Is my network healthy? Network assessment basics

How can you know if your network is doing fine? Should you worry about upgrading your backbone next year? Do you get slow responses because your network is not up to what you do with it? Those questions are a common concern for many of the customers I got to know along the way. So how do you know if your network is doing fine? What are the vital signals of a functioning data infrastructure? Two approaches can be taken in tackling this challenge: Inspecting the network devices or using independent network inspection devices. The first approach requires managed network devices, which supports standard snmp information (aka mib-II, not the movie …), you will also need to know the read only community and preferably have web/command line access to the network switches. Then you will need software that can query those devices, which can be a commercial package like solar winds, or some open source snmp query application. In the second approach you will use a monitoring device to sense the network and identify its characteristics; it can be a commercial network probe that has a management interface or a sniffer application running from your laptop, the main thing is that it will be independent of the network infrastructure. In a switched environment this approach is pretty limited, but if you have limited access to the network equipment, it’s better then nothing. A decent assessment will use both approaches, gaining overall status from the network devices and drill downs from a probes/sniffer. So what should you be looking for, my first preference always goes to broadcasts per second then multicasts per second and then utilization. Why? Because broadcasts are something that every workstation has to listen to and therefore it has direct relation to CPU utilization (servers and workstation), also too many broadcasts is indication of network issues. Multicasts are not always listened to, unless they go to the all multicast hosts address (, still they require a lot of switching resources and should not exceed a certain level. As for utilization, over utilized links are not good things, inevitable at times, but still undesired. So what is the normal threshold, that is a subjective issue, every engineer will probably have an opinion here (experts, feel free to comment), as for me, I’d say that a constant level of 40 or more broadcasts per second is an indication of something (loop, virus, bad application). Please be advised that I’m talking about a constant level and not a peak, every network has broadcast peaks, but one should be worried when the peek becomes the average. As for multicasts, the same number is probably right. Again it’s the average that worries us more then the peaks. Utilization should no be above 80% on average, actually a lot less in normal situations. Switch to switch or server links will probably be utilized more then workstations, but even them should not have more then 80% utilization on avarage. Next time I’ll look at tools that can help to verify those thresholds, and some other parameters of interest. Later, Avner.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2008 IDG Communications, Inc.