Probe from Network Instruments aims to ease troubleshooting, planning.
Diagnosing network problems without analyzing or even inspecting the traffic related to the problem is always an exercise in speculation and guesswork. Network Instruments says its GigaStor probe is the answer.
How we tested GigaStor
Archive of Network World tests
Subscribe to the Network Product Test Results newsletter
Long-distance WAN links complicate the picture. Troubleshooting or planning network segments thousands of miles away isn’t easy without some level of direct analysis of the traffic. Even worse, dealing with intermittent problem reports (someone screaming, “It happened again just five minutes ago!”) is extremely frustrating.
Network Instruments says its GigaStor probe is the answer, because it can capture gigabytes of network traffic, analyze them and forward the analysis to a central console (its Observer protocol analysis and network-monitoring software). We recently tested the 4TB version of the GigaStor appliance (Network Instruments also makes 2TB and 8TB versions).
The appliance passed our tests with flying colors. Its high price may preclude some from installing probes in every nook and cranny of the network, but the unit’s processing power and capacity can offset the price by letting you place probes at strategic network intersections, even if their network connection is extremely busy. The GigaStor stored high traffic volumes without missing a beat, was frugal with bandwidth, and the Observer console made understanding and solving even difficult network problems quick and easy.
How we tested GigaStor
We connected the GigaStor to each of our six Cisco-routed Gigabit and Fast Ethernet network segments. The client and server platforms included Windows NT/XP/98/2000/2003, Unix (AIX), Red Hat Linux and Macintosh OS X. Relational databases on the network were Oracle 8i, Sybase Adaptive Server and Microsoft SQL Server 2000. Windows Server shared files, while Internet Information Server, Netscape and Apache software served up Web pages. We set up T-1, T-3, OC-1 and OC-3 WAN links for the GigaStor to eavesdrop on.
In each test, we looked at the GigaStor’s ability to discover our network nodes, monitor those nodes for availability and performance, decode protocols, filter traffic based on network address, protocol type and other parameters, produce useful statistical summaries of network activity, help troubleshoot problems and report on the current status of the network’s devices and connections. To determine the GigaStor’s performance, we flooded the WAN links with a known number of network messages and noted the ability of the GigaStor to keep up with the traffic.
Probing intelligence
The 4U rack-mounted GigaStor includes a 64-bit processor, a high-performance disk subsystem and the Network Instruments-named Gen2 Gigabit Capture Card to intercept and store on its hard disk every packet, no matter how busy the network. Operating at wire speeds, the high-performance GigaStor effortlessly and accurately captured dense traffic flowing at T-1, T-3, OC-1 and even OC-3 speeds (see How we tested GigaStor). The 4TB unit we tested easily stored a 72-hour history of heavy OC-3 (155Mbps) traffic. This means a remote user could have a problem on a Monday, take Tuesday off, report the problem on Wednesday, and you could still diagnose it – all without having to travel to the user’s office.
| The Tip Jar: Network probes do’s and dont’s | ||||||
|
The GigaStor analyzed the stored traffic and produced typical protocol analyzer statistics, including top talkers, packets per second, packet-size distribution and bytes per packet. The unit also sported a sophisticated network-monitoring ability. For example, once we set thresholds for alert situations, such as
|
| |||||||||||||||||
| |||||||||||||||||
Network Instruments says its GigaStor probe is the answer, because it can capture gigabytes of network traffic, analyze them and forward the analysis to a central console (its Observer protocol analysis and network-monitoring software). We recently tested the 4TB version of the GigaStor appliance (Network Instruments also makes 2TB and 8TB versions).
The appliance passed our tests with flying colors. Its high price may preclude some from installing probes in every nook and cranny of the network, but the unit’s processing power and capacity can offset the price by letting you place probes at strategic network intersections, even if their network connection is extremely busy. The GigaStor stored high traffic volumes without missing a beat, was frugal with bandwidth, and the Observer console made understanding and solving even difficult network problems quick and easy.
How we tested GigaStor
We connected the GigaStor to each of our six Cisco-routed Gigabit and Fast Ethernet network segments. The client and server platforms included Windows NT/XP/98/2000/2003, Unix (AIX), Red Hat Linux and Macintosh OS X. Relational databases on the network were Oracle 8i, Sybase Adaptive Server and Microsoft SQL Server 2000. Windows Server shared files, while Internet Information Server, Netscape and Apache software served up Web pages. We set up T-1, T-3, OC-1 and OC-3 WAN links for the GigaStor to eavesdrop on.
In each test, we looked at the GigaStor’s ability to discover our network nodes, monitor those nodes for availability and performance, decode protocols, filter traffic based on network address, protocol type and other parameters, produce useful statistical summaries of network activity, help troubleshoot problems and report on the current status of the network’s devices and connections. To determine the GigaStor’s performance, we flooded the WAN links with a known number of network messages and noted the ability of the GigaStor to keep up with the traffic.
Probing intelligence
The 4U rack-mounted GigaStor includes a 64-bit processor, a high-performance disk subsystem and the Network Instruments-named Gen2 Gigabit Capture Card to intercept and store on its hard disk every packet, no matter how busy the network. Operating at wire speeds, the high-performance GigaStor effortlessly and accurately captured dense traffic flowing at T-1, T-3, OC-1 and even OC-3 speeds (see How we tested GigaStor). The 4TB unit we tested easily stored a 72-hour history of heavy OC-3 (155Mbps) traffic. This means a remote user could have a problem on a Monday, take Tuesday off, report the problem on Wednesday, and you could still diagnose it – all without having to travel to the user’s office.
| The Tip Jar: Network probes do’s and dont’s | ||||||
|
The GigaStor analyzed the stored traffic and produced typical protocol analyzer statistics, including top talkers, packets per second, packet-size distribution and bytes per packet. The unit also sported a sophisticated network-monitoring ability. For example, once we set thresholds for alert situations, such as a specific server emitting no packets (a nonresponsive server), the GigaStor thereafter promptly notified us of errors and warnings via the Observer console, SNMP trap, pager or e-mail.
If viewing statistics doesn’t solve the problem, the GigaStor lets you drill deeper. The appliance decodes more than 550 diverse protocols and can display the contents of packets for an address, a protocol stream or a time period. We were especially impressed by the unit’s application analysis statistics, which revealed response times as well as total transactions and failed transactions for such applications as SQL Server, Oracle, Exchange, VoIP and DNS/DHCP. Equally impressive is GigaStor’s nanosecond resolution.
When communicating with the Observer console, the GigaStor was especially frugal in its bandwidth use. The probe compressed and encrypted statistics and actual packets sent to the console for display. In our tests, we measured an increase in use of less than 3% when we told the GigaStor to send the console all packets sent or received by a particular client for a specified five-minute period during the previous day. We estimate the device’s compression reduced the GigaStor-to-Observer transmission to a tenth of what it would have been.
Moreover, the console and appliance use a private protocol that carries only changed (updated) display data. For example, if you are viewing a Top Talkers window that shows 300 network nodes, and the displayed data changes for only 38 of the nodes during an update cycle (configurable), the GigaStor sends only the changes in display data (IP address, byte counts and packet counts) for the 38 nodes.
Network Instruments offers nTAP connectors for using the GigaStor on 10/100Mbps copper, 10/100/1000 copper and 10/100/1000 fiber networks. These connectors let us link the GigaStor directly to our network without using the span (mirror) port of the switches on each of our subnets.
Ease of use
Although the appliance includes monitor and keyboard ports for local access, the primary interface is the highly capable Observer protocol-analysis tool. Because working with a remote probe is similar to using Observer to diagnose a local problem, solving remote problems becomes simple and painless. Moreover, the Observer analysis tool and the GigaStor are so closely integrated, that just using a newer version of Observer to access a GigaStor probe automatically updates the GigaStor’s internal analysis software.
The GigaStor communicates only with the Observer protocol-analysis tool, which is a slight drawback for this network probe. You can’t use, for example, HP’s OpenView network-management product to direct the unit’s operation or view GigaStor analysis results. Fortunately, Observer is intuitive, highly graphical and easy to navigate.
The appliance was easy to install, requiring only that we connect it to the network and give the unit an IP address. The printed, nicely indexed and well-written documentation was clear and comprehensive.
Nance runs Network Testing Labs and is the author of Introduction to Networking, 4th edition and Client/Server LAN Programming. He can be reached at barryn@erols.com.
Nance is also a member of the Network World Lab Alliance, a cooperative of the premier reviewers in the network industry, each bringing to bear years of practical experience on every review. For more Lab Alliance information, including what it takes to become a member, go to www.networkworld.com/alliance.
