Selecting a protocol analyzer

Nutter helps a user with a tight budget choose a protocol analyzer

I have just started a job with a company whose network spans several buildings in a campus-like setting. One of the tools I know  I will need is a protocol analyzer. The current budget allows for me to get some tools, but I don’t want to blow the budget on any one tool. What protocol analyzer will be the best buy?

– Via the Internet

The best answer I can give you is that it depends. In terms of price, you can go from free with Ethereal to spending more than $20,000 with some of the software-based analyzers. There are good hardware-based analyzers, but these will probably cost more than a software-based one, which allows you to put the analyzer on a laptop that can be used for other needs. There are several good options to choose from – EtherPeek NX from Wild Packets, Sniffer from Network Associates and Observer from Network Instruments. There are others, bur what I just listed are the ones I’m familiar with.

Since each analyzer can offer a different set of features, you need to look closely at what services are running on your servers and what points in the network you need to be able to troubleshoot. In terms of services, you’ll want to see if a server is running Oracle, SQL or some other type of database service. Not all protocol analyzers may decode this type of traffic to the level you need, if at all.

Once you have inventoried your services, look at what you need to examine in terms of hardware. If you have a Wi-Fi network or you want to monitor traffic between your routers and the T-1s that connect to them, this is something not all analyzers may be able to do because of the special hardware required. Sniffer is an example of a product line that can do several things in one package; you’ll need to get specialized hardware such as a PC card that can connect between the router and the DSU/CSU feeding the T-1. Other vendors may not be able to do something like this or may have your purchase a different product.

The bottom line is see what you need to be able to examine with a protocol analyzer, rank how important it is and see what it costs to do what you want in deciding which analyzer will be the best for your situation.  Get a feel for how each analyzer works before putting down your money.  Most vendors will have some type of “demo” version available to help you in your selection process.