Network Computingwww.networkcomputing.com

Anyone who has become comfortable with the DOS-based Sniffer protocol analyzer over the past several years will feel right at home with the ATM Sniffer. But we hope those users haven't become too dependent on the expert system, because they won't find one with the ATM version.

That shortcoming aside, the ATM Sniffer was the easiest analyzer to set up and use. The DOS-based analyzer is quick to boot and before you know it, you're capturing off the ATM network. For $20,550 you get the Dolch PC, software and ATM pod.

This Pentium-based Dolch lunch-pail-style PC requires an external pod about the size of a large paperback book, making it a bit bulkier than the other units we tested. However, the analysis software does not have to be running before you hook up the external pod to the ATM. As long as the Dolch has power, the external pod is powered via a cable connected to the ATM SAR (Segmentation and Reassembly) card installed in the Dolch. It's ready to insert into your ATM OC-3 fiber with minimal disruption. In comparison, the other ATM analyzers we tested require that you boot up fully and run the analyzer application before attempting to make your fiber connection.

In contrast to the HP, GN Nettest and Wandel & Goltermann products, ATM Sniffer automatically captures either cells or reassembled packets of cells into frames. The cells or frames are stored in the buffer of the Dolch. The unit we tested had approximately 58 MB available for capture memory. There are pros and cons with this approach. When you capture cells with the ATM Sniffer you need to decide ahead of time if you want to capture raw cells or cells that are reassembled into frames such as those found in LANE.

Our testing showed the classic mode with reassembly to be more useful by far. It allowed us to monitor connections by VPI/VCI and capture cells that were reassembled into LANE control frames and LAN data frames for Ethernet and token-ring protocol decodes. The automatic reassembly feature in ATM Sniffer also allowed us to specify frame slicing during capture, which saves buffer memory.

If you want to look at only the ATM cells, then you have to capture without reassembly selected. Unlike the other ATM analyzers, the cells can't be reassembled in the decode buffer once they are captured. We found this to be a bit of a nuisance, since after verifying that the ATM layers are working and error-free, you can then start capturing frame data to focus your analysis on the upper-layer protocols. Of course, the cells must be capable of being reassembled. If you suspect that an ATM-layer-related problem is contributing to an upper-layer problem, such as TCP timeouts, you can always go back to cell mode and examine the lower layers.

The decodes and display filtering capabilities for reassembled frames are on par with the excellent decodes found in the DOS-based LAN and WAN Sniffers. Except for the occasional LANE control frame on the summary line, you hardly notice you're using an ATM analyzer. When looking at the decode detail for each reassembled LAN frame, information about the VP and VC (from the ATM cell header) that was used to carry the frame is shown. The first two bytes of each frame in the buffer is actually the 2-byte LANE header that identifies whether the remainder of the frame is in Ethernet or token-ring format.

This analyzer was the easiest to use and its roots in the DOS-based LAN Sniffer analyzer are obvious. Too bad the expert system never made it into the product. Instead, we'll have to wait for the Windows-based SnifferPro ATM analyzer.

GN Nettest WinPharaoh

Similar in design to Wandel & Goltermann's DominoATM analyzer, WinPharaoh consists of an external pod connected to a host PC that runs the application software. Our review unit came with a pod (a GN Nettest PXU-600 chassis) and a Windows95 laptop containing the preinstalled ATM applications. The pod connects to the laptop via a cable connected to a proprietary PCMCIA card. Although you can't connect to a desktop PC that doesn't have a PCMCIA slot, data transfer from the pod to the laptop was noticeably faster than via the parallel port used by the Wandel &Goltermann unit. Rather than work with multiple pods simultaneously, the WinPharaoh software can control multiple modules that plug into the pod with a mix of LAN and WAN topologies.

The pod has six slots, with one slot occupied by the host connection module. The remaining five slots can be populated with additional interfaces. Unfortunately, the interface to OC-3 ATM chews up two slots, requiring one module for each side of the connection.

Our unit with single-mode ATM modules and software, but not including a laptop, lists for $26,885. With single-mode ATM modules, the price drops to $20,885.

Each ATM module (our test unit had two) can contain up to 64 MB of capture buffer. As with all the ATM analyzers we tested, captured cells are decoded and LANE cells are reassembled into their frames with full seven-layer decoding. The decoding software is the same as that used with the LAN/WAN WinPharaoh. The one drawback is that the WinPharaoh expert system is not available for WinPharaoh for ATM.

During our tests, we were surprised to discover that we had to view the decode of the captured cells in two separate windows--one for the transmit side and one for the receive side of the ATM connection--instead of a single merged view. We also had to tell the analyzer that we wanted it to decode the data as token-ring LANE cells. All the other ATM analyzers automatically detected this. We were also disappointed when we couldn't set a filter on an IP address of the reassembled LANE frames in the buffer. This is a rather basic filtering feature that's part of all the other ATM analyzers we tested.

We were sent a late software update after we had finished our testing. This version is intended to fix the merged buffer and LANE decode problem. The new software now merges the two half-duplex capture buffers. However, you have to recapture, as the old trace files cannot be merged. We still had a problem with the LANE decodes as the new software insisted that the token-ring LANE cells were Ethernet LANE.

The WinPharaoh ATM analyzer does boast extensive traffic-generation capability with full QoS (Quality of Service) and BERT (Bit Error Rate Test), on par with the Internet Advisor.

While this is a solid tool for ATM cell and error analysis, the WinPharaoh still has a few rough edges in usability, particularly when you get above the ATM layers into upper-layer protocol analysis.

Analyzer Analysis There's no doubt that ATM analyzers have to mature a bit before they can catch up to their LAN counterparts. Adding expert systems, larger cell buffers and capture filters that work with reassembled cells will push ATM analyzers to the next level. Until that happens, there are limits to the technology that have to be considered.

J. Scott Haugdahl is the founder of Net3 Group. Send your comments on this article to him at scott@net3group.com.