Our company just purchased a Sniffer Distributed and a 6040 unit. I am not at all impressed with the 6040. It is slow and you cannot use sniffview with it. Is there any real benefit of having this device instead of the other SNiffer distributed models? I was just curious if any else feels the same way.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
6040 vs. Sniffer distributed
- Thread starter ttnnee
- Start date
Do you have SP-1 for S6040 ? if not then get it by using you
Grant number
S6040 Works on Webconsole base... SP-1 will enhance the Performance but nothing compared to snifferview
S6040 is technically far better than s4000 Gbe Architechture when it comes for RMON,Capture and Analysis
also S6040 does GEC/MLT (gbe link aggregation)
Grant number
S6040 Works on Webconsole base... SP-1 will enhance the Performance but nothing compared to snifferview
S6040 is technically far better than s4000 Gbe Architechture when it comes for RMON,Capture and Analysis
also S6040 does GEC/MLT (gbe link aggregation)
Just curious.... how does the S6040 handle access to the channelled links? Does NAI suggest using it in-line (seems like a bad idea as it would represent a significant potential point of failure) or do they recommend using it with passive in-line fiber taps?
Also curious about using it with SPAN ports. I have the impression that it can connect to multiple SPAN ports (4 or 8?) but am curious as to how many can actually monitored simultaneously and also if concurrent captures can be performed on multiple interfaces when connected to SPAN ports.
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
Also curious about using it with SPAN ports. I have the impression that it can connect to multiple SPAN ports (4 or 8?) but am curious as to how many can actually monitored simultaneously and also if concurrent captures can be performed on multiple interfaces when connected to SPAN ports.
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
I do not agree tmbenne...
I had the chance to get my hands twice on a 6040 box and I was impressed. I'm not aware of any other product being able to keep up at that traffic level. The troublshooting aprroach however is much different and I don't like the current web gui either. For "normal" client server problem determination, I just use my mini-hub/span-port on a standalone fast ethernet sniffer/DSRmon agent. You might consider using the 6040 as a collector mainly and transfer the trace files to your Sniffview console for further analysis.
__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****
I had the chance to get my hands twice on a 6040 box and I was impressed. I'm not aware of any other product being able to keep up at that traffic level. The troublshooting aprroach however is much different and I don't like the current web gui either. For "normal" client server problem determination, I just use my mini-hub/span-port on a standalone fast ethernet sniffer/DSRmon agent. You might consider using the 6040 as a collector mainly and transfer the trace files to your Sniffview console for further analysis.
__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****
CoolGuy077
Programmer
Does NAI plan to provide win32 interface for 6040.
~CG
~CG
- Thread starter
- #6
mahaprabhu
Vendor
Guys,
I disagree with some of the comments posted here.
The S6040 and S4000 are 2 entirely different product lines for 2 entirely different segments. S4000 is an excellent low cost solution for Ethernet, WAN, ATM, Gig etc. networks, whereas S6040 is a higher cost solution with much better performance, on Gig Networks.
As tmbenne said, S4000 will do just fine on Gig, provided you do not need capture at line rates for high utilization rates. This is where S6040 comes in.
Typically, one would put S6040 boxes at the core of one's Network. It has excellent performance and advanced filtering capabilities. Based on my information, there it even has some kind of aggregation feature that allows you to consolidate data from up to 4 links.
This 6040 solution would get even more attractive once NAI comes out with the Windows console or the SniffView console, as we know it - I heard that this might happen sometime in 1H 2004.
Until then, customers may face some issues at the console, but they should be more than offset by the impressive feature set of the Agent.
TmBenne - maybe you can ask your NAI SE / support contact to help you out with some of the issues you are facing and help you get the maximum bang for your buck.
My 2 cents,
MP.
I disagree with some of the comments posted here.
The S6040 and S4000 are 2 entirely different product lines for 2 entirely different segments. S4000 is an excellent low cost solution for Ethernet, WAN, ATM, Gig etc. networks, whereas S6040 is a higher cost solution with much better performance, on Gig Networks.
As tmbenne said, S4000 will do just fine on Gig, provided you do not need capture at line rates for high utilization rates. This is where S6040 comes in.
Typically, one would put S6040 boxes at the core of one's Network. It has excellent performance and advanced filtering capabilities. Based on my information, there it even has some kind of aggregation feature that allows you to consolidate data from up to 4 links.
This 6040 solution would get even more attractive once NAI comes out with the Windows console or the SniffView console, as we know it - I heard that this might happen sometime in 1H 2004.
Until then, customers may face some issues at the console, but they should be more than offset by the impressive feature set of the Agent.
TmBenne - maybe you can ask your NAI SE / support contact to help you out with some of the issues you are facing and help you get the maximum bang for your buck.
My 2 cents,
MP.
- Thread starter
- #8
Yes, we have been in touch with NAI about the issues. They are more than willing to help us out until all the bugs are resolved. I intended to use the 4000 to view the s6040 captures but there are some bugs with the timestamps that prevent this. NAI is currently working on resolving this. Once they resolve this issue you will be able to open captures files from the s6040 on the 4000 client. Then it wont be too bad viewing capture files. I think the s6040 will be a awesome product Q1 of next year when they come out with Sniffview for it though.
Try looking at Niksun NetVCR as an alternative to DSS. Higher throughput, simultaneous processing, greater flexibility.
mahaprabhu
Vendor
You said Niksun NetVcr has 'Higher throughput'. Can you quantify this performance? How much traffic can it handle in terms of 'x' packets per second @ 'y' packet sizes, utilization, etc.
I've heard that Niksun drops packets, but doesn't show it on the screens, giving the illusion of better performance....
I've heard that Niksun drops packets, but doesn't show it on the screens, giving the illusion of better performance....
thepacketman
Vendor
I think it's only fair we keep away from the Niksun vs Sniffer debate, as this isn't going to do Sniffer Technologies (McAfee Network Protection(!?)) any favours. In REAL environments (inc Ethernet, Gigabit, WANs and ATMs as opposed to just Gig) Niksun does capture all packets (if configured too), and not only that, does have a far broader and useful tool set too. The "proof of the pudding" is the fact that most "enterprise" customers are buying Niksun units as opposed to Sniffer now!
I will respectfully suggest that since this is a "Sniffer" forum, we focus the conversation on issues relating directly to that product. I'm not a vendor of either product and am aware that there are distinct differences/advtantages/disadvantages to both but would like to see the discussion stay on topic. Perhaps it would be helpful to suggest that Tek-Tips start a separate discussion forum for Niksun users? There seems to be enough user interest to justify that.
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
Owen O'Neill
Datacom Systems Inc.
Northeastern SE
- Status
Similar threads
- Locked
- Question