The good news is that HP's toolbox is deep enough to hold just about all the tools you need, which is one of the reasons it edged out Network General's Sniffer for our top position. Internet Advisor can tap directly into full-duplex networks and decode and summarize VLAN traffic. However, HP should have laid things out a little better--maybe on a pegboard.

Only HP's and Network General's products include expert troubleshooting aids. If you are going in blind to a network problem, or if you just want to perform a general health check of your network, these aids c an save you a lot of time. The first tool you'll want to pull out is HP's Ethernet Expert Analyzer tool. It's window contains textual and graphical summaries of utilization along with a rating of Network Health, along the top of the screen. Drilling down from the top of the screen will display a table containing basic Ethernet statistics related to all known Ethernet addresses.

At the bottom of the Ethernet Expert Analyzer screen is a table with nine major protocols along the left axis and various statistics related to each protocol in columns to the right, including warning and event counters for each protocol. You can drill down through three more layers of detail from each counter to reveal the actual diagnoses that have been flagged, the frame numbers involved and a detailed interpretation of each prognosis.

Like Network General's Sniffer, Internet Advisor can flag a long list of events, from simple physical layer error thresholds to the upper layers, and monitor functions like slow file transfers on Novell applications and Oracle SQL applications.

Internet Advisor also can flag transport retransmissions for TCP/IP and AppleTalk, but, unlike the Sniffer, it cannot understand retransmissions for Novell's NetWare Core Protocol (NCP). We were able to understand things like duplicate service requests, which are always the result of a retransmission, but the product could not catch retransmissions that are the result of dropped packets. Retransmissions are one of the more common symptoms of problems, which can be caused by anything from noisy lines or malfunctioning equipment to overwhelmed servers.

You also can launch an Ethernet protocol stats window from the measurements window. We were able to get a detailed breakdown of all major protocols. For example, when we ran the TCP/IP version, we saw usage stats on major protocols in the suite including Domain Name System (DNS), HTTP and the Post Office Protocol (POP). Internet Advisor can provide these stats for more protocols than either Network Genera l's Sniffer, which could only display usage for TCP/IP, or Shomiti's Surveyor, which only offered breakdowns of TCP/IP and Novell protocols. Shomiti, however, formatted the data in better-looking graphs and tables that were easier to customize.

Setting up filters with the Internet Advisor was not so easy. Only Ethernet address and IP filters could be set up without getting into the hexadecimal editing business. Although the capture decodes were fairly thorough, they were not easy to read or navigate because of a lack of color coding and a cumbersome user interface, which combined the worst features of OpenWin and Microsoft Windows. If you want an analyzer with expert troubleshooting aids and you need to monitor and decode Cisco VLANs directly tapped in a full-duplex network, HP is your only option.