SNEAK PREVIEWS

NetXRay Exploits Win95 For Protocol Analysis

by Peter Morrissey

Cinco Networks' NetXRay, the first true Windows95 software analyzer, may actually be good medicine for your network, whether it needs a quick checkup or minor surgery. It handled all the stress testing I've thrown at the other products (see "Software Analyzers Bring Right Features, Right Price," July 1, page 116) without any difficulty. I found it as easy to use, and functionally rich as the top products in this category.

Imitation? Or the Real Deal? If imitation is the best form of flattery, Novell (whose LANalyzer won our Editor's Choice award) should be basking in the adulation. The "dashboard" with gauges for packets, utilization and errors, looks like a LANalyzer clone. Clicking on the file tab below the gauges reveals running counters about Ethernet statistics.

The Host Table window lists all of the hosts on the network by MAC address, or by name. It displays in and out packets and octets for each station, as well as out errors, broadcasts and multicasts. You can sort each column with a single mouse click and drag-and-drop columns. Novell also listed the major protocols associated with each host, however.

Unlike LANalyzer, you invoke the packet capture feature in a separate window, highlighted by two more gauges showing packets and buffer status. From here I had easy access to the filter settings that can be based on hardware or IP address. I could set up filters on two-way IP conversations, a feature that LANalyzer neglected.

An "Advance Filter" section provides a list of eight common protocols you can check off. It also provides the flexibility to set up offset filters. Accomplishing this, however, was not quite as easy as with LANalyzer, which automatically loads in the offsets by having you click on a packet already captured. NetXRay compensated by letting me save any filter setup in a file I could easily access from the main capture window.

The capture screen had the typical, three horizontal windows showing summary, decode and hex/ASCII views of the packets. The summary displayed customizable color coding for each protocol type. The detail doesn't use color coding. The decodes, although thorough, usually didn't venture past the transport layer, but the release version should have all of the most common decodes further up the stack. One of decode window's best features is the ability to mark the position of the decode in the window for future reference.

There is also a packet generator capable of generating 7,000 packets per second (pps) while monitoring and capturing packets without any apparent difficulty. The user interface also remained quite functional when I blasted it with 11,000 pps and successfully captured 602 filtered packets.

This is apparently part of being a true, 32-bit, Windows95 application, but the fact that it came installed on a Pentium 120 with an Ethernet PCI card didn't hurt either. The utilization levels were always exactly the same as the Network General Sniffer I usually use as a baseline.

Peter Morrissey is a network systems programmer at Syracuse University. He can be reached on the Internet at ppmorris@mailbox.syr.edu.

October 15, 1995