Network Performance Monitoring

Here I compare and contrast how to analyze network performane using both Microsoft Windows and Unix/Linux machines using counters and other tools for performance profiling testing and tuning

Topics this page:

Site Map  
About this site  

System Analysis Utilities downloads
directory.google.com/ Top/ Computers/ Performance_and_Capacity

Measured Objects

This is one in a series of measurements:

• Network
• Memory
• Server
• System/Process on all CPUs
• Processor (individual CPU)
• Physical Disk

U: prefixes UNIX rstatd daemon counters.
W: prefixes Windows Perfmon counters.
S: prefixes SiteScope counters.

Counters.chm file from the Windows 2000 Resource Kit.
Counters.hlp file from the Windows NT Workstation 4.0 Resource Kit.

Picking Network Monitor

To determine if the number of network buffers need to be set higher, watch the number of error-free packets the system is dropping obtained by subtracting from the total packet throughput the sum of Packets Outbound Discarded and Packets Received Discarded.

Counters Packets Outbound Errors and Packets Received Errors indicate network card hardware problems.

Don't rely on the Current Bandwidth counter because it shows theoretical rather than actual bandwidth.

A reasonable limit for an Ethernet network is %Network Use less than 30 percent. A higher value means you need to speed up the network or reduce the amount of traffic.

Use the %Broadcast Frames and %Multicast Frames counters to view the percentages of broadcast and multicast traffic. Network cards pass broadcast and multicast frames to a higher-level software component before they act on or discard them. This extra activity results in additional CPU use.

As the requesting computer connects to find the server computer's network address, it generates broadcast traffic. Frame traffic increases as the server transfers the files.

Similarly, don't use the Output Queue Length counter because it's always zero, since transmission requests are not handled by the network card but by network device interface specification (NDIS) software.

The MRTG (Multiple Router Tafffic Grapher) freeware runs on Perl to graph network traffic by reading SNMP packets issued from servers. It's the most widely used tool on the Internet.

$1099 Denika from Somix plugs into the MRTG to dispaly 500 different performance trend reports after saving SNMP and IpSwitch WhatsUp Gold logs to a MySQL ODBC database (as a Microsoft service).

Logging Data with Perfmon for MRTG

Network Monitor

To add Network Segment counters, you must install the Network Monitor Agent.

Microsoft provides two versions of NetMon. Install the promiscuous version of Netmon from Microsoft's Systems Management Server (SMS) 1.2 and 2.0+ product to capture packets on all NICs on the same network subnet hub.

Otherwise, the network card typically rejects network traffic intended for other network cards.

Traffic through a switch (rather than a hub) may not be captured this way.

1. Install Network Monitor from Control Panel > Add/Remove Programs > Add/Remove Windows Components > Management And Monitoring Tools This puts netmon.exe and its dlls in the %windows%\system32\netmon folder.
2. Apply patch from MS Security Bulletin MS00-83 to patch the buffer overrun vulnerability from malicious malformed data.
3. Invoke Netmon from a command prompt or
   Start > Programs > Administrative Tools
4. By default capture files are saved with the .cap file suffix in the My Captures folder under the My Documents folder of the current user.

Netmon filter specifications are stored in the NetMon\Captures subdirectory. Netmon allows filtering by protocol, TCP/IP address, and data pattern.

This activity drains the resources of the computer you're analyzing, limit Network Segment monitoring. Monitoring Network Segment counters increases CPU use. As these counters process network traffic, they use additional system resources.

Among network monitoring tools to capture packets off the wire.

Open Source Ethereal displays and filters network data files captured by sniffers, even while a capture session is in progress. It resolves DNS.

Show Traffic, rewrite of Linux Trafshow.

$450 Network Probe from ObjectPlanet.

Network Sniffers

• Open Source WinPcap (installed as System protocol Driver NPF at the same level of tcpip.sys is visible in msinfo32.exe System Information panel, Software Environment). It exports primitive compatible with Unix capture library libpcap

  So, to unload it:

   net stop npf

  • HTTP Analyzer ($149) specializes on analyzing HTTP/S traffic via an IE Add-on or stand-alone program. Its creator, IE Inspector, also offers IE WebDeveloper and AxScripter for debugging ActiveX scripts.
  • Visual Networks' Visual UpTime
  • libpcap tcpdump
  • NAI's SnifferT
  • SnifferT Pro,
  • NetXrayT,
  • Sun snoop and atmsnoop,
  • Shomiti/Finisar Surveyor,
  • AIX's iptrace,
  • Novell's LANalyzer,
  • RADCOM's WAN/LAN Analyzer,
  • HP-UX nettl,
  • i4btrace from the ISDN4BSD project,
  • Cisco Secure IDS iplog,
  • pppd log (pppdump-format),
  • AG Group's/WildPacket's EtherPeek/TokenPeek/AiroPeek,

$1,395 Distinct Network Monitor [A] translates complex protocol negotiation codes into natural language, providing an intelligent interpretation pinpointing where errors occurred.

SNMP4NT SNMPUTIL.EXE SNMP Network Management Station (NMS) to Walk SNMP OID trees to get MIB info from network devices MS perf2mib and mibcc

$200 WebWatchBot