires more planning than connecting it in a standard shared media environment. LAN environments and ATM environments will require somewhat different approaches.
LAN Environments
As shown in Figure 10, if a Sniffer Network Analyzer were connected to a switched hub in the same way a user would be connected to a shared media hub, the user would not see most of the traffic. Switched hubs, by design, forward packets only to the specific port to which they are addressed. This would limit the Sniffer Network Analyzer to capturing broadcast packets, multicast packets, or packets in which the switch has not been able to resolve a hardware address.
Fortunately, however, there are several techniques for effectively connecting a Sniffer Network Analyzer to a switched hub. Some of these techniques are specific to particular hub vendors, using techniques such as port tapping, circuit tapping, or switch tapping.
For vendor-specific information consult with your switch vendor, or visit the Network General Web site at www.ngc com.
Many switch vendors offer a “monitoring port” to allow a network analysis device to be connected to the switch, although implementation techniques vary from vendor to vendor. There are three common implementation techniques that ease the introduction of network analysis devices:
• Port Tap: Sending all traffic to or from a selected port on a switched hub to a designated monitoring port on the hub.
• Circuit Tap: Sending all traffic exchanged between two specific ports on the switch to a designated monitoring port on the hub.
• Switch Tap: Sending all traffic that occurs on any port on the switch to a designated monitoring port on the switch.
Each of these techniques simplifies network analysis, and allows monitoring of a hub or connected device without the necessity of additional hardware. Many switched hubs implement one or more of these techniques to assist network analysis.
The port tap and circuit tap techniques limit the amount of traffic that is delivered to the network analyzer. This feature could filter important information from the analysis device if not used correctly. For example, an administrator might use the circuit tap feature to focus on a problem connection between a user and a resource. The source of the problem might actually be another user accessing the shared resource. Focusing on the connection between the first user and the resource might not provide enough detail to identify the problem.
At the other extreme, the switch tap feature does not filter any information. This feature might work well in circumstances where overall use of the switch is low. However, if several of the switch users are demanding high amounts of bandwidth individually, their combined traffic may be greater than the switch can effectively process through a single monitoring port.
In order to be sure of monitoring all switch traffic without exceeding the capacity of the monitoring port, a dedicated analyzer or probe would have to be attached to each port on the switch. In most cases, this isn’t cost-effective. However, some switch vendors are embedding selected groups of RMON into each port on the switch.While this doesn’t provide the full troubleshooting capability of a Sniffer analyzer, it is effective for alerting the user to problems which might be occuring on the switch. For example, each port on the switch has been set up with RMON to notify the user when utilization exceeds 50%. If one of the ports exceeds the threshold, the user can then point the Distributed Sniffer System to that port in question for problem resolution through Sniffer analysis. (See Figure 13 for ways to leverage your Distributed Sniffer System across multiple ports/segments.)
There are also techniques for monitoring a switched hub even if the vendor has not implemented any monitoring technology. Analyzing a switched hub requires the use of an additional shared media hub with a crossover cable, or a hub with a crossover port. There are many small, portable hubs that are ideal for this operation, such as those made by Cabletron, 3Com, Cisco, and Bay Networks.
The first step in monitoring a switched network involves strategically locating the analysis device. In many network environments, most traffic flows either to or from a shared resource, such as a file server or a router. Placing a network analyzer strategically between the switched hub and the shared resource will allow you to trace all traffic to and from that shared resource. As illustrated in Figure 11, placing a small shared media hub between the switched hub and the shared resource provides the Sniffer Network Analyzer with an access point at which to monitor the network without impairing the performance benefits of the switched hub.
Full duplex traffic over 100BASE-T/X and 100BASE-F/X lines can be analyzed by using two Fast Ethernet Sniffer Network Analyzers connected to the lines via a Fast Ethernet Splitter, as shown in Figure 12. This figure shows the splitter connected between a Fast Ethernet switch and a critical resource such as a server.
Focusing on strategic areas aids in the network analysis procedure. For example, suppose that an administrator wants to diagnose a problem on a connection between a user workstation and a file server. Connecting the Sniffer Network Analyzer to the shared media hub between the switch and the file server would allow the administrator to determine if the user’s data was reaching its destination, and how the file server responded.
A distributed monitoring solution would work similarly. Distributed Sniffer System Servers have the ability to maintain separate monitoring and communications ports. This means that the analysis device does not need to communicate with the management console using the same connection to the network that is used for monitoring. The benefit of this architecture is that the distributed analysis tool can be attached transparently to the connection between the shared resource and the hub without creating traffic on the link, or interfering in any other way with the communications of the shared resource. This also allows Servers to be used in environments that use “single-MAC” switched hubs. Single-MAC switched hubs would not operate correctly if a monitoring device attempted to communicate on the same segment to which another device was connected.
Dedicating a Server to each shared resource might not be possible because of budgetary or other availability constraints. Maintaining the ability to capture data on all connections is still needed. As depicted in Figure 13, a single Server can be connected with as many as eight separate shared media hubs, using a matrix switch (not to be mistaken for a switched media hub or packet switch) such as one made by Datacom. Distributed Sniffer System software allows the Server to remotely control the switch, in order to connect the monitoring port of the Server to the desired shared media unit to troubleshoot the desired connection. This also allows the user to leverage the Server investment across eight separate segments.
The use of additional equipment, such as a shared media hub or matrix switch, may not be needed if the switched media hub supports some method of port monitoring (such as port tap, circuit tap, or switch tap). Port
monitoring allows the remote monitoring or analysis device to be connected directly to the switched hub. These switched media hubs can often be configured to direct traffic to the monitoring or analysis device using either their proprietary management software, an SNMP umbrella management console (such as SunNet Manager or HP OpenView), TELNET, or even an “out-ofband” serial connection.
In Figure 14, the Distributed Sniffer System Server is connected directly to the switched media hub. The switched media hub in this diagram supports port tapping. The switch has been configured to use Port 4 as the tap port. The tap port is designated to receive any traffic going to or from Port 1. The file server in this diagram is connected to Port 1. This allows the Server to receive any traffic going to or from the file server. Note that the Distributed Sniffer System Server is also connected to Port 5. This allows the Server’s transport connection to communicate to the central console without interfering with the file server’s communication. If the monitoring port (Port 4) is ever reconfigured to monitor a different port on the switch, the transport connection does not need to be changed from Port 5.
ATM Environments
For the example shown in Figure 15, congestion can occur in either direction. Traffic from the 155 Mbps ATM link can overwhelm a single Ethernet LAN. Conversely, the aggregate traffic from all the LANs may exceed the capacity of the ATM link. For complete monitoring and analysis, locate a Distributed Sniffer System Server so that it can be switched to any of the Ethernet LANs, and also attach an ATM Sniffer Network Analyzer to the ATM link. The ATM Sniffer Network Analyzer has the ability to decode LANE. Thus it can track LAN traffic moving through the ATM switch. By contrast, an Ethernet analyzer has no way of knowing that the LAN traffic came from an ATM switch.
Analyzing traffic on an ATM link requires an approach that is different from analyzing, for example, traffic on a 10 Mbps Ethernet segment. Because the transmission rate (typically 155 Mbps in each direction) is so high, it is generally not possible to capture all of the traffic into the analyzer’s capture buffer for any substantial length of time. Therefore, the analysis of ATM interswitch traffic usually occurs in these three stages:
• Attachment — gaining access to the link
• Discovery — determining what kinds of traffic are on the link
• Analysis — capturing what is relevant to your investigation
Network General provides an ATM Sniffer Network Analyzer that makes it easy to progress through these three stages.
Attachment is accomplished through an ATM Pod into which you simply plug the ATM interswitch cables. This breaks out the full-duplex link.
Discovery is a main menu selection on the ATM Sniffer Network Analyzer. In Discovery mode, the analyzer quickly lists all the ATM virtual circuits. It identifies which are PVC and which are SVC connections, and characterizes the type of traffic, data, switch setup, or management that exists on each circuit. The analyzer then lets you choose the particular connections that interest you. Cells from the virtual circuits that you select will then go into the capture buffer.
Analysis is another main menu selection on the ATM Sniffer Network Analyzer. It is applied specifically to the traffic selections made during Discovery. Analysis provides the seven-layer protocol decodes that let you do in-depth troubleshooting.
RMON Solutions in the Unison Architecture
NetScout products from NetScout Systems provide a layered RMON solution called the Unison Architecture. Key components in this architecture are:
• Mini-RMON consists of four groups from the RMON MIB — Statistics, History, Events, and Alarms. These four groups of RMON monitoring capability are embedded within some switches. This allows basic monitoring of all ports on a switch, without significantly impacting the performance of the switch.Mini RMON is a cost-effective solution that provides a good deal of visibility, without the additional cost and possible performance degradation that could result if all nine RMON groups were embedded.
• Roving RMON uses an external NetScout RMON2 probe attached to a switch. Under software control, the NetScout probe can be set to monitor any individual port on the switch. Because this full RMON2 capability
moves from port to port, it is called roving RMON. Roving RMON provides far more detailed monitoring capability than mini-RMON so it can be used to more fully investigate problems first detected by the embedded mini- RMON process.
• Dedicated high-speed probes are placed on critical high-speed inter-switch links and can perform seven-layer monitoring of all the traffic on such links. Among other things, the probes can identify virtual LANs (discussed below) and characterize VLAN traffic.
• Switch-smart network management applications can aggregate data from mini-RMON, roving RMON, and interswitch probes into a consolidated view of switch and VLAN traffic, while handling the details of the actual RMON sources transparently.
Using Risk Hierarchies to Develop a Network
Management Plan
Identifying hierarchies of risk is a basic concept in network management. Network resources are grouped (conceptually) according to how critical they are to the operation of a business enterprise or government function. Network monitoring and troubleshooting resources are then deployed in a meaningful relationship to the relative importance of each resource.
As an example, here is a three-layer risk hierarchy that a corporate network manager could use to stratify the resources on an enterprise network:
• Key resources such as server clusters, backbones, and WAN links. If a key resource becomes inoperative for even five minutes, it creates a serious problem for the company. Such resources are also called “business-critical” or “mission-critical” resources. You make sure that these key resources have plenty of reliable bandwidth capacity and that they have dedicated monitoring and troubleshooting resources attached and operating at all times.
• Important resources such as an e-mail server or an intraweb, or a workstation used to perform time-sensitive tasks. If an important resource goes down for an hour, productivity within the company will decrease, and problems will gradually worsen. You provide these important resources with continuous monitoring devices and set up alarms to notify you of current or potential problems. You deploy more powerful troubleshooting tools to those resources as necessary to solve the problems.
• Non-critical resources such as a workstation used only occasionally, or a spare workstation for guests.
An individual user or workgroup can be considered non-critical if it can go down for a day or more without causing any serious problems to the business.
You probably don’t need continuous monitoring for this type of resource. You can simply move troubleshooting resources, such as a portable Sniffer Network Analyzer, a switched Distributed Sniffer System Server, or use embedded RMON on the local network segment whenever a problem develops.
In practice, it takes time to set up a proper monitoring and troubleshooting infrastructure for a large enterprise network. The cost of the monitoring and troubleshooting hardware is just a small part of the total cost involved. The greater part is the cost of training the personnel who will use this equipment, plus the ongoing costs of employing these same people.
Based on the experience of successful corporate Information Systems (IS) departments, the average relationship is about six dollars of IS personnel cost for every one dollar of equipment cost.
A workable strategy is to build up your network monitoring and troubleshooting capability in stages. Here is an example:
• Using the definitions given above, identify which parts of your network are key resources, important resources, and non-critical resources.
• In the first stage, install the necessary hardware to assure that the key resources have adequate reliable bandwidth. Acquire the dedicated monitoring and troubleshooting tools. Install these tools and train your IS personnel to use them.
• In the second stage, set up monitoring tools and a system of alarms that will alert IS personnel as to problems or potential problems among the important resources. Train the IS people to interpret these alarms and to take the appropriate corrective actions.
• In the third stage, set up some simple monitoring means, such as mini-RMON embedded in local switches, and establish procedures describing how to interpret data from these devices, and how to move more powerful diagnostic aids as necessary to solve problems.
This guide, How to Manage Switched LANs and ATM Switches for Maximum Performance, was authored by Network General to help you increase network performance and maximize the return on your network investment.
A worldwide leader in enterprise fault and performance management solutions, Network General is committed to providing businesses with Total Network Visibility™ — the ability to view the entire information enterprise from end to end and top to bottom within all seven layers of the OSI model. This is critical to optimizing network performance and ensuring a consistent quality of service to users. This visibility is delivered through a family of Sniffer Network Analyzer tools and systems that incorporate Experience Technology, Network General’s proprietary technology based on 10 years of internal R&D, as well as long-term working relationships with leading networking vendors and network management professionals. In addition, Network General offers a complete line of NetScout RMON solutions, reporting applications, and service options. Network General products are used by all of the Fortune 50 companies and more than 80 percent of the Fortune 500. Products are used in 58 countries and are available in several languages.
No comments:
Post a Comment