1. Chapter 12 NM Tools and Systems 12-1 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

2. Notes Tools Catalog Developed by IETF Working Group on NOCTools Update available via news:comp.networks.noctools ftp://wuarchive.wustl.edu/doc/noctools Network Management: Principles and Practice © Mani Subramanian 2000 Chapter 12 12-2

3. Notes 12-3 BERT Physical layer monitoring tool Generates and detects bits Bit error rate (BER) is calculated by comparing the transmitted pattern with received pattern Loop back is a feature of the modem BER can be measured for a modem or two modems and the link in between Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

4. Notes 12-4 BERT in HFC / LAN Environment SmartBits  used in LAN environment Used for error measurement at physical and data layers Source and destination addresses - MAC / IP- in software Enables measurement of modems in a shared medium environment Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

5. Notes 12-5 Cable Modem Error Rate Noise can be injected at various points in the transmission and error rates can be measured Noise in upstream is very sensitive to noise because of low frequency band Notice the sharp curve before loss of sync at high error rate Modem goes out of sync within a db range. Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

6. Notes 12-6 Network Software Tools Status monitoring tools Traffic monitoring tools Route monitoring tools Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

7. Notes 12-7 Status Monitoring Tools Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

8. Notes 12-8 ifConfig Used to assign/read an address to/of an interface Option -a is to display all interfaces Notice two interface loop-back (lo0) and Ethernet (hme0) Example: Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

9. 12-9 Ping Most basic tool for internet management Based on ICMP ECHO_REQUEST message Available on all TCP/IP stacks Useful for measuring connectivity Useful for measuring packet loss Can do auto-discovery of TCP/IP equipped stations on single segment % ping 205.152.8.138 PING 205.152.8.138 (205.152.8.138): 56 data bytes 64 bytes from 205.152.8.138: icmp_seq=0 ttl=17 time=14.8 ms 64 bytes from 205.152.8.138: icmp_seq=1 ttl=17 time=20.2 ms 64 bytes from 205.152.8.138: icmp_seq=2 ttl=17 time=15.7 ms 64 bytes from 205.152.8.138: icmp_seq=3 ttl=17 time=21.6 ms 64 bytes from 205.152.8.138: icmp_seq=4 ttl=17 time=20.0 ms --- 205.152.8.138 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 14.8/18.4/21.6 ms Chapter 12 Notes Example: Network Management: Principles and Practice © Mani Subramanian 2000

10. 12-10 nslookup An interactive program for querying Internet Domain Name System servers Converts a hostname into an IP address and vice versa querying DNS Useful to identify the subnet a host or node belongs to Lists contents of a domain, displaying DNS record Available with BSD UNIX; FTP from uunet.uu.net Available in Windows NT Chapter 12 Notes Example: Network Management: Principles and Practice © Mani Subramanian 2000

11. 12-11 Domain Name Groper: dig Used to gather lots of information on hosts from DNS noc2% dig noc2 ; > DiG 2.2 > noc2 ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6 ;; flags: qr aa rd ra; Ques: 1, Ans: 0, Auth: 1, Addit: 0 ;; QUESTIONS: ;; noc2, type = A, class = IN ;; AUTHORITY RECORDS:. 86400 SOA A.ROOT-SERVERS.NET. hostmaster.INTERNIC.NET. ( 1998091500 ; serial 1800 ; refresh (30 mins) 900 ; retry (15 mins) 604800 ; expire (7 days) 86400 ) ; minimum (1 day) ;; Total query time: 141 msec ;; FROM: noc2.btc.gatech.edu to SERVER: default -- 199.77.147.28 ;; WHEN: Wed Sep 16 21:42:11 1998 ;; MSG SIZE sent: 22 rcvd: 95 Chapter 12 Notes Example: Network Management: Principles and Practice © Mani Subramanian 2000

12. 12-12 Host Command: host Displays host names using DNS Available from ftp.nikhef.nl:/pub/network/host.tar.Z % host -a sun4-gw.cc.gatech.edu Trying null domain rcode = 0 (Success), ancount=1 The following answer is not authoritative: sun4-gw.cc.gatech.edu 85851 IN A 130.207.111.100 Chapter 12 Notes Example: Network Management: Principles and Practice © Mani Subramanian 2000

13. Notes 12-13 Traffic Monitoring Tools ping and bing used to measure the propagation characteristics of the transmission path etherfind, snoop, and tcpdump puts the network interface in promiscuous mode and logs the data Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

14. 12-14 Packet Loss Measurement Command: ping Many options available Implementation varies from system to system Chapter 12 Notes Example: Network Management: Principles and Practice © Mani Subramanian 2000

15. Notes bing Used to determine throughput of a link Uses icmp_echo utility Knowing packet size and delay, calculates bandwidth bing L1 and L2 and the difference yields the bandwidth of link L1-L2 Bandwidth of link L1-L2 could be higher than the intermediate links. 12-15 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

16. Notes snoop Puts a network interface in promiscuous mode Logs data on Protocol type Length Source address Destination address Reading of user data limited to superuser Example: Options: -d for device interface and -c for counts 12-16 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

17. Notes tcpdump Command: tcpdump Interprets and prints headers for: EthernetIPICMP TCPUDPNFS NDARPAppletalk Useful for examining and evaluating the TCP based traffic Available in UNIX system; FTP from ftp.ee.lbl.gov Example: SNMP message 12-17 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

18. Notes Network Routing Tools 12-18 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

19. Notes Network Status netstat -a UDP Local Address State -------------------- ------- *.route Idle *.* Unbound *.sunrpc Idle *.* Unbound *.32771 Idle *.32773 Idle TCP TCP Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ------- *.* *.* 0 0 0 0 IDLE *.sunrpc *.* 0 0 0 0 LISTEN *.39136 *.* 0 0 0 0 IDLE *.32771 *.* 0 0 0 0 LISTEN *.32772 *.* 0 0 0 0 LISTEN *.ftp *.* 0 0 0 0 LISTEN *.telnet *.* 0 0 0 0 LISTEN 12-19 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

20. Notes Route Tracing Command: traceroute (UNIX) / tracert (MS TIME-EXCEED error report Available in most UNIX OS Windows) ICMP Also available from uc.msc.unm.edu Discovers route taken by packets from source to destination Useful for diagnosing route failures Useful for detecting bottleneck nodes 12-20 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

21. Notes Trace Route Sample 1 12-21 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

22. Notes Trace Route Sample 2 12-22 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

23. Notes Network Management Tools SNMP command tools MIB Walk snmpsniff Many tools available on public domain. See http://www.btc.gatech.edu/net/management 12-23 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

24. Notes SNMP Command Tools snmptest snmpget snmpgetnext snmpset snmptrap snmpwalk snmpnetstat Test tool is an interactive tool to get values of several managed objects, one at a time. Get, Get-next and Set are the SNMP commands that we learned under SNMP architecture / messages. Execution of these will return an SNMP Response message. SNMPWalk uses snmpgetnext to trace the entire MIB. Network status command is used to test the status of network connections of a host. 12-24 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

25. Notes SNMP Get Command % snmpget noc5.btc.gatech.edu public system.sysDescr.0 system.sysDescr.0 = OCTET STRING: "SunOS noc5 5.6 Generic_105181-03 sun4u" Note that the value 0 at the end of the object id indicates that it is a single valued scalar. 12-25 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

26. Notes SNMP Get Next Command % snmpgetnext noc5.btc.gatech.edu public interfaces.ifTable.ifEntry.ifIndex.1 interfaces.ifTable.ifEntry.ifIndex. 2 = INTEGER: 2 12-26 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

27. Notes SNMP Set Command Command: snmpset host community 12-27 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

28. Notes Network Status Command: snmpnetstat host community Useful for finding status of network connections % snmpnetstat noc5 public Active Internet Connections Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp 0 0 *.* *.* CLOSED tcp 0 0 localhost.46626 localhost.3456 ESTABLISHED tcp 0 0 localhost.46626 localhost.3712 ESTABLISHED tcp 0 0 localhost.46626 localhost.3968 ESTABLISHED tcp 0 0 localhost.46626 localhost.4224 ESTABLISHED tcp 0 0 localhost.3456 localhost.46626 ESTABLISHED tcp 0 0 localhost.3712 localhost.46626 ESTABLISHED tcp 0 0 localhost.3968 localhost.46626 ESTABLISHED tcp 0 0 localhost.4224 localhost.46626 ESTABLISHED tcp 0 0 noc5.41472 noc5.4480 ESTABLISHED tcp 0 0 noc5.41472 noc5.4736 ESTABLISHED tcp 0 0 noc5.4480 noc5.41472 ESTABLISHED tcp 0 0 noc5.4736 noc5.41472 ESTABLISHED 12-28 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

29. Notes SNMP Browser Command: snmpwalk host community [variable name] Uses Get Next Command Presents MIB Tree 12-29 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

30. Notes SNMP Sniff snmpsniff -I interface A tool in Linux / FreeBSD environment Puts the interface in promiscuous mode and captures snmp PDUs. Similar to tcpdump 12-30 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

31. Notes Protocol Analyzer Analyzes data packets on any transmission line including LAN Measurements made locally or remotely Probe (data capture device) captures data and transfers to the protocol analyzer (no storage) Data link between probe and protocol analyzer either dial-up or dedicated link or LAN Protocol analyzer analyzes data at all protocol levels 12-31 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

32. Notes RMON Probe Network Associates Sniffer Stand-alone and Networked HP NetMetrix / HP OpenView Communication between probe and analyzer is using SNMP Data gathered and stored for an extended period of time and analyzed later Used for gathering traffic statistics and used for configuration management for performance tuning 12-32 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

33. Network Monitoring with RMON Probe 12-33 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

34. Notes Network Statistics Protocol Analyzers RMON Probe / Protocol analyzer MRTG (Multi router traffic grouper) Home-grown program using tcpdump 12-34 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

35. Traffic Load: Source 12-35 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

36. Traffic Load: Destination 12-36 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

37. Traffic Load: Conversation 12-37 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

38. Protocol Distribution 12-38 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

39. Notes MRTG Multi Router Traffic Grouper (Oeticker and Rand) www.ee.ethz.ch/stats/mrtg/ Generates graphic presentation of traffic on Web Daily view Weekly view Monthly view Yearly view 12-39 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

40. Notes Enterprise Management Management of data transport IBM Netview, Sun Solstice, HP OpenView, Cabletron Spectrum Systems management CA Unicenter and Tivoli TME Network and systems management Partnerships Telecommunications management TMN, Operations systems Service management and policy management 12-40 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

41. Notes NMS Components 12-41 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

42. Notes NMS Components 12-42 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

43. Notes Multi-NMS Configuration 12-43 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

44. Notes Network Configuration Configure agents Configure management systems Community administration parameters Community name MIB view Trap targets Auto-discovery : Scope 12-44 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

45. Notes Network Monitoring By polling By traps Failure indicated by pinging or traps Ping frequency optimized for network load vs. quickness of detection trap messages: linkdown, linkUp, coldStart, warmStart, etc. Network topology discovered by auto-discovery Monitoring done at multiple levels - “drilling” 12-45 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

46. Global View 12-46 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

47. Domain View 12-47 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

48. Interfaces View 12-48 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

49. Segment View 12-49 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

50. Commercial NMS & System Solutions Enterprise NMS Hewlett-Packard OpenView Sun SunNet Manager IBM Netview Cabletron Spectrum Enterprise Manager Low End NMS SNMPc System & Network Management Computer Associates Unicenter TNG Tivoli TME / Netview Big Brother Spong Low End NMS Enterprise NMS Centralized Distributed System and Network Management Notes 12-50 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

51. Notes Auto-discovery and mapping Drill-down views Fault monitoring Event monitoring MIB Browser SNMP tools Traffic monitoring 3rd party integration OpenView is Hewlett-Packard’s platform for Network Management Many NMSs use OpenView Platform: CiscoWorks, CA TNG, Transcend NNM is HP NMS on OpenView Drill-down Map Hierarchy HP OpenView Network Node Manager 12-51 Chapter 12 Network Management: Principles and Practice © Mani Subramanian 2000

52. Notes HP OpenView Platform 12-52 Chapter 12 Open, modular, and distributed architecture Object oriented design; TNM can be implemented Open API-based architecture Easy vendor-specific NMS integration by 3rd party Network Management: Principles and Practice © Mani Subramanian 2000

53. Notes OpenView Distributed Platform 12-53 Chapter 12 Postmaster integrates all management services - multiple protocol stacks: SNMP, CMIP, TCP/IP Routing enables distributed message routing Event services control event and alarm messages Management services interface with management applications via APIs Network Management: Principles and Practice © Mani Subramanian 2000

54. Notes Distributed OpenView NNMs 12-54 Chapter 12 An enterprise network managed by multiple NMSs Collection stations could be regular NNMs or entry-NNMs (100 nodes) Filtered information sent to MoM (top level NNM) reduces traffic MoM integrates and presents enterprise data Network Management: Principles and Practice © Mani Subramanian 2000

55. Notes Cabletron Spectrum 12-55 Chapter 12 Distributed architecture Presentation only on SpectroGRAPH SpectroSERVER and SpectroGRAPH can reside in a single processor SpectroGRAPH could be switched between SpectroSERVERs Network Management: Principles and Practice © Mani Subramanian 2000