print

Tip of the Month

November 2001

Fall is the Time to Clean House...

It is also a good time to take this philosophy to the network! Hopefully, you don't have roses growing in your routers, though old hubs make good planters! Let's assume that you have put out enough fires so that there are no significant glitches on the network, and that your khakis aren't on fire at the moment.

Break out that network map and old baseline data and make a schedule for November to baseline at least the major segments of your network, or at least those that have the most visibility. If you don't have a network map, use your instinct to pick some critical segments. For those of you who baseline at regular intervals... "Way to go!!!" For those of you who do not, there is no time like the present!

Use the Peek's unattended mode and don't set any filters, because you want to see all traffic. You will want to consider how much utilization each segment has and how that relates to the size of your buffer and disk space, and plan accordingly for an extended capture. To maximize the buffer available, you will most probably want to "packet-slice." Limit the size of packets to about 128 bytes and you will get all the header information you need without getting all the data that you don't need. Set up your analyzer and let it run for 24 hours so you can see what, if anything, happens during on and off times. In many instances, updates, downloads, or mass FTP sessions are run at night when the network is used least by clients.

After capturing the data, it's time to make use of all those great-looking Peek graphs and charts! Here are a few data points that you will want to review:

Nodes Tab:
Who were my top-talkers?
Are the top-talkers Servers and Routers? (If a client is a top-talker, ask why!)
Who are my least talkative talkers?
Is this just today, or do I have old machines that are no longer needed on my network?

People doing the same work should be using the network at about the same rate, though this will differ by excess tasks or changed configurations. So, when you look at a department with 45 people doing the same work, they should have relatively equal traffic patterns. If they don't, ask if a user made a configuration change or if they are a power user.

Protocols Tab:
What Protocols are being used? Is this surprising?
Are there any protocols that are no longer used and can be shut off?
Are all machines speaking the same frame-type?

Size Tab:
Do the sizes make sense?
Are you seeing many large packets on a network with many large file transfers?
Small packets should be seen for keep-alives and telnet sessions, etc.

Now that you've done some fall network cleaning, mark your calendar to do it again in six months (or, better still, quarterly!) Save these captures with their graphed data for review next time you baseline, so you can plan for future growth. When asked for your end of year Christmas Wish list, you'll know what you need for the network!