DSS 4.1 and SnifferBook

[blundergod]

I am running the Distributed Sniffer (DSS ET05) 4.1 on Windows NT with the SnifferReporter 4.0. I also have a WAN SnifferBook.

Within the DSPro Agent Configuration Utility (i.e. POD Configuration), there is an option to set the POD_TYPE for one of the four Ethernet cards on the DSS to "SnifferBook".

I have a few questions:
1). Can my DSS 4.1 work with the SnifferBook (i.e. download the applicable code to the snifferBook, launch 4.1 DSPro on the DSS and look at Wan Stats, etc.)?
2). How do I properly configure the DSS to work with the SnifferBook? I cannot locate this information within any of the documentation.
3). If yes on #1 and #2, then can I also log statistics to RMON on the DSS box with my version of SnifferReporter/RMON.

Please respond on any one of the questions above, even if you do not know the answers to all three.
Thanks in advance for your help.
Jay

 

[phaelon56]

My memory is a bit hazy on this but I am under the impression that the SnifferBook is compatible with v4.1. If I recall correctly, there was a DS Pro version that lacked proper compatibility with the ATM Book (I think it was v4.0 or v4.1) but I recall no such problem with the SnifferBook. That's the good news....

Now the bad news..... is the ET05 actually able to do WAN analysis without your paying for the WAN capabilities? I don't think so. If I understand it correctly, Distributed Sniffers, including the ET series, are sold and come preconfigured for specific topologies, e.g. an ET05 is designed to monitor and decode Ethernet only. Portable Sniffer (Sniffer Pro) is different. If you have a full blown license for Sniffer Pro that gives you WAN or LAN decode and monitoring capabilities, you could reimage the DS Pro platform, install Sniffer Pro WAN, configure it for the Sniffer book and then use RD32 or VNC as a way to remptely access the box. At that point you no longer have a true Distributed Sniffer that can be accessed from Sniffview.

There are some book products (e.g. the ATM book) that were designed for use with the Distributed platform but it still required that the appropriate Distributed analysis software be in place.

Short version is I don't think you can do what you're hoping to do. I'm relying on memory here and may well be mistaken - my actual experience with the Book products dates back well over a year or more. I suggest contacting a Sniffer SE in your area to clarify - unfrotunately the documentation for the book products is very limited.,

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[blundergod]

Thanks Owen! I do have DSPro 4.5 that can communicate with the SnifferBook and perform analysis. I have to manually move the files that are saved on the DSPro onto the DSS Reporter Agent box.

This doesn't really help though, since I really would like to log the WAN stuff via RMON and report off the RMON data with another management/reporter application.

Given your answer above, can I can re-install the reporter software 4.0 on the DSPro 4.5 box to achieve the above?

Jay

 

[AlfSutherland]

Hi,

For you reference the latest version of Sniffer Distributed is v4.3, and for Sniffer Portables v4.7.5. The reason I mention this is, that it may be required to upgrade the firmware of the Sniffer Book, for compatablity and eliability issues. Information on this is found in the Install guides.

I agree with Owen's comments on using the Sniffer Books with Sniffer Distributed unit (NAI licensing).

If you own a copy of Sniffer Reporter (latest version v4.2), you may install it on the Sniffer Pro unit, and produce WAN related reports.

Be aware of the following;
The max database size for Sniffer reporter is 1GB
Sniffer Repoter starts as an application and not a service ie you have to start the Sniffer reporter agent manually.

Alf

 

[phaelon56]

Alf makes excellent points (as usual!). If you have paid for a perpetual license for Sniffer Pro or Sniffer Distributed or have a subscription license that is still in effect, you are entitled to move those pieces of software onto different machines, e.g. you can put DS pro on a notebook PC or put Sniffer Pro onto the rack mounted PC appliance that the DS Pro was originally being used on. I see no reason why you can't leave Reporter Agent in place on the DS Pro server, remove the DS pro software and put Sniffer Pro on in its place so the SnifferBook may be uses. What you can NOT do is install the one copy of either software on multiple machines and use them both at the same time - the license is intended for single install use. Needless to say, NAI does not provide support for DS Pro unless it's installed on the turn-key appliance platform. I've known of people who purchased DS Pro simply because it was cheaper than Sniffer pro and included the Reporter software.

Alf's comments on the database size restriction for Reporter are also important to note. keep in mind that you can opt to have the Reporter stats compressed and "rolled up" at periodic intervals - using this option should get you some extra mileage.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[phaelon56]

I just reread the replies and see mention of DS Pro 4.5 - I answered assuming that you meant Sniffer Pro v4.5 as DS pro is just now up to v4.3 and Sniffer pro is at v4.7

As I mentioned, should be no issues on leaving Reporter on the box and installing Sniffer Pro. One more important note - DS Pro v4.3 has a new scheme for installation and license unlock. It's no longer a cinch to just uninstall and then reinstall it on another machine by entering the key number. Keep this in mind if you plan to play around with v4.3 once you upgrade to that point. It's understandeable that NAI has done this to address their concerns about license abuse but it creates extra work for everyone when DS Pro has to be uninstalled or reinstalled. I strongly advise making a Ghost image of the fully installed and configured DS Pro box after initial setup, just in case there are problems that require a reinstall (have seen this happen a number of times w/v4.3). Reimaging is way easier than going through the whole reinstall scheme now that the key has to be reissued every time.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[blundergod]

Great Owen, thanks for the info. I did mean to say Sniffer Pro v4.5 and NOT DSPro 4.5.

Much thanks to both yourself and Alf. I'll report back what I have been able to accomplish when I get to it so that others can learn.

Appreciate all your time guys.

Jay

 

[jas1967]

Dss sniffer does not want to work on Xp. Any ideas

 

[phaelon56]

If by "Dss sniffer" you are referring to DS Pro Agent(Distributed Sniffer Pro).... the answer is that it's not designed to run on anything but Windows NT 4.0 service pack 6 or 6a and is not supported for any other OS at this time.. I have heard that a few of the newest DS Pro appliances (running DS Pro v 4.3) may be shipping with XP as the operating system but it's hearsay and I have yet to see one in the flesh. I do know for certain that a DS Pro Agent version running on XP has been in beta test for quite some time - possibly close to a year and is said to be perfomring well at this point.

If it's the DS Pro Console software that you want to run on XP..... look through past posts in this forum - there is a relatively simple way to make it work successfully.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[blundergod]

How about the DS Pro Agent running on Windows 2K? Anyone ever get that to work?

Jay

 

[netwho]

No way - up to v 4.3 only nt4 works because of the sniffer.sys architecture, but it's a matter of time....
cheers, walter

__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****

 

[portable]

I haven't heard about any plans to get the Sniffer Distributed Agent on 2k.
However, as mentioned by Owen, it seems that there's some kind of Beta version of the XP agent floating around at some customer sites.

 

[netwho]

Yes this is correct! W2k will be skipped, next supported platform will be xp...
I believe there's a fair chance that w2k will work, but not being supported by nai.
cheers, Walter

__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****