New ethernet sniffer program

Originally Posted by kriesel

If you want a runt generator, try what an amateur network admin did on our shared uplink network some years ago; put too many hubs in series between switches or routers, and ordinary equipment at the far end. A media converter counts as half a hub. It helps to have speed mismatches to overload the low speed end.

Late collisions in ordinary traffic in this situation generate runts. (Low budget university networking done by a student not knowledgable about networking or coordinating with people who know what they're doing creates such things. AUI to RJ45 to thin coax to AUI to fiber to stand off lightning potentials between buildings to RJ45 to chained hubs to media converter to old NIC... I think there was a hub or two in there somewhere used as a media converter.)

This was in the bad old days before we had switches with per-port diagnostics. I forget the name of the network monitor used to localize the issue to the smallest network connected to the common uplink, by looking at the content of the abandoned runt packets.

I am organizing the lab for tests, the setup will be as follows:

network                                            packet
  monitor <---------> lab equipment <----------------> generator

I got already a packet generator, waiting for more equipment.

[chalsall]

Originally Posted by kriesel

I forget the name of the network monitor used to localize the issue to the smallest network connected to the common uplink, by looking at the content of the abandoned runt packets.

Possibly Nagios and/or Cacti?

SNMP can be a bit of a steep learning curve, but instrumenting everything you have access to can be *very* useful....

[kriesel]

o

Originally Posted by chalsall

Possibly Nagios and/or Cacti?

SNMP can be a bit of a steep learning curve, but instrumenting everything you have access to can be *very* useful....

Definitely neither nagios nor cacti at the time. But yes, a kit of effective tools really pays off.

Nagios and cacti maybe did not exist yet or did not then have the necessary capabilities at the time. Perhaps I used the wrong term. It was a midrange commercial Windows software product for live network packet, fragment, or header capture or injection and inspection. "Protocol analyzer"? (I don't recall which, might have been LanHound) It could handle TCP/IP, UDP, ICMP, DECNET, Appletalk, etc and raw ethernet. One of the few that offered packet collision fragment capture at the time, many years ago, for under the cost of $500 or so. Later it was phased out, replaced by Ethereal and Wireshark.

I took that small Lan from single 10Mhz collision domain, mostly minicomputer, to PC dominant switched gigabit with firewalls between departments. While still doing my "real job", mechanical engineering, among other things.

SNMP monitoring was a whole other category I implemented, through free vendor-specific software, along with a central syslog server and network map with periodic accessibility/health testing. This central logging and monitoring was bequeathed to my successor by the simple swap of IP#s between our desktop machines. The time spent mapping the connectivity of machines through the switch mesh, firewalls, routers, etc to our uplink and distant resources in other states (in an early version of WS_Watch) was well spent when panicked B-school people would roam through the hallways announcing "the network is down" as if it was a single thing, like a toaster, and I could view the map, hit refresh, and quickly see the boundary between reachable and unreachable, which often took minutes off determining where the issue lay, corresponding to avoiding man-hours of work lost through reduced productivity. We also did traffic volume tracking, and a shared network link's cost was apportioned by relative traffic, without compromising data confidentiality.