
Analyzing The Network Analyzer
We tested network monitoring accuracy and capture performance (with and without capture filters) with varying levels of network traffic. All traffic used contained a good mix of IP, IPX and AppleTalk data captured from a busy subnet in Network Computing's lab at Syracuse University. We replayed each sample on a dedicated network segment using Network General Corp.'s Sniffer Network Analyzer and Traffic Generator. All testing was validated using Wandel & Golte
rmann's FastEthernet Domino.
Each software analyzer's monitoring tools were tested for accuracy in both percent of bandwidth utilization and packets per second. Capture performance was gathered in four tests: standard traffic rates (between 10 percent and 20 percent of 10-Mbps utilization were replayed and captured); accelerated traffic (traffic was replayed using minimal interframe gaps); and two capture filter tests. In the filter tests, standard traffic was captured with high and low levels of background traffic (generated by a second Sniffer Traffic Generator) and filtered using a MAC (Media Access Control)-level exclusion filter.
Performance varied dramatically across the different cards. 3Com Corp.'s 3C905 PCI adapter yielded the most consistent performance, though it regularly refused to pick up certain packets. This indicates that some packets are not passed through the NDIS (Network Driver Interface Specification) driver by design.
Network General's NetXRay offered perfect capture performance using CNet Technologies' NE2000-compatible ISA card (and Network General's proprietary replacement for the standard NDIS driver). However, it suffered from degraded capture performance in the filter tests at high network utilization.
Triticom's LANdecoder32 offered vertical drivers for the DEC21140 PCI card, which yielded perfect captures, though it required disabling the card under Microsoft Windows95.
The only software analyzer that was seriously affected by low performance across all Ethernet cards tested was AG Group's EtherPeek 2.0 (beta version), which was unable to perform a complete capture of a full 19,006 frames, replayed in real time, on any card.
|