Diagnosing Ethernet errors 1

[karkclent]

Hi all,

Can Sniffer diagnose layer 1 & 2 problems like errors due to CRC, alignment, fragments (runts), etc.? I have an Extreme Networks switch that gives me statistics on these errors and I'd like to validate these errors via Sniffer or some other tool. End result is I'd like to know if the problem is hardware-related or cable-related. Also, does anyone here use any handheld analyzers for on-the-spot work like in the data closet/center?

TIA,
kc

 

[mpennac]

Sniffer will diagnosis layer 1 and 2 problems, if you are using the proper Network Interface Card. Most NDIS drivers for NIC cards will discard bad packets, CRC and Fragments to name a couple. NAI has developed drivers specifically for the Xircom CBE2-10/100TX card so that it will pass the errors up to the analyzer.

The difficult part is getting the analyzer in-line to observe the problem. One method is to place a hub in-line to capture all of the packets between the Extreme switch and the device connected to the switch. If the CRC errors are being caused by a duplex mismatch, the hub may mask the problem and the errors might go away. Another method that is less likely to change the environment is an in-line tap. This usually requires additional hardware to capture the traffic in both directions at the same time.

As far as handheld analyzers, Fluke Networks has a great line of products. For example, the NetTool is a great solution for diagnosing problems such as the CRC problem. It can be placed in-line between the switch and the device and show you which side of the connection is sending the CRC errors. This device will not do packet capture, so I would not be a replacement for the Sniffer.

One the high end of handheld tools is the Fluke Networks OptiView Integrated Network Analyzer. This is a touchscreen PC that is connected to a data aquisition board. This device is battery powered and supports 10/100/1000 connections. It does network discovery and reporting as well as packet capture and decode. You can also purchase a wireless option that will allow you to analyze wireless networks. The trace files captured an be converted to the Sniffer format, so you can continue to use the packet decode capabilities of the Sniffer you have already invested in.

Hope this helps,

mpennac

http://www.netprospecialists.com

 

[karkclent]

THANKS. I haven't looked at Fluke's offering in awhile, so this info is helpful. Is the Optiview fully portable or is it something you deploy, like Distributed Sniffer? Also, does it incorporate Ethernet diagnosis?

Thanks

 

[mpennac]

There are two versions of the OptiView. The first is the Integrated Network Analyzer. It is a fully portable touch screen analyzer that supports 10/100/1000. Since the capture card is built by Fluke, it supports diagnosis of all of the type of Ethernet errors you might see. A very nice feature of this tool is that it supports 7 concurrent remote user sessions. This means that while you are using the touchscreen PC, 7 other people can be accessing the capture card and do other tests all at the same time.

The other version of the product is known as the Workgroup Analyzer and is the INA, without the touchscreen PC. This unit supports 8 remote sessions. It is designed to be put in a wiring closet and accessed remotely. One neat feature of both products is that they can be configured to phone home to a console PC. You can send them out to anywhere in your network and they will notify you of the address they were assigned so you can remotely control them. This works great in DHCP environments. Check them out at

http://www.flukenetworks.com.

mpennac

 

[phaelon56]

I've played with the Fluke Optiview 9the portable version with touchscreen) and agree that it's a great tool. Very intuitive interface and seems very robust and stable. I have not yet had any experience with the distributed server version but expect to be getting some exposure to it later this year.

"mpennac" speaks correctly about the need for a tap prather than just a hub (assuming the connection in question is full duplex). It should be self-evident from his post but I'll clarify and reemphasize that a tap is needed because SPAN and mirror ports do not propogate layer 1 and Layer 2 errors. There are several choices available on the market for 10/100 FD taps - I'll encourage you to test them carefully before making a purchase decision - make sure the tap itself runs clean and does not introduce any CRC's of its own (disclaimer - I work for a company that manufactures taps but am not trying to promote our product in specific - just want people to make informed decisions).

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com