network management tools and systems n.
Skip this Video
Loading SlideShow in 5 Seconds..
Network Management Tools and Systems PowerPoint Presentation
Download Presentation
Network Management Tools and Systems

Loading in 2 Seconds...

play fullscreen
1 / 57

Network Management Tools and Systems - PowerPoint PPT Presentation

  • Uploaded on

In the Name of the Most High . Network Management Tools and Systems. by Behzad Akbari Fall 2011. NM Tools and Systems. Network Management Tools Network Statistics Measurement Systems Enterprise Management Systems. Network Management Tools. NOC Tools (RFC 1470). Network Monitoring Tools.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Network Management Tools and Systems' - barth

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
nm tools and systems
NM Tools and Systems
  • Network Management Tools
  • Network Statistics Measurement Systems
  • Enterprise Management Systems
network management tools
Network Management Tools

NOC Tools

(RFC 1470)

network monitoring tools
Network Monitoring Tools
  • Useful list of network monitoring tools


  • Used to assign/read an address to/of an interface
  • Option -a is to display all interfaces
  • Notice two interface loop-back (lo0) and Ethernet (le0)

[/home/teachers/ycchen]ifconfig -a

lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 1

inet netmask ff000000

le0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2

inet netmask ffffff00 broadcast

ifconfig le0 down

ifconfig le0 netmask broadcast

  • Most basic tool for internet management
  • Based on ICMP ECHO_REQUEST message
  • Available on all TCP/IP stacks
  • Useful for measuring
    • Connectivity
    • Packet loss rate
    • Round trip time
  • Can do auto-discovery of TCP/IP equipped stations on single segment
  • An interactive program for querying InternetDomain Name System servers
  • Converts a hostname into an IP address and vice versa querying DNS
  • Useful to identify the subnet a host or node belongs to
  • Lists contents of a domain, displaying DNS record

Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]

[-r count] [-s count] [[-j host-list] | [-k host-list]]

[-w timeout] destination-list


-t Ping the specified host until stopped.

To see statistics and continue –

type Control-Break;

To stop - type Control-C.

-a Resolve addresses to hostnames.

-n count Number of echo requests to send.

-l size Send buffer size.

-f Set Don't Fragment flag in packet.

-i TTL Time To Live.

-v TOS Type Of Service.

-r count Record route for count hops.

-s count Timestamp for count hops.

-j host-list Loose source route along host-list.

-k host-list Strict source route along host-list.

-w timeout Timeout in milliseconds to wait for each reply.


C:\>ping -n 10 -l 256

Pinging [] with 256 bytes of data:

Reply from bytes=256 time=7ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=9ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=9ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=6ms TTL=242

Reply from bytes=256 time=37ms TTL=242

Ping statistics for

Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 6ms, Maximum = 37ms, Average = 9ms


C:\>ping -n 2 -r 5

Pinging [] with 32 bytes of data:

Reply from bytes=32 time=423ms TTL=239

Reply from bytes=32 time=264ms TTL=239

Ping statistics for

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 264ms, Maximum = 423ms, Average = 343ms



  • Used to determine throughput of a link
  • Uses icmp_echo utility
  • Knowing packet size and delay, calculates bandwidth
  • bing L1 and L2 and the difference yields the bandwidth of link L1-L2
  • Puts a network interface in promiscuous mode
  • Logs data on
    • Protocol type
    • Length
    • Source address
    • Destination address
    • Reading of user data limited to superuser

C:\>netstat -n -a

Active Connections

Proto Local Address Foreign Address State










UDP *:*

UDP *:*

UDP *:*

UDP *:*

UDP *:*


NETSTAT [-a] [-b] [-e] [-n] [-o] [-p proto] [-r] [-s] [-v] [interval]

-a Displays all connections and listening ports.

-e Displays Ethernet statistics. This may be combined with the -s


-n Displays addresses and port numbers in numerical form.

-p proto Shows connections for the protocol specified by proto; proto

may be TCP or UDP. If used with the -s option to display

per-protocol statistics, proto may be TCP, UDP, or IP.

-r Displays the routing table.

-s Displays per-protocol statistics. By default, statistics are

shown for TCP, UDP and IP; the -p option may be used to specify

a subset of the default.

interval Redisplays selected statistics, pausing interval seconds

between each display. Press CTRL+C to stop redisplaying

statistics. If omitted, netstat will print the current

configuration information once.


C:\>netstat -s -p TCP

TCP Statistics for IPv4

Active Opens = 904

Passive Opens = 13

Failed Connection Attempts = 25

Reset Connections = 189

Current Connections = 3

Segments Received = 61946

Segments Sent = 53891

Segments Retransmitted = 249

Active Connections

Proto Local Address Foreign Address State










TCP 94ASUS3705:4558 localhost:4559 ESTABLISHED

TCP 94ASUS3705:4559 localhost:4558 ESTABLISHED


C:\>netstat –r C:\>route print


Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 12 f0 2b b8 0b ...... Intel(R) PRO/Wireless 2200BG Network Connection

- Packet Scheduler Miniport

0x3 ...00 01 4a 82 13 e8 ...... Intel(R) PRO/100 VE Network Connection - Packet

Scheduler Miniport



Active Routes:

Network Destination Netmask Gateway Interface Metric 20 1 20 20 20 20 1 2 1

Default Gateway:


Persistent Routes:


traceroute tracert


Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name


-d Do not resolve addresses to hostnames.

-h maximum_hops Maximum number of hops to search for target.

-j host-list Loose source route along host-list.

-w timeout Wait timeout milliseconds for each reply.



Tracing route to []

over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms []

2 <1 ms 1 ms <1 ms []

3 <1 ms <1 ms <1 ms []

4 <1 ms <1 ms <1 ms []

5 2 ms 1 ms 1 ms []

6 6 ms 3 ms 3 ms

7 3 ms 3 ms 2 ms []

8 4 ms 4 ms 5 ms []

9 6 ms 6 ms 6 ms []

10 6 ms 6 ms 6 ms

11 56 ms 19 ms 6 ms

12 59 ms 60 ms 60 ms

13 66 ms 74 ms 70 ms []

14 62 ms 61 ms 62 ms []

15 60 ms 62 ms 61 ms []

16 62 ms 62 ms 60 ms

17 60 ms 60 ms 60 ms

18 63 ms 60 ms 62 ms []

Trace complete.

network management tools1
Network Management Tools
  • SNMP command tools
  • MIB Walk
  • MIB Browser
  • snmpsniff
snmp command tools
SNMP Command Tools
  • snmptest
  • snmpget
  • snmpgetnext
  • snmpset
  • snmptrap
  • snmpwalk
  • snmpnetstat
network status
Network Status
  • Command: snmpnetstat host community
  • Useful for finding status of network connections

% snmpnetstat noc5 public

Active Internet Connections

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp 0 0 *.* *.* CLOSED

tcp 0 0 localhost.46626 localhost.3456 ESTABLISHED

tcp 0 0 localhost.46626 localhost.3712 ESTABLISHED

tcp 0 0 localhost.46626 localhost.3968 ESTABLISHED

tcp 0 0 localhost.46626 localhost.4224 ESTABLISHED

tcp 0 0 localhost.3456 localhost.46626 ESTABLISHED

tcp 0 0 localhost.3712 localhost.46626 ESTABLISHED

tcp 0 0 localhost.3968 localhost.46626 ESTABLISHED

tcp 0 0 localhost.4224 localhost.46626 ESTABLISHED

tcp 0 0 noc5.41472 noc5.4480 ESTABLISHED

tcp 0 0 noc5.41472 noc5.4736 ESTABLISHED

tcp 0 0 noc5.4480 noc5.41472 ESTABLISHED

tcp 0 0 noc5.4736 noc5.41472 ESTABLISHED

snmp browser
SNMP Browser
  • Command: snmpwalk host community [variablename]
  • Uses Get Next Command
  • Presents MIB Tree
snmp sniff
SNMP Sniff
  • snmpsniff -I interface
  • A tool in Linux / FreeBSD environment
  • Puts the interface in promiscuous mode and captures snmp PDUs.
  • Similar to tcpdump
protocol analyzer
Protocol Analyzer
  • Analyzes data packets on any transmission
  • line including LAN
  • Measurements made locally or remotely
  • Probe (data capture device) captures data and transfers to the protocol analyzer (no storage)
  • Data link between probe and protocol analyzer either dial-up or dedicated link or LAN
  • Protocol analyzer analyzes data at all protocol levels
rmon probe
RMON Probe
  • Communication between probe and analyzeris using SNMP
  • Data gathered and stored for an extended period of time and analyzed later
  • Used for gathering traffic statistics and used for configuration management for performance tuning
network statistics
Network Statistics
  • Protocol Analyzers
  • RMON Probe / Protocol analyzer
  • MRTG (Multi router traffic grouper)
  • Home-grown program using tcpdump
nms deisgn
NMS Deisgn
  • Key Requirements:
    • Scalability
    • Heterogeneity
    • Geographic Spread
    • BurstyLoad
    • Real time Response
    • Batch Processing
    • Diverese Users
    • Local and Remote Management
    • Ease of Use
    • Security
    • Data Management
enterprise management
Enterprise Management
  • Management of data transport
    • IBM Netview, Sun Solstice, HP OpenView, Cabletron Spectrum
  • Systems management
    • CA Unicenter and Tivoli TME
  • Network and systems management
    • Partnerships
  • Telecommunications management
    • TMN, Operations systems
  • Service management and policy management
network monitoring
Network Monitoring
  • By polling
  • By traps (notifications)
  • Failure indicated by pinging or traps
  • Ping frequency optimized for network load vs. quickness of detection
  • trap messages: linkdown, linkUp, coldStart, warmStart, etc.
  • Network topology discovered by auto-discovery
node discovery in a network
Node Discovery In a Network
  • Node Discovery
    • Given an IP Address with its subnet mask, find the nodes in the same network.
  • Two Major Approaches:
    • Use ICMP ECHO to query all the possible IP addresses.
    • Use SNMP to query the ARP Cache of a node known
use icmp echo
  • Eg: IP address:

Subnet mask:

  • All possible addresses:
    • ~
  • For each of the above addresses, use ICMP ECHO to inquire the address
  • If a node replies (ICMP ECHO Reply), then it is found.
use snmp
  • Find a node which supports SNMP
    • The given node, default gateway, or router
    • Or try a node arbitrarily
  • Query the ipNetToMediaTable in MIB-II IP group



ipNetToMediaIfIndex ipNetToMediaNetAddress

1 00:80:43:5F:12:9A dynamic(3)

2 00:80:51:F3:11:DE dynamic(3)

network discovery
Network Discovery
  • Network Discovery
    • Find the networks to be managed with their interconnections
  • Given a network, find the networks which directly connect with it.
  • Recall that networks are connected via routers.
  • Major Approach
    • Use SNMP
discovering networks
Discovering Networks

a network discovery algorithm




ipAdEntNetMask 1 … 2 … 3 …

A Network Discovery Algorithm

1. First use a node discovery algorithm to find all the nodes in the network.

2. For each discovered node, use SNMP to query the ipAddrTable of MIB-II IP group

3. Query the corresponding entries in ipRouteTable to verify the above addresses

layer 2 topology discovery
Layer 2 topology discovery
  • Useful MIB variables for Layer 2 discovery (RFC 1493)
    • dot1dBase-NumPorts to find the number of ports on each switch
    • dot1dStpPortTable to find the topology of the extended LAN
    • dot1dTpFdbTable to find the MAC address of the machines connected to each port
commercial and open source nmss
Commercial and Open Source NMSs
  • Management functions that must be supported by NMSs:
      • Configuration management
      • Fault management
      • Performance management
      • Accounting management
      • Security management
commercial and open source nmss1
Commercial and Open Source NMSs
  • Open source NMSs
    • OpenNMS
      • Currently supports Fault, Performance and parts of Configuration in FCAPS
      • Does not have a graphical map for the display of the NEs and their status
    • Nagios
      • Provides basic network management functions
      • It has graphical mapping of network elements
  • Enterprise NMSs
    • Hewlett-Packard OpenView
    • Sun SunNet Manager
    • IBM Netview
  • System & Network Management
    • Computer Associates Unicenter TNG
    • Tivoli TME / Netview