Reviews

Network Protocol Analyzers: A Window To The WAN

To view the Report card.

ware-only products have made LAN protocol analysis downright common. WAN analysis, however, has its own set of challenges: the diversity of physical interfaces and link parameters, variations in Level 2 protocols (differing frame relay Local Management Interface standards, for example) and the difficulty of nonintrusive testing on point-to-point links.

To determine their functionality and usability in a real-world environment, we tested WAN analysis devices from Digitech Industries, GN Nettest, Hewlett-Packard Co., Network General Corp., RADCOM Equipment and Wandel & Goltermann. All of the products are rich in features, and many come with a bewildering array of software and hardware options. To level the playing field, we focused our testing on fractional T1 and frame relay interfaces.

One capability we insisted on is the ability to perform decodes on encapsulated LAN traffic. However, this requirement eliminated several powerful telecommunications products. We also considered nonintrusive testing of fractional T1 circuits of particular value and we were pleased to find that all the products submitted met this criteria. It may come as a surprise to network analysts spoiled by the plug-and-play simplicity of LAN monitoring that these devices must be configured appropriately before a single bit of data can be captured.

Two occurrences have contributed to the development of these analyzers: First, the tele-communications industry has developed strong tools for physical and bit-oriented testing. Second, with the advent of packet switching, particularly frame relay, these devices have become progressively smarter and more feature-rich.

At the same time, classic LAN analyzers focusing on protocol decodes have extended their reach to the WAN via add-on boards and external modules. Of the products we tested, the Digitech WAN 900 and the GN Nettest 9470 Protocol Analyzer stem from the first event. The RADCOM RC-100W WAN Analyzer, Wandel & Goltermann's DominoWAN Internetwork Analyzer and Network General's Sniffer Internetwork Analyzer clearly are from the latter. The HP Internet Advisor WAN seems to be an offspring of both.

Hewlett-Packard Co.Internet Advisor WAN

The Internet Advisor is HP's attempt at the ultimate analyzer. We were amazed at the number of interfaces the developer has squeezed into one box. The basic unit has every V-series interface you can think of, along with T1 bantam and RJ-48C jacks. It even h as a V.35 connector onboard. HP's description of the unit as "lightweight" must be in comparison to the stuff white dwarf stars are made of: It weighs in at almost 16 pounds. The construction, however, is exceptional, and we suspect it could sustain a fairly good drop without significant damage.

The unit ships with Microsoft Windows95, but most of the Internet Advisor programs are Windows 3.1, 16-bit applications. Many of the modules actually run in a proprietary OS mode, requiring that Windows95 reboot into "DOS mode."

HP's approach to test selection differs substantially from that of other vendors. Rather than configuring options from the main application, the user must traverse the programs tree structure, drilling down from the initial three-way, ATM-LAN-WAN, split to Level 2 protocol, Physical Interface and encapsulation standard.

This seemed a little weird initially, but we grew accustomed to it. The actual program items simply are shortcuts to configuration files invoked by the particular application, WAN.EXE for example. If this sounds too confusing, you can select "Utilities-Copy HP Icons to the Desktop" as an alternative.

You can choose various data views from the main viewing area through the toolbar icons. "Line Status," "Line Vital Signs," "DLCI Statistics" and "Decodes" provide detailed information in an easy-to-understand format. Statistical data for Data Link Connection Identifiers (DLCIs) is particularly useful. Protocol decodes basically are to Level 4. None of the TCP/IP suite protocols, such as SNMP, telnet or FTP, are decoded.

This is the only unit, besides the Network General Sniffer, that provides anything approaching an expert system. For example, it identified and flagged TCP retransmissions.