Infoblox NetMRI Community

Designing a Logging Solution

tslattery — Wed, 16 Nov 2011 21:33:00 GMT

I just found out about a great tutorial on designing logging solutions by Marcus Ranum. Marcus has been doing network security work for a long time and is well known in the network security industry. I have previously referenced some of his work in my blog Handling Network Events (syslog and snmp traps) where Marcus defines the term Artifical Ignorance . The tutorial by Marcus is quite long - over 200 pages, but it contains a lot of really useful information about how to process log files (syslog...(read more)

Rethinking Interface Error Reports

tslattery — Thu, 03 Nov 2011 01:58:00 GMT

've always looked at percentage of interface errors as an indicator of which interfaces I should examine. What did I know? Not enough, as it turns out. I've been working with customers on application performance, as you might have guessed from the series of recent blogs on the topic of application performance and the effect that packet loss has on TCP performance. ( Application Analysis Using TCP Retransmissions, Part 1 and Application Analysis Using TCP Retransmissions, Part2 ) Of course...(read more)

Application Performance Troubleshooting

tslattery — Mon, 17 Oct 2011 18:36:00 GMT

In the last two blogs, I described how application performance is impacted by TCP Retransmissions. Of course, there are many other causes of poor application performance. My review of this topic came about because Pete Welcher and I have just finished investigating whether application slowness at a customer site was due to the network or due to the applications themselves. Packet Loss As I described in the blog posts about TCP retransmissions, even small amounts of packet loss can cause significant...(read more)

Application Analysis Using TCP Retransmissions, Part 2

tslattery — Wed, 12 Oct 2011 17:14:00 GMT

In my last post, I talked about TCP retransmissions that are caused by link errors. Another source of TCP retransmissions is too much buffering in network routers and L3 switches. Some buffering allows the network to handle traffic bursts without dropping many packets, which is good. However, too much buffering causes problems. How much buffering is too much? Looking at how TCP works can help us understand what the limits should be. TCP measures the Round Trip Time (RTT) of its connection (see Wikipedia...(read more)

Application Analysis Using TCP Retransmissions, Part 1

tslattery — Thu, 29 Sep 2011 12:52:00 GMT

I've been doing a number of network assessments recently and one of the factors that I use to determine network health is the number of TCP retransmissions that occur. I look at servers and user workstations as well as looking for retransmisisons using packet capture tools. There is a fair amount of information on the web about TCP retransmissions and how TCP works. But I haven't seen anything much about the sources of TCP retransmissions. The few things I did find typically contained inaccuracies...(read more)

A Network Management Architecture, Part 4

tslattery — Wed, 31 Aug 2011 16:31:00 GMT

This is the fourth and final post of a series on the network management architecture used by NetCraftsmen . The architecture is shown below, consisting of seven elements. In this post, we'll look at Topology Mapping and discuss integrating the elements together. Topology Mapping Until recently, we had not identified a good way to track the physical network topology. The basic Visio network discovery and topology creation mechanism has never worked well for us. However, we have found several tools...(read more)

A Network Management Architecture, Part 3

tslattery — Tue, 23 Aug 2011 02:29:00 GMT

This is the third of a series of posts on the network management architecture used by NetCraftsmen in our network assessments. The architecture consists of seven elements, shown below. The two prior posts covered Events, NCCM, Performance, and IP Address Management. In this post, we'll look at Active Path Testing, and Application Performance. Active Path Testing Network management systems tell us how the network devices are operating. But they often don't tell us what the applications experience...(read more)

A Network Management Architecture, Part 2

tslattery — Mon, 15 Aug 2011 15:06:00 GMT

In Part 1, I discussed a Network Management Architecture, composed of seven elements, shown in the figure below. I described the Event and NCCM elements in that post. Performance Performance monitoring is typically where most people focus their early network management efforts. I think that's because it is easy for an organization's management to understand and it is relatively easy to implement. A lot of tools provide performance monitoring, with the Top N displays of utilization and errors...(read more)

A Network Management Architecture, Part 1

tslattery — Thu, 11 Aug 2011 17:36:00 GMT

At Netcraftsmen , we get to do a lot of network assessments where we examine and evaluate a customer's network, including the network management implementation. As a result of this work, we've identified a set of network management architectural elements. There are currently seven elements in the architecture, shown in the figure below. Each element provides a key piece of functionality that provides visibility into the network's operation. There are multiple products that provide functionality...(read more)

Debugging NetMRI Perl Scripts

tslattery — Wed, 03 Aug 2011 19:21:00 GMT

One of the new features in the latest release of NetMRI is the ability to write scripts in Perl. This means that the Perl programmers in your organization can now help you write and debug your command scripts. But the environment in which you can develop scripts is a locked-down sandbox to prevent a Perl script from doing undesirable things to the system. So how do you go about debugging these scripts? Create a simple script that runs the commands that you expect to execute on the network devices...(read more)

Network Management Function Review at CiscoLive 2011

tslattery — Wed, 27 Jul 2011 15:34:00 GMT

I just returned from a week at CiscoLive 2011. The show floor had a lot of network management products on display, making it an easy place to walk around and investigate various products. I did an informal product survey of functions that are important to a good NMS. Without going into the details of what I found for each vendor, I thought it would be worth describing the key factors that I investigated. Alerting Alerting is top on my list of key functions. A network with more than a few devices...(read more)

Diagnosing a QoS Deployment

tslattery — Fri, 22 Jul 2011 22:30:00 GMT

Monitoring QoS traffic class drops. Reference prior post. Discuss what happened with drops in high piroiry queue. Several of us at Netcraftsmen were involved in an interesting network QoS configuration case a few weeks ago. The customer had requested assistance with the first phase of a QoS deployment in which we were going to add QoS to some overloaded WAN links. These links ran at low utilization at night, but at 8am the utilization started increasing and by 9am it was typically into link saturation...(read more)

Diagnosing the "ipOutNoRoute" Counter

tslattery — Fri, 08 Jul 2011 17:54:00 GMT

Any devices that implement the IP MIB have an interesting SNMP counter called ipOutNoRoutes that has the following definition: ipOutNoRoutes OBJECT-TYPE SYNTAX Counter ACCESS read-only STATUS mandatory DESCRIPTION "The number of IP datagrams discarded because no route could be found to transmit them to their destination. Note that this counter includes any packets counted in ipForwDatagrams which meet this `no-route' criterion. Note that this includes any datagrams which a host cannot route...(read more)

What Are Critical Network Problems?

tslattery — Wed, 06 Jul 2011 12:58:00 GMT

What are your critical network problems? Every network has them. They are the problems that cause network outages, or are the precursor to network outages. Most networks have similar designs and have similar critical network problems. I've heard network staff say "our network is unique" and I always think to myself "if that's true, you have unique problems that you probably don't understand". Using well-known configurations allows network vendor technical staff to...(read more)

Device Real-Time Displays

tslattery — Fri, 24 Jun 2011 22:23:00 GMT

I've been doing a number of device configuration changes as a result of the things that NetMRI and syslog are reporting in a customer network. Both NetMRI and syslog have rather long reporting cycles before I know that something was fixed, so I've been thinking about a device real-time display as a nice function to have. NetMRI is not unique in its data collection. Network management systems tend to using a polling mechanism to collect a lot of the data that is displayed. The collection tends...(read more)