Is my network healthy? The Macro level using SNMP

In my previous post I explained how to use Wireshark (or any other sniffer) to get a basic understanding of how your network performs. This does not require any knowledge of the current addresses or network devices, which makes it a good starting point. With that being said, it’s a very limited starting point since in a switched environment; you will only be exposed to the traffic which is in the vlan that you are connected to. In that vlan you will only see broadcasts and multicasts. If you turn on port spanning/mirroring, you will see more info, but then you might need professional network probe to handle the amount of traffic. The answer to those limits is based on the fact that most of today’s network devices are intelligent enough to track and report their information on the network. This means that one can look at his network from where his backbone switch sees it, including all vlans, all ports etc. If you are running an unmanaged switch, this is not the technique for you; unfortunately those devices can not report anything. On the managed devices you can monitor parameters using their management interface (cli, web or device manager) or you can use SNMP, why should we prefer the later, because it gives a standard interface to different vendors and switches. With SNMP it doesn’t matter if this is a CatOS or IOS, or if it is Cisco or not, they all should report using the same tools and no switch specific knowledge is required. Many tools are available to allow SNMP monitoring, most are commercial, but some are open source. From the open source most are Linux based. For the purpose of this blog post, I used an open source command line tool, called snmptable which is a part of the net-snmp project that can be found at: http://www.net-snmp.org . Since this tool is command line based, it’s not very friendly to observe and analyze, especially when you run it against a multi interface backbone switch. The way around it is to redirect the output to a text file, which can then be opened in excel and further analyzed. The tool has many command line options, and you can explore them by executing it without any parameter. It supports SNMP version 1, 2c and 3. It provides access to a table structure. There are multiple tables that can be requested using this application, and it can also be used to report what tables are supported by the device you are running it against. This is done by running it with the following command line parameters: C:usrsnmptable -v 2c -c my-snmp-comm -Os 192.168.254.1 sysORTable > tables.txt Once it returns, you can view the tables.txt file and select which table you want to get info about. In my case, I wanted to monitor the network and therefore used the ifTable. The command line looked like that: C:usrsnmptable -v 2c -c my-snmp-comm -Os 192.168.254.1 ifTable > ift1.txt The output file is a 24 column text file, not a friendly sight to see, but with the assistance of excel, it becomes a useful piece of information. It can tell you a lot about your network. In excel simply open it as a text delimited file, and set the separation character to space. What are we looking for here? Errors (ifInErrors and ifOutErrors) discards, heavy users based on the in and out octets, heavy broadcasters based on the ifInNUcastPkts and ifOutNUcastPkts (the N stands for non …). When you identify an interface with higher then the normal count, try to verify what it is and where is it connected to. Also, for errors, monitor this interface to see if the errors increment, if they don’t it might have been something that happened long ago and should not worry you. A better approach is to constantly monitor and alert if there are any unusual symptoms, there are tools that will do it for you, which fall under the network management category. In Cisco’s environment, a tool from Cisco works Lan Management Solution (LMS) is designated to do that. This is the Device Fault Manager (DFM). It will actively monitor preconfigured counters and should alert if they behave suspicious, I found it very useful for the purpose of network health monitoring. Other 3rd party tools are also available. That’s it for this aspect of assessment, next time I’ll talk about the info that can be seen from the command line interface. Take care, Avner.