Analysing Fast Ethernet | LAN Protocol Analyser | The Basics of E-mail Access | Virtual Private Networks (VPN)
The Fast Ethernet Black Hole
The rapid introduction of Fast Ethernet relieves bandwidth problems, but it may create invisible spots in the network which the administrator cannot monitor or manage effectively. Agents cannot be embedded in current switches, because they consume too many resources at Fast Ethernet speeds and degrade switching performance. Switch monitoring today is primarily counting packets for port statistics - this is done with cheap silicon and imposes no loading on the switch processor. Capturing packets is another matter entirely, cycles and memory are consumed dropping the performance of the switch - even at Ethernet speeds.
External collectors are an effective solution, especially at Fast LAN speeds. They represent a cost effective alternative that has minimal impact on switching performance since all complex data collection functions are outboard of the switch. Further, external collectors are portable, they can be moved to trouble spots, and places permanently at key points, or rotated for periodic baselining.
This problem can only be addressed by high performance, external collectors meeting the performance and cost constraints of most organizations. External collectors can be used for permanent monitoring of key backbone links and high performance server ports. They can also be rotated on a periodic basis throughout the Fast Ethernet infrastructure to provide regular traffic characterization and trending analysis.
Half-Duplex LAN Analysis in Switched 10/100 Networks
LAN analyzers available today can monitor half-duplex links in switched 10/100 networks in two ways: through a "mirror port" on a switch that supports this capability (analyzer "A1" in diagram), or via connection to a hub port which is connected to the switch (analyzer "A2" in diagram).
"Port mirroring" is the ability for a switch to copy data from a switch port to a specially designated port called the "mirror port" (sometimes called the "monitor port"). The analyzer is connected to the "mirror port" with the network manager specifying which switch port(s) to mirror. This solution gives the network manager great flexibility since one analyzer can be used to monitor all segments on a switch, though not simultaneously.
For switches that do not support "port mirroring", an analyzer can be used to monitor a single switch segment by physically connecting the analyzer to a hub port on the segment to be monitored. In order to monitor another segment, the network manager would have to reconnect the analyzer to the second segment.
Full-Duplex LAN Analysis in Switched 10/100 Networks
A major void in LAN analysis today is the inability to cost-effectively monitor full-duplex links. Since a full-duplex connection consists of exactly two devices, there has been no inexpensive way to introduce a LAN analyzer into a full-duplex link without changing the connection to half-duplex.
Attaching a LAN analyzer to the switch's "mirror port" does not address this issue. In this scenario, the analyzer would only be able to capture, at most, one-half of a full-duplex link's capabilities (100Mbps out of 200Mbps maximum). The network manager would then have no visibility of the remainder of the traffic over the full-duplex link.
Introducing The Century Tap Family
Shomiti Systems' Century Tap family represent the first devices to enable network managers to cost-effectively monitor full-duplex 10/100 Ethernet segments using a LAN analyzer. The Century 12-Tap, pictured below, provides a unique way for an analyzer to view traffic on up to twelve 10/100 Ethernet segments while the Century Tap is a single port device. Both members of the Century Tap family are fault tolerant, thus network connectivity is always maintained, even in the event of a device power failure.
The diagram below shows the typical full-duplex deployment scenarios for the Century Tap family: switch-to-server links and switch-to-switch links. The Century Tap family are wiring "taps" for inserting a LAN analyzer into full-duplex links. The Century 12-Tap and Century Tap "listen" to both sides of a full-duplex link and mirrors the data streams to the attached analyzer. What makes the Century Tap family unique are that they do not affect either the performance or the configuration of full-duplex connections. The Century Tap family, compliant with both the 10Base-T and 100Base-Tx Ethernet specifications, do not add a hop count to the full-duplex segment since they are not repeaters - the Century Tap and Century 12-Tap are essentially "Y-cables" for 10/100 Ethernet links.
