Upcoming Events

Cloud Connect
Santa Clara
Feb 13-16, 2012

Cloud Connect brings together the entire cloud eco-system to better understand the transformation we're experiencing and promises to be the defining event of the cloud computing industry. Learn about the latest cloud technologies and platforms from thought leaders in Cloud Connect’s comprehensive conference.

Register Now!

Making The Diagnosis With Windows Protocol Analyzers

Analyzing The Network Analyzer
We tested network monitoring accuracy and capture performance (with and without capture filters) with varying levels of network traffic. All traffic used contained a good mix of IP, IPX and AppleTalk data captured from a busy subnet in Network Computing's lab at Syracuse University. We replayed each sample on a dedicated network segment using Network General Corp.'s Sniffer Network Analyzer and Traffic Generator. All testing was validated using Wandel & Golte rmann's FastEthernet Domino.

Each software analyzer's monitoring tools were tested for accuracy in both percent of bandwidth utilization and packets per second. Capture performance was gathered in four tests: standard traffic rates (between 10 percent and 20 percent of 10-Mbps utilization were replayed and captured); accelerated traffic (traffic was replayed using minimal interframe gaps); and two capture filter tests. In the filter tests, standard traffic was captured with high and low levels of background traffic (generated by a second Sniffer Traffic Generator) and filtered using a MAC (Media Access Control)-level exclusion filter.

Performance varied dramatically across the different cards. 3Com Corp.'s 3C905 PCI adapter yielded the most consistent performance, though it regularly refused to pick up certain packets. This indicates that some packets are not passed through the NDIS (Network Driver Interface Specification) driver by design.

Network General's NetXRay offered perfect capture performance using CNet Technologies' NE2000-compatible ISA card (and Network General's proprietary replacement for the standard NDIS driver). However, it suffered from degraded capture performance in the filter tests at high network utilization.

Triticom's LANdecoder32 offered vertical drivers for the DEC21140 PCI card, which yielded perfect captures, though it required disabling the card under Microsoft Windows95.

The only software analyzer that was seriously affected by low performance across all Ethernet cards tested was AG Group's EtherPeek 2.0 (beta version), which was unable to perform a complete capture of a full 19,006 frames, replayed in real time, on any card.