Previous Table of Contents Next Network Statistics The best manual way to gather long-term network statistics is to use your analyzer. If you have a lot of segments, you should get an analyzer with a probe system such as Observer, LANalyzer Agent, or the Distributed Sniffer. For our purposes, we'll pretend that you only have one segment you're interested in getting statistics on. Let's say that my shop's only analyzer is the LANalyzer. A LANalyzer allows you to export trend details to a disk file that you can then import into whatever spreadsheet you like. All I do is start it running on Monday, stop it Monday night, and save the trend data to disk (see Figure 23.4). Then I repeat the same steps on Tuesday, Wednesday, Thursday, and Friday. [23-04t.jpg] Figure 23.4 LANalyzer can show you details or trends. With LANalyzer, I end up with several vital statistics that are sampled every 15 minutes: o Packets/sec o Errors/sec o Percent of network utilization o Kilobytes/sec I definitely like to chart the kilobytes per second-this lets me know how quickly my little data highway is actually flowing. I also chart the utilization. Although this pretty much follows the curve of the KB/sec statistic, it can't hurt, and it reminds me how much of my pipe I have left. I don't usually bother with packets per second, but I definitely chart the errors; this should be a long, flat line at the bottom of the graph with very few peaks. Baseline Bottom Line After you've done your baseline homework, when a user reports slowness on the network, it's a simple matter to compare values that you're currently getting to what they should be on your baseline graph. This allows you to know whether these stats are out of line for your network. You can then take appropriate action: o Network utilization too high?-Seek and destroy the "top talker" using an analyzer. o Network errors too high?-Seek and destroy the top error producer using an analyzer. Also check the cabling. o Server paging too high?-Decrease the number of users or apps on the server or add more memory. o Server waiting for I/O too high?-Upgrade the disk cache or consider a new high-performance disk upgrade. o Server CPU utilization too high?-Decrease the number of users or apps on the server, add CPUs, or replace the server. Summary Although troubleshooting slowness problems can seem to be a black art, when you break down any network session into its component parts in a variation on the divide-and-conquer theme, it quickly becomes apparent which part is the bottleneck on your information highway. Your family trip can take a lot longer to complete than you expect due to highway traffic or road conditions. Similarly, your application can move slowly due to a variety of reasons-the most obvious being network utilization. Other reasons include server slowdown, router or switch latency, and application or protocol efficiency problems. Baselining your network is an important step in being able to quickly determine which of these reasons is causing your slowdown; if you don't know how things are when life is great, you have no reference to troubleshoot by. With a baseline, you can compare current stats to "normal" stats-just as a doctor does when diagnosing your blood chemistry-and quickly take action to fix it. You can "manually" take baselines, or you can buy into an SNMP management package that will create the baseline for you. SNMP is certainly the yummier option; however, it's possible to do this on the cheap side-it's just more of a pain in the neck. Workshop Q&A Q Which network analyzers can be used to manually baseline a network segment? A Just about all the newer ones. The exact technique may vary, but the basic functions for gathering statistics about the segment you're analyzing are the same. Very old DOS-based analyzers might not have the ability to save statistics over a time frame, however. Just ask before you buy. Q About that latency analysis method: Do the analyzers need to have synchronized clocks? A No, that's the cool thing about this method. You're taking the total trip time differences on both ends. Because the difference between the differences has to be the total amount of time the packet spends in the switch or router going both ways, you divide that number by 2 to get the latency for a one-way trip. Quiz 1. You install a new virus protection application on one of your servers. Instantly, you're bombarded with complaints that the network in your building has slowed to a crawl. What should you do next? A. Run a network analyzer on your segment B. Deny everything C. Uninstall the new application D. Power down the server 2. Application throughput can be found by dividing the ___________ by the ____________. A. number of workstations, number of routers B. total bytes transmitted, time elapsed C. total bytes transmitted, workstations involved D. number of workstations, time elapsed 3. 10Mbps Ethernet is about ________ times faster than a T1 leased line. A. 5 B. 2 C. 1 D. 100 4. Major slowdowns can occur when _________ or __________ is not used by a network application. A. packet burst, sliding windows B. packet windows, sliding burst C. windows defenestration, burst appendix D. windows burst, sliding packets 5. What's the slowest kind of memory on any server? A. Amnesiac memory B. Cache memory C. Dynamic memory D. Virtual memory 6. What constitutes a "disk-bound" application? A. When the limiting factor is how fast the disk can go B. When the application is strapped to the hard drive C. When the disk is going as fast as it can D. None of the above 7. When does "oversubscription" occur? A. When a provider has more bandwidth coming in than going out B. When a provider sells too many tickets C. When a network is saturated D. When too many Web sites are used by your users 8. True or false? You can easily tell whether current statistics are out of bounds, even without baselining. Answers to Quiz Questions 1. C 2. B 3. C 4. A 5. D 6. A 7. A 8. False Previous Table of Contents Next