Network Computingwww.networkcomputing.com

In general, the protocol analyzer vendors that embraced WAN technology early on are the ones providing the best solutions for analyzing high-speed traffic.

And that's not surprising when you consider that routers that connect to dedicated point-to-point links as well as frame relay typically operate over synchronous T1 connections. A WAN protocol analyzer that connects to a router's V.35 interface or directly to the T1, needs to capture both the send and receive side (DCE and DTE) simultaneously, and provide a merged picture of the packets from both connections.

The methodology for capturing from two interfaces and merging two buffers together into a single view provides a foundation for capturing from full-duplex LAN and ATM connections as well. WAN vendors have experience building specialized NICs or pods to capture full-duplex WAN data that can be scaled to higher transmission rates, given specialized hardware and adequate on-board capture buffers.

Contrast this to the typical LAN protocol analyzer that captures packets only from traditional shared half-duplex Ethernet or token-ring segments. Under this scenario, the analyzer operates with an adapter in promiscuous mode in a PC. The adapter connects to a shared hub port and captures packets into a single buffer, usually the RAM inside the PC. Obviously there are limitations to how fast the capture performance can scale under this scenario.

Operating with pods or specialized NICs, all of the analyzers we reviewed here with the exception of Network Associates' ATM Sniffer had their own on-board memory for high-speed data capture. ATM Sniffer relies on transfer of data over a PCI interface to memory inside a PC and can drop cells under heavy traffic when operating in "reassembly" mode. All of the ATM analyzers were tested at 155 Mbps and we didn't detect any dropped cells during our normal capturing of bursty traffic between two ATM switches. The ATM switches service a community of user token rings and routers.