Is my network healthy? Miscellaneous tools

The last post in this series is touching some of the other tools you can make use of when assessing a network. Not trying to cover it all, but to point some more useful utilities and commands. First one is ‘Show process cpu’, you must always be aware of the CPU status and to make sure it is not overloaded. It is also important to have some sort of SNMP monitoring application running and looking at its utilization. You can add the ‘history parameter to the end of the command line and get historical info that shows utilization in the last 60 seconds, 60 minutes and 72 hours. Another important thing is to identify which ports on your switch are the top traffic generators; I covered how to get this info using SNMP in one of the previous posts ( Is my network healthy? The Macro level using SNMP”), but sometimes there is no time to get SNMP going. Or the network is already down and we are trying to identify why, in those cases the ‘show interface counters’ command is a good alternative. There are also some parameters which provide better focus on errors, etherchannel and more. Might be a good idea to first clear the counters and look at the current traffic rather then relaying on information that was collected before, use the ‘clear counters’ command. As for monitoring interfaces, say you want to dive deep into a problematic interface, the ‘show interface x/x’ is the command that can show more info on traffic rates, errors and more, all separated into inbound and outbound. An important thing to change on interfaces that are monitored closely is the ‘load-interval’ parameter. Make it the minimum, which is 30 seconds, in order to get a better update interval to the counters. The default for this is 5 minutes and the change is being done by using the interface level command ‘load-interval 30’. On routers, traffic can be measured by using the ip accounting and the Network Based Application Recognition (NBAR) features; these two will be enabled from the router’s config first, and then can be monitored using the CLI (and SNMP). NBAR would provide traffic statistics divided into protocols, which means that you can see what protocol is taking most of your bandwidth capacity, while ip accounting is more targeted towards measuring traffic between source and destination ip addresses. Both are very useful. NBAR is being used in the ‘auto qos enterprise’ feature, as the discovery mechanism which is later translated into a qos policy, but that is another story. That’s it for the network assessment line of posts; we have been covering all sorts of basic network assessment tools, which are available to any technical person. Some were vendor independent and the others were Cisco specific. I might deal more with this topic in the future but will discuss commercial tools. Keep up the good work, later …