Network monitoring technology
1. Environmental topology map to the campus network as an example.
Sniffer 2.1 Installation
A running the installation program on the host. According to the installation wizard prompts, enter your user information, specify the installation path, fill in the user registration information, enter the serial number, designated connected to the Internet. After installation is complete, restart your computer
2.2 Operation and test
Sniffer Pro main features include:
l monitoring function: for calculating and displaying real-time network traffic data.
l capture function: means for capturing network traffic and the current packet stored in the buffer (or file), to prepare for future analysis.
l real-time expert system analysis function: for analyzing network packets in the capture process, and warn of potential problems.
l display function: for decoding and analyzing the captured data packet buffer, and displayed in various formats
This experiment to understand its monitoring function.
(1) Dashboard (dashboard)
The dashboard is a visual network performance monitor. When the first start, the instrument panel will appear on the screen, as shown in FIG. 2. If you close the dashboard window, select the menu Monitor (monitor) → dashboard (dashboard) to start it, or click the Dashboard icon in the tool bar Sniffer Pro. Dashboard dial window includes three numbers from left to right is:
l showing the percentage of bandwidth utilization percentage of the line, with the ratio of the maximum transfer amount of bandwidth that can be processed by the port indicated. Dial red areas indicate the alert value. In a disk hereinafter has two numbers separated by a dash. The first number represents the current utilization percentage, behind the dash number represents the maximum utilization percentage.
l Description packets transmitted per second transfer rate of the current packet. Dial
The red area indicates the warning value, is displayed below the dial current packet transfer rate and peak.
L instructions per second error generated error rate of the network. Dial red area indicates the warning value, the value below the dial indicates the current error rate and the maximum error rate.
FIG 2 Sniffer Pro dashboard window
Many network analysis of Sniffer Pro can be set thresholds. If the threshold is exceeded, an alarm is generated record information. On the instrument panel, exceeds the set threshold range marked in red. Setting threshold) click button above the dashboard, the dashboard properties dialog box, as shown in FIG. In the Dashboard Properties dialog box, the left is the name of the column on the right is a high threshold bar at the bottom is monitoring sample interval in seconds calculation. If Fixed an argument, but want to restore the default values, you must first select the parameters, and then click Reset) button. If you want all parameters are reset defaults, click the Reset All) button.
3 Dashboard Properties dialog box
Metering plate the lower left table) real-time display label utilization, packet rate and the error rate instrument details click plate bottom left) tag, displayed in tabular network counting result, and the scale error count results into For details, as shown in FIG.
Figure 4 Sniffer Pro dashboard details label
Click Short term (short-term) or long term (long-term) button, you can narrow or expand the scope and scale of the distribution of detailed error graphics, short-term range is approximately 25 minutes long range is 24 hours, click the bottom left of the instrument panel network) selection box, dashboard displays network as shown in FIG. 5 and illustrated network event selection box. Dashboard view of network statistics per second, providing all network diagram. 1
Figure 5 Network dashboard view of network events and selection boxes
Click dashboards size distribution below) selection box, a dashboard display as shown in FIG scale distribution and size distribution of events shown in FIG. 6 selection box. Distribution of the dashboard is all activity on the network segment and the Sniffer Pro connected to the system by a real-time view of the scale division.
6 scale distribution and the size distribution of the dashboard map event selection box
Similarly, users can also click Detail Errors pan bottom left of the instrument (detailed error) selection box, see the dashboard with detailed maps and a detailed error error event selection box.
(2) Host table (host list) host list provides the communication with the network where hosts are all monitored. Select Menu Monitor (monitor) → Host table (host list) to start the list of hosts its icon, or click a point to 7 Sniffer Pro toolbar.
In the bottom of the main window, the list may be selected to address the IP address or MAC address IPx host list view. As shown in FIG. 7, select two points P option. Host List supports four different views yield: outline (outline), details (detail), Histogram (bar) and pie (pie).
7, the icon click Outline, express the list of hosts, and these hosts after the transfer byte number. In outline view, want to know if a particular station (Example 192.168.1.101) networking case, simply click on the address P in FIG. 7 is directed, the interface appears as shown in FIG. 8.
Figure 7 list of hosts outline view
FIG 8 is connected host address Example
Figure 8 clearly shows that the machine address (192.168.1.101) connection. Click the icon to the left of the other host list toolbar will pop up the machine-related data connection interface.
Details click) on the icon screen shown in FIG. 7, showing the distribution of the protocol throughout the network, the network application can be clearly seen on the network layer protocol of each machine is running, as shown in FIG. 9 .
9 view details
Bar Click (histogram) icon interface shown in FIG. 7, the amount of network transmission occurs in a histogram display of the host prior to N bits. By default, the first 10-bit host, as shown in FIG.
FIG 10 is a front of the main transfer amount N bits histograms
Click Pie (pie) icon interface shown in Figure 7, the network traffic for the first N-bit host displayed in the form of a pie chart. By default, the first 10-bit host, as shown in FIG.
FIG 11 is a front transfer amount N bit host Pie
(3) Matrix (matrix)
Host list is provided a communication case of a single host matrix provides a case where the communication network to be monitored between the host pair, both the user interface and the function information is entirely analogous. Select Menu Monitor (monitor) → matrix) to start it, or click the matrix icon in the toolbar. FIG green line indicates the network connection is occurring, the blue line represents the past in which the mouse over the connection line can be seen.