The Network Zone

Will the Cisco Cius Make Desktop Video Conferencing Mainstream?

2010-08-02T15:34:00.001-04:00

With the Cisco Cius product launch, the age of desktop video conferencing may well be emerging. The Cisco Cius is an ultra-portable, mobile collaboration business tablet that offers access to essential business applications and technologies.

The early adaptors are likely to find making video conferencing calls within an organization extremely easy and become hooked on the experience.

To read the full post, please visit the new location of our blog and start following us there. We recently revamped our website and have moved locations. We look forward to you visiting.

The iPad in Action

2010-06-18T15:41:00.001-04:00

I wrote a post some time ago about the potential of the iPad to help manage networks. Since then, I’ve grown much more excited about its potential as a business tool.

The iPad is such a powerful tool for IT administrators because it is much more convenient than a netbook. It is lighter and thinner, can be used instantly and has a large display area – a powerful combination for remote networking.

I’ve been using the iPad myself with the new version of dopplerVUE 2.1 and its web client capabilities. The display is perfect for the powerful visualization features of dopplerVUE. I can clearly display and monitor network status and performance by combining maps, charts and gauges into a single dashboard. If you want to give it a try for yourself, download the 30 day free trial version.

The iPad is a great tool while you’re on the go. Some tasks are always going to be much easier to address with the computer on your desk. But in my mind there is definitely a place for the iPad in terms of network management. If you’re using the iPad for IT management, it would be great to hear about your experience.

A Network Management Resource...

2010-06-11T13:41:00.000-04:00

I came across a network management website that I thought was worth sharing. See what you think.

Network Management Software is a source of news, analysis and reviews of the IT network management space. The website is solely focused on the network management space and offers great tips on the basics of network management and the fundamentals on application monitoring.

Also keep in mind that dopplerVUE recently added application centers for Exchange, IIS and SQL in its new 2.1 release and is available for download.

3 Keys to Achieving Optimal IIS Performance…

2010-06-04T12:07:00.000-04:00

Monitoring the Microsoft Internet Information Server (IIS) is something I take pretty seriously. As one of the most relied upon and mission-critical web infrastructures for eCommerce websites, web applications, intranet portals and corporate websites – it is definitely a mission critical application and there will be some crazed phone calls if the service goes down.

I monitor IIS for two main reasons - to troubleshoot performance problems on the server and to improve server performance. When I’m able to optimize server performance and save money by reducing costs on additional servers and hardware it is always a big plus.

Here are three steps for achieving optimal performance (for additional details read this article):

1. Monitor Memory and CPU Usage
It is critical to monitor memory and CPU usage and to take any steps necessary to reduce the load on the server. Other processes operating on the server could be using memory and CPU resources needed by IIS. If this is the case, stop non-essential services and move support applications to a different server.

2. Resolve Hardware Issues that Cause Problems
Slow disk drives can delay file reads, if that is the case improve the disk input/output (I/O). Also install additional network cards, if the current ones are fully optimized to ensure you can perform critical activities such as back-ups.

3. Optimize Web Pages and Applications on IIS
Make sure to test web pages and IIS applications to ensure the source code executes as expected. Take the time to eliminate unnecessary procedures and optimize inefficient processes.

To fully optimize IIS, you have to do some testing and go through some trial and error until you get everything tuned properly. It is definitely worth the time.

If you don’t want to use a bunch of disparate tools to monitor such a critical server and application, try out dopplerVUE 2.1 for a 30 day free trial. dopplerVUE’s IIS application center lets you display system responsiveness, application services, server and application utilization and alarm conditions all in a single window.

Why Keep Using IE6? 5 Reasons Some People Have Not Upgraded

2010-05-28T11:41:00.000-04:00

Network world has an interesting article about how Microsoft is pushing hard to get everybody off of IE6. They describe some really good reasons to upgrade. It got me thinking about why people still have the IE6 browser at all?

With a bit of research, here are the top reasons why so many people still have IE6:

1. Certain commercial apps do not support newer versions of IE without major upgrades. With funds for maintenance and upgrades slashed during the recession, it may be very difficult to obtain the necessary dollars to get the latest version of vendor software that supports new versions of IE.

2. Some internal apps do not support newer versions of IE. IE 6 offered a proprietary API that is not the same as current versions. If your development team has moved on or did not upgrade, the necessary knowledge of how to upgrade your application may now be missing.

3. IE6 uses less RAM then later versions – installing a new browser version may require you to upgrade the hardware or sacrifice the performance of other more critical applications. This cost factor encourages some to delay the upgrade.

4. Long refresh cycles – some industries do not refresh their technology until about 5 to 7 years of usage. Those of us in technology live around it and want the latest and greatest but, not everyone needs the most advanced technology immediately.

5. This does leave out the groups of people who simply have not upgraded because they don’t care to do any updates and those who ignore all new browser versions for various reasons.

If you haven’t made the leap, consider evaluating your situation and creating an upgrade plan that gets you off of IE6 before 2014 when Microsoft stops supporting XP and IE6. After that, no more security patches for new vulnerabilities.

Four Resource Bottlenecks to Monitor in SQL Server 2008 for Better Performance

2010-05-21T09:40:00.000-04:00

Looking to improve Microsoft SQL Server performance? I've found that resource bottlenecks are often the the most common issues with SQL Server 2008 performance. You can monitor SQL Server performance with a range of tools built into the server. In my experience four main culprits are often the key to finding, monitoring and resolving SQL Server 2008 performance issues.

1. CPU Bottlenecks
Monitoring the CPU load can identify systems that are over worked. Generally, when a processor sustains a rate above 80% the condition should be evaluated and the usage reduced. While you can buy more hardware, you should also look at the queries consuming the most load and attempt to optimize CPU consumption.

Metrics to monitor:
Processor:% Processor Time: Sustained above 80% indicates a problem

2. Memory Bottlenecks
There are multiple ways in SQL server and the base OS to use or reserve memory. It is important to monitor the overall physical and virtual memory to ensure it is not fully allocated. When the memory is fully utilized, your system works harder to move items around and is less efficient, resulting in a slower system.

Metrics to monitor:
Memory: Available MBytes: less than 50-100 likely indicates a problem but, you may need to see how your local system responds in relationship to the available memory for a more precise number
Monitor the windows event log for errors that indicate the virtual memory has run low

3. Disk I/O Constraints
The SQL server reads and writes to the database on a regular basis. A slow response during processing can result in decreased SQL performance. Improving the disk I/O with hardware is one solution, but you should also ensure that memory problems are not making the problem worse. In addition, consider data compression strategies and review query plans for missing indexes with the database tuning advisor to improve performance.

Metrics to monitor:
PhysicalDisk Object: Avg. Disk Queue: When operating regularly above 2 this indicates an I/O bottleneck
Avg. Disk Sec/Read & Avg. Disk Sec/write: Less than 20ms is normally fine, but beyond 30 is likely to cause slowdowns.
Physical Disk: %Disk Time: Numbers above 50% indicate an I/O bottleneck

4. TempDB Issues
The tempDB provides a storage place for objects, tables and stored procedures. The tempDB can affect both performance and disk space usage which can reduce the efficiency of the SQL Server and any other applications running on the same server.

Metrics to monitor:
Space used: Ensure this does not exceed 80% utilization.
Free Space in tempdb: Monitor and evaluate the proper levels for baseline operations.

I've found that monitoring these four common resource issues can help troubleshoot and resolve many common SQL Server 2008 bottlenecks. If you don't have time to use a range of tools to monitor all these metrics, consider a solution that provides an integrated view of all the SQL Server metrics that you need. dopplerVUE is a network management solution with an SQL application center that displays system responsiveness, application services, server and application utilization and alarm conditions all in a single window.

Cisco Tech Days – Don’t Miss Out

2010-05-14T17:34:00.000-04:00

Want to get the inside scoop on network technology straight from the network experts? Cisco is hosting its Tech Days series throughout the month of May and into June in several cities throughout the country. I’ve attended the sessions in the past and found them to be very useful. Viewing demos, hearing about product roadmaps and features from the horse’s mouth is very helpful.

The hot topics this year include borderless networking, virtualization and collaboration technologies. Find out how the newest innovations can help you develop strategies and deploy solutions to make your network more efficient and effective.

Get the full details here for all the locations and dates. If you’ll be attending the event on May 26th in McLean, VA or the June 9th event in San Francisco, CA let me know. It would be great to meet up and discuss some of these latest networking trends.

Application Problems and Downtime – Avoid the Pain

2010-05-06T17:24:00.000-04:00

Whether it’s the email system, web infrastructure or your database backend – downtime can make your blood pressure rise. I’ve seen the support calls come in when a server and application goes down that is mission critical.

That’s why I’m so excited about the new release of dopplerVUE 2.1. Application centers have been added for Microsoft® Exchange, Microsoft® IIS and Microsoft SQL Server® applications. These monitoring centers provide detailed information about the overall health of an application, including its hardware and software dependencies.

dopplerVUE displays responsiveness, application services, server and application utilization and alarm conditions in a single view. Take a look at the screenshot below.

Interested in getting more insight into your Exchange, IIS or SQL server and applications? Try
dopplerVUE 2.1 free for 30 days.

7 Key Considerations for Managing Exchange Server Health and Status

2010-04-29T11:04:00.001-04:00

In my experience application problems are often a factor in downtime making monitoring mission critical. Trying to resolve application performance issues is no easy task. Troubleshooting requires that you test and validate the different application layers and dependencies like the network, server and application performance to determine the cause of the problem and solve it. For applications like Exchange server, there can be a fair number of items to evaluate. Here are some of the items you want to evaluate when troubleshooting Exchange Server or monitoring its health and status.

Application Monitoring in dopplerVUE 2.1 Available Soon
In early May the new release of dopplerVUE 2.1 will be available with application monitoring capabilities. In a single window it will display system responsiveness, application services, server and application utilization and alarm conditions. An early preview is provided below with a screenshot. The screenshot shows Exchange monitoring displaying average delivery time in milliseconds and queue size at zero with more metrics in the same window.
Be on the look out for an email letting you know more details about the release and its availability.

Interop 2010 - Video Conferencing and Blazing Fast Switches

2010-04-28T18:13:00.000-04:00

It’s that time of year again. I’m in Vegas for Interop reviewing all the new technology and emerging trends. Thought I’d share a few insights from the show.

This year, I’m struck by the number of video conferencing vendors that are at the show. The quality of the technology is incredible and both the service and the equipment are getting more cost-effective. If your company has multiple offices it’s definitely worth considering. On the tech side, there are new blazing fast switches that have been built to keep up with the increased load from the usage of video on networks. Very impressive stuff.

The best booth so far has to be Xirrus, primarly because of the live boxing (picture below). They did a great job getting me to pay attention to their pitch and not mind it one bit. Huge crowds and well it was fun. Kudos to that marketing team!

The Changing Face of the Network: The User and IT Perspective

2010-04-16T12:48:00.000-04:00

Is 2010 going to be a year of huge change for the network? With the increasing use of video conferencing, web 2.0 and other emerging technologies, will users demand that the network and IT better support these performance hungry services?

Loudhouse Research, a UK based firm thinks so based on a survey of 152 IT decision makers in companies with 1000+ employees. The trend would tie the business to the network and the network engineer to the user more closely than ever before. The key question – is the network ready for these services? The user and IT perspective on the challenges with the network today can be viewed in the chart below.

An interesting difference of opinion is in terms of performance which is at the heart of the network and new services.

I agree with the trend that Loudhouse points out is coming, but I’m not as sure about the timeline. What do you think? Do you see these changes in your organization?

We do know that the network is constantly changing, so it’s always better to be prepared. In my experience I’ve found it to be helpful to use tools, such as dopplerVUE to manage the network to make sure users are satisfied with performance and that IT is aligned with the goals of the business. There is a free 30 day download available if you’re interested in trying it for yourself.

Network Management Becomes Critical for Smart Residences…

2010-04-06T18:31:00.000-04:00

I’m sure you hear it all the time – we are becoming a more network centric world. Is this just hype? I don’t think so and a recent customer example, I think proves the point.

Used to be only really large organizations worried about network uptime and cyber security. These days the network is so critical to revenue and productivity that mid-sized and smaller organizations are facing the same issues.

Now the network is even vital in high-end residences. As more residential networks pop-up and data networks are joined by home security and advanced audio video systems -security and uptime become a much more serious issue.

A great example is Certified Cyber Solutions (CCS) a company that provides a product SAM (Secure Access Manager) that helps installers and resellers of residential systems that employ IP networks, such as audio/video, home security and “smart home” systems to protect their customers from cyber threats.

CCS is using dopplerVUE as their network monitoring platform to enable their SAM product (screenshot below). dopplerVUE’s unique architecture allows maximum flexibility to customize data collection and data display, making it uniquely suitable for CCS and other hardware and software manufacturers who need an uptime monitoring, diagnosis, cybersecurity and compliance component to their products.

With predictions that there will be 215 million IP enabled devices by 2012, it’s clear that network monitoring will become a more critical activity for the mainstream. Seems like the world is becoming more network-centric one device at a time. Do you see the trend as well?

Comparing Solarwinds & dopplerVUE Layer 2 Switch Port Mapping…

2010-03-26T10:05:00.004-04:00

When a customer calls with a problem, I often start the troubleshooting process by validating the connection. I start at the switch port and cable level. This process can be time consuming and challenging because you have to find the specific port a user or server is connected to on the network by checking the cable or manually connecting to a switch. Who has time for that lengthy process?

Fortunately, several tools now have layer 2 switch port mapping capabilities. I recently watched a demonstration of Solarwinds and dopplerVUE’s layer 2 switch port mapping capabilities and found them to be quite different despite the same name. The Solarwinds toolset provides very basic functionality. It identifies the switch port a device is connected to and it’s up/down status.

In a nutshell, here are four reasons to consider dopplerVUE over Solarwinds.

dopplerVUE’s layer 2 switch port mapping delivers:

the same and added functionality vs Solarwinds
complete mapping in 4 steps vs the 7 steps required by Solarwinds. That’s half the work and time.
a simpler process - there is no need to memorize the switch/router and community strings
a view of what is connected with how it is performing in a single dashboard (screenshot below)

The dopplerVUE screenshot below displays a complete device view including the switch port it is connected to, it’s current up/down status, the amount of traffic over the interface and any alert conditions. If you want to view a switch and a list of every connected item, simply choose the switch name instead of the end target device name.

I’ve provided a comparison of the steps and process to use each product below. Feel free to check out the steps for yourself by downloading a free trial of dopplerVUE.

The Right Network Dashboard Can Make All the Difference

2010-03-19T11:06:00.001-04:00

I’ve found that dashboards can be a huge help when managing the network, so I wanted to share some thoughts on the topic. A picture can be worth a thousand words in my experience. The dashboard I use (see below) makes it easy at a glance to see the status of the network and drill down into device details and troubleshoot network problems.

Of course setting up a dashboard that really provides value can be a time consuming process. To make the process easier, I’ve found it helpful to decide up front what elements are most important to display and then create the dashboard. Another key step is picking the right tool to create your dashboards. Three key questions can assist you in picking the right tool and avoiding confusion and disappointment later in the process.

1. How easy is it to create a dashboard? (Does it require importing or code?)
2. Can it mash-up network topology maps, performance data and alarm data?
3. Does the drill down capability provide for rapid jumping to detailed device/alarm data?

So why are dashboards so valuable? I’m able to display the information that helps me manage the network more effectively. For example, the screenshot of my dashboard below shows a distributed site. When managing across a WAN, I add elements into my dashboard that include where the alerts are, what type of network services are potentially impacted and the overall health and status of the network (bandwidth, router CPU load, etc). My dashboard shows all of these elements, and also goes a few steps further by including a network topology map, the top alarmed devices and customized pieces that show response time and availability of a specific website.

Depending on your specific situation, the dashboard capabilities can extend across multiple systems or take a deep dive into a single service provided by an IT organization. For example, an application dashboard would have a blend of device status, applications status, application services, and status of key dependencies all on a single page.

The dashboard that I’ve included was created with dopplerVUE my network management system of choice. If you’re interested in easily creating a custom dashboard give it a try by downloading the 30-day free trial.

Have you heard the Buzz?

2010-03-16T13:41:00.001-04:00

Lately, many Gmail users have noticed a new option right below their Inbox that says “Buzz”. If you’re like me, you probably read the quick Google summary and then ignored it while you took care of your email. I finally decided to investigate Buzz a few days ago, and after hearing some colleagues expressing confusion about this new feature, thought I would address a few questions I’ve heard over and over:

What is it?
Google Buzz is similar to an RSS feed, except that it integrates all of your social networking data into one area, while also serving as a messaging tool. Buzz users can share things such as status updates, comments, video and pictures, which makes it fairly similar to Facebook and Twitter. The difference? Instead of going to different apps or sites to check all of your profiles, you can combine it all in Buzz.

Why do I need it?
Those of you that use social networking sites and like integration and consolidation will get the most use out of it. If you’re already using Gmail, Buzz is right there for your convenience. It’s also handy for those who love mobile apps. However, you must have an iPhone/iPod Touch, Windows Mobile, Android 2.0, Openwave or S60, for Buzz to work on your mobile device.

Side note- For those thinking of using Buzz with a supported mobile device, it can integrate your posts with Google Maps so that you can see your location and others around you using Buzz (similar to Google Latitude).

Are there privacy features?
While this is a question I’m still trying to gather all the details on, Buzz didn’t have stringent privacy features at first. However, after Google was threatened with multiple lawsuits in February, they added a few privacy features. There is an option to make your Google profile private, so that you don’t show up in directories and/or searches. You can also choose the sites that you want to link with for your contacts/followers to see, so you control the information you share. Choosing contacts is also completely in your control, and while Google will suggest people from your Gmail contact list, you have the option to add, ignore or even block them. As added value, you can also view who’s following you and choose how you want to react (add, ignore or block), so you can keep tabs on who can see your information.

What type of stuff can I integrate?
Sites currently integrated: Twitter, YouTube, Flickr, Picasa, Google Reader and Blogger.

Can Buzz benefit an IT or Network Manager?
Sure, if you use Gmail (or want to start) and use any of the integrated sites to communicate with others for IT or networking purposes. For instance, if you notice you’re having bandwidth problems, you could Twitter about it to notify your coworkers or get advice from your followers and also upload a screenshot of your network stats to Flickr so everyone can see details. Both of those examples can be done directly from within Buzz- no need to go to the Twitter website and Flickr website separately. You could also then use Buzz to tap into your Google Reader to look for tips to help increase your network speed or manage your bandwidth more efficiently.

For those of you that love to try out new tools and software, Google Buzz is an efficient venue for sharing information and opinions quickly. Again, being able to do the majority of your sharing within one area (Buzz) is the key.

Since Google Buzz is still pretty new, the adoption rate isn’t as high as Facebook, Twitter or any other mediums of the same nature. However, as Google tweaks it and integrates with additional sites, I can see how convenient it may turn out to be. In an age of information overload, consolidation can really cure a headache!

Is anyone currently using Google Buzz? What do you think of the overall user experience? Any tips to add?

The iPad – The Network Manager’s Friend or Foe?

2010-03-12T09:14:00.000-05:00

So I’ve heard all the buzz about the iPad - pretty much impossible to avoid unless you live in a cave. Other than the unfortunate name, I’m intrigued by the technology and its potential to make managing a network a bit easier. I haven’t bought one yet, since I’m still determining, if it’s a network manager’s friend or foe at the moment.

On the plus side, from what I’ve read due to its size, it is much better than carrying around a larger laptop to monitor, troubleshoot or configure network devices. You could easily load ebooks to help you with troubleshooting in real-time. It definitely beats heading over to the office desk to grab a book for reference.

On the negative side, the iPad could easily become a security concern on the wireless network without antivirus and firewall protection. Connecting a device that is geared for personal use into the network could have some serious consequences. The usefulness of the iPad will also be dependent on the applications that are developed to help monitor the network.

Sounds like there is still some development work to be done from a security standpoint before the iPad is ready for prime time for network managers. That being said, as the technology matures and security concerns are resolved it could become a very helpful tool. Are you using the iPad? What do you think?

Avoid Traffic Headaches on the Road and in your Network

2010-03-03T12:30:00.002-05:00

Traffic congestion on the way to work is a sure way to get an immediate headache. That is why I’m a big fan of viewing live traffic patterns from my smart phone. I get a live view of traffic that shows which routes are congested and clear. With this information, I arrive at the office much faster and in a better state of mind (my co-workers agree).

Wouldn’t it be nice if finding congestion in network traffic was as simple as flipping on your smartphone and pressing a couple of buttons? Maybe someday. In the mean time, to make life as simple as possible, I use dopplerVUE which has Netflow built in, so I can look deep into routers and capture rich details about what types of traffic, which IPs are talking and how much bandwidth is being used. Take a look at dopplerVUE in action below. You can try it out free for 30 days.

If you don’t have access to tools like dopplerVUE, there are free tools that can help you as long as you’re willing to invest the time.

There are basically two types of techniques to monitor congestion - packet monitoring and packet capturing. I’ve listed some free tools for both methods below.

Packet Monitoring
Packet monitors watch the number of packets whizzing by and tell you a little bit of information about them, such as the number of packets and if there are any errors in the packet. But that is about it, you don’t get much more detail. So this method is good for watching long term trends.

1) For Windows users, look at the network interface properties. The display shows you packets sent and received. This is an easy way to see if your interface is working.

2) The Windows command line provides a number of useful tools to determine the performance of your TCP/IP connection. The Netstat command can give you details about each TCP connection including how many packets have been processed. Below is the result of a netstat –e command.

A list of the most common communications related commands available for the Windows command line are listed below:

Packet Capturing
Packet capture actually stores a copy of each packet that comes by which allows you to look at all characteristics of the packet. But all this detail comes with a down side - it will eat up storage space very quickly. So this method is best to capture a small sample of traffic for deep analysis.

1) For packet capture, the gold standard for open source tools is Wireshark. Here is a screenshot of a packet capture done with Wireshark on my laptop. As you can see, every packet is listed with full details about source and destination address, protocol type and data contents.

Wireshark is one of many open source tools that leverage the Winpcap tool for network monitoring. A list of tools that use Winpcap can be found here.

2) Windows server users have access to a similar tool called Network Monitor that helps monitor network traffic. Below is a screenshot of Network Monitor in action.

I hope these tools help you avoid congestion on your way to work and in your network.

Where are the best jobs in IT going to be in 2010?

2010-02-23T12:03:00.000-05:00

Are network related jobs going to be hot in 2010? Looking for an answer to the question, I turned to Network World’s article on the 10 best IT jobs right now. With all the talk of security and virtualization, I was wondering if network related work would make the top 10.

The job of network engineer came in at number four on the list. According to Gartner, interest in networking, voice and data communications technologies increased for 2010, meaning skills in that high-tech area will also be in demand. With the need for social interactions and collaboration, network skills still remain hot.

I’m sure one of the reasons being a network engineer is one of the best jobs is because of all the great network management solutions that make life easier (I’m of course biased). Take for example, the solution I use – dopplerVUE. The software is installed and up and running in less than 30 minutes. It’s great - I get to start working on what I do best as soon as possible. Once installed, the package offers integrated fault, performance and auto-updating discovery across devices, apps, servers and services. Take a free test drive if you want to make your life a little easier.

Some other jobs that made the top 10 included security specialist, virtual systems manager, capacity manager, open source specialist, service assurance manager, electronic health records systems manager, sourcing specialist, service catalog manager and business process manager. Some of these jobs make sense considering the new technology trends, but I’ll admit some took me by surprise. What do you think of some of these jobs? Do you have any nominations for the best IT jobs?

Battling Blizzards

2010-02-10T12:47:00.002-05:00

Back in the fall I posted about prepping your network for winter weather disasters, and it looks like those tips really came in handy for many this season. Today, the majority of the East Coast is battling a severe blizzard complete with 1-2ft of snow (4-8ft drifts!), 60mph winds with whiteout conditions, power outages and fallen trees. Each one of these factors pose a challenge to your business and your network. For my co-workers in our Washington DC offices, this is the third blizzard this winter, but they have managed to avoid communication and network failures. For those that may not have been hit with a weather disaster yet, you may want to take some time to review these tips to get a head start on future storms:

Questions you should be able to answer:

1. Are you aware of your power situation?
a. What happens when a power outage occurs?
b. What is the operational status of the UPS system?
c. How long will the UPS backup systems sustain key functions?
d. What do we do if the outage is longer?

2. What if the building becomes unavailable? (fire or water damage)
a. Are the offsite backups current?
b. If a network device or server is ruined, what is the procedure to replace it?
c. Does everyone know the primary and secondary facility contacts to use should an after-hours emergency occur?

3. What if access to the building is limited? (snow, tornado warnings, etc)
a. Is VPN access updated for all employees that may need to work from home?
b. Can all of the required maintenance procedures be done remotely or skipped for several days?

4. What if the phone and/or Internet connection is lost?

5. What is the customer impact when any of these conditions occur?

A few tips:

Advance planning is the best approach. A good network design can minimize the impact of storm and disaster related problems. Having redundant phone and data lines from different carriers minimizes the inbound/outbound traffic risk. Using an adequate number of UPS devices mitigates all but very lengthy power outages and network routing protocols like HSRP reduce the risk of single device point of failures.

Even monitoring your network with disaster prevention in mind can be helpful in avoiding unnecessary failures. These tips are a great starting point:

1. Enable redundant polling of critical devices

2. Map out HSRP primary and secondary links

3. Know the status of the UPS systems

4. Make sure you have 24x7 access to your management system client

And for fun (and to get the sympathy of those without 3 feet of snow on the ground), here’s what three blizzards in a row will do to you (and your network!):

Prepare for the New CCNP Tests with FREE Training Books, Videos and Cert Kits

2010-02-08T14:36:00.001-05:00

Cisco Press will be giving away 50 copies of its new CCNP Cert Kits and other study guides to help you prepare for the revised CCNP certifications. The mega giveaway is being sponsored by Cisco Press on Network World’s Cisco Subnet – a community website.

The chances are really high that if you enter, you will win something. All you need to do is find some words that form a specific sentence in various chapters that are provided and enter the response. Not too much work for some free study materials. The contest ends March 31. Register to win one of 10 copies of the following titles:

CCNP Route Cert Kit (Read excerpt.)

CCNP Switch Cert Kit (Read excerpt.)

CCNP Tshoot Cert Kit (Read excerpt.)

CCNP Routing and Switching Official Certification Libraries

CCNP routing and Switching Quick Reference printed bundle

Good luck and hope you win!

Improving Network Discovery by using SNMP OID Include/Excludes

2010-02-04T11:33:00.000-05:00

An issue that frequently comes up for IT managers is the need to find only certain types of devices within a heterogeneous network that contains many types and manufacturers of networked devices. I recently worked with a customer that wanted to locate about a hundred Windows Servers from a network that contained several thousand devices.

One way to approach this task is to discover all the devices, then pick out the ones you are looking for, the old needle in the haystack routine. This approach is time consuming and error prone. A better method is to leverage the information available from devices that support the SNMP protocol, which includes most operating systems. SNMP includes an object library of OIDs (Object Identifiers) that are set up by each manufacturer. A Google search for “Windows OIDs” found this site which listed the OIDs to identify Microsoft Server Operating Systems.

As you can see (table below), the OIDs are built in a hierarchy so, if I could search my network for servers which contain the OIDs below for workstations, servers and domain controllers, I should find all my Windows Server boxes.

You can make the difficult task of finding and sorting networked devices much more manageable. I use dopplerVUE, a network management tool that simplifies the whole process and helps find the needle in the haystack faster and without issues.

dopplerVUE provides an OID include/exclude discovery feature that makes it easy to accomplish this task.

Here are some steps for using dopplerVUE to improve the network discovery process. To get started the server must have the SNMP agent service running and you need the credentials (called a community string) to enter in the SNMP service “security” tab. Most servers use “public” as a default and are case sensitive. SNMP service is usually turned off by default, so you’ll need to restart the service when you are done making changes.

Once you have the servers set up, you should create a discovery job within dopplerVUE to find the Windows Servers. dopplerVUE provides a discovery wizard that guides you through the step by step process as follows:

Step 1: Select a discovery method appropriate to the task. Use an IP address range that provides the most control over your discovery results.

Step 2: Set an IP range that includes the Windows Servers you are looking for in your search. Be careful, the larger the range you select, the longer it will take to complete the discovery.

Step 3: Select SNMP protocol.

Step 4: Enter the community strings for the servers. Your admin can provide these and you can always use public which is set as default on most servers.

Pictured below is a tab marked “Show sysObjectID include/exclude options”. You can click on the tab, expand the Window and then select “include”. You can then enter the OIDs we found earlier.

Step 5: In the workstation column you’ll want to select SNMP poller and then Host MIB if you want to collect information about processor utilization, memory usage and disk space.

Step 6: Optional: Enter a name and description for this discovery job.

Now you can click finish and go to the Inventory>Discovery Jobs tab to watch the progress of the task. The job will start automatically assuming your dopplerVUE discovery service is running and you had the “run now” checkbox selected in step 6. If not, click on the job and start it.

You can watch the progress in the job details section and keep an eye on your inventory tab to see if new devices are being found. When new devices are found, they should appear in the workstation classification. You can change classifications or create new ones easily by right clicking on the objects in the workstation classification list.

This technique works for any search where you can separate the devices by manufacturer. Since each manufacturer determines how they want to build their SNMP library, you’ll need to understand how they created their hierarchy. Fortunately there is a lot of good information available on manufacturer websites to help you. Here is more information about SNMP support within Windows.

If you’re looking to improve network discovery and automate IT tasks to save time, try dopplerVUE for free for 30 days.

Network and Security Monitoring – What are the Key Challenges in 2010?

2010-01-29T17:14:00.001-05:00

Want to wager a guess as to what the key issues are surrounding network and security monitoring in 2010? If you want to confirm or deny your suspicions, check out a study from Enterprise Management Associates (EMA) involving network and security operations professionals highlighting the challenges and best practices for optimizing monitoring in 2010. In case you don’t have time, here are some of the highlights:

1. 24% of participants reported they either lack the staff to keep up with monitoring tasks or the training within existing staff to keep up with administration or interpretation.

2. A trend spotted by 62% of participants was the movement of staff to more generalist roles reducing the availability of technical specialists (shrinking budgets have made this a real challenge). Does your experience support this trend?

3. 66% of participants indicated they lack enough monitoring tools or the budget to buy them.

4. 47% of respondents were not fully utilizing the monitoring tools they had in place.
It's clear that in 2010 workloads won’t be decreasing and that the trend of doing more with less will continue. Another finding is that IT staff need a tool that centralizes their monitoring into a single system that is simple to maintain and is easy to use.

If this rings true for you, I can provide some helpful guidance. My company offers dopplerVUE a powerful easy-to-use network management tool that can help you bring together security and performance management into a single system. dopplerVUE is a cost-effective ($10 per element) and proven solution (check out our tutorials). Or download the software and try if for yourself for free. We also offer great customer support to make sure you make the most out of your investment.

That’s my product pitch for the day. Enjoy the weekend!

Routers in Space…Extending the Internet into the Universe???

2010-01-21T14:13:00.001-05:00

Managing a network on Earth is no easy feat. How about in space? This may sound far fetched, but the concept may be becoming a reality. Internet technology is now being made available from a space-based platform.

Cisco is testing an IP router aboard a satellite in Earth orbit (22,300 miles above the Earth). The aim is to extend IP access to places that aren’t served by traditional phone and wireless networks.

As part of its Internet Routing in Space (IRIS) program, Cisco is testing the router to demonstrate to the Department of Defense (DoD) that the technology can be used to enhance military communications.

Here is a picture of the Intelsat 14 satellite with reflectors deployed for testing. Check out more pictures here.

According to Cisco, IRIS shifts much more of the intelligence to the orbiting router – with potentially dramatic benefits. The long-term goal is to route voice, data and video traffic between satellites over a single IP network in ways that are more efficient, flexible and cost effective than is possible over today's fragmented satellite communications networks.

After testing is completed in April, the IRIS project will be switched over for commercial use.

This is a very interesting development from my perspective. My company has been helping the government manage LAN, WAN, satellite and a range of networks for some time. Perhaps its time to take it to the next level….

Networks Could be 10,000 Times More Efficient…Really?????

2010-01-15T09:44:00.002-05:00

Did you know the global network currently generates 300 million tons of carbon dioxide a year -- about as much as 15 million cars? I didn’t either until I came across an article on Market Watch. The number is increasing as Internet traffic continues to grow along with a worldwide user base. I was surprised by how much of an impact the network has on the environment. But, there is good news…

Global networks could theoretically run on 10,000 times less energy than they do today according to scientists and engineers at Bell Labs (the research arm of Alcatel-Lucent). The estimate came from the scientists when they decided to find out the minimum amount of power required to run the network. This isn’t my field of expertise, but it seems like a staggering amount of inefficiency.

Why are networks so energy inefficient? Bell Labs says that networks weren’t designed with energy efficiency in mind, but were optimized for performance and simplicity (not too surprising).

So where does this leave us? Alcatel-Lucent and Bell Labs have decided to launch a global consortium called Green Touch whose goal would be to develop the technologies needed to make networks much more efficient.

How much more? 1,000 times more efficient than it is now within five years. It's an aggressive goal, considering that a thousandfold reduction is roughly equivalent to being able to power the network for three years with as much energy as it currently takes to run it for a day.

This is great news. It’s going to be interesting to see if the consortium can deliver on their goals. I’m cautiously optimistic – how about you? If you want more details check out the Green Touch press release.

How Much is Downtime Costing You? Find out How to Reduce Downtime by 85%...

2010-01-13T17:12:00.003-05:00

Any guesses on how much IT downtime is costing your organization? Maybe you already know. In case you don’t - research from analyst groups suggest the cost is anywhere from $42,000 to $90,000 for every hour of unplanned downtime. The estimates (of course) vary greatly based on industry, organization size and other variables, but even if you’re on the low end of that estimate, that’s a lot of money.

In a recent white paper “Business Operations Disruption Risk: Identify, Measure, Reduce”, IDC highlights the application of five best practices that can help reduce unplanned downtime by up to 85% (derived from interviews with multiple midsize companies).

• Consistent use of management software reduces network and system downtime by 65%
• Upgrading servers/storage/network equipment reduces downtime by 50%
• Enabling high-availability failover clustering software reduces downtime by 43%
• Adopting industry best practices standards (e.g., ITIL, Cobit) across the organization reduces downtime by 13-15%
• Using virtualization software reduces server downtime by 10%

I’m guessing you’re already using some or a combination of these tactics to mitigate the risk of downtime. Most of these best practices are well known, although I did find the percentages associated with each one interesting. Do you find them to be accurate based on your experience?

Anyway…if you’re looking for guidance in any of these areas, let me know. My company specializes in IT services and network management software (free trial for 30 days).

Network Management Security

2010-01-06T10:45:00.000-05:00

Happy New Year! I recently read a great article on network management security by Joel Snyder, and thought it would make a nice first topic for 2010. His article offers up several very good tips that you should consider implementing if you haven't done so already. Check it out:

It doesn't happen very often, but when Cisco sends out a security advisory about one of their routing or security products, there's a big splash. Almost all of these advisories can be summarized like this: "If someone out on the Internet sends some bad packets to your Cisco device, and if your device is listening to them, then something bad will happen."

The phrase in that alert you need to pay attention to? "If your device is listening to them."

It shouldn't be.

Do you have SNMP enabled on edge devices? Fine… so long as you also have an access list saying that those SNMP packets can only come from your management station. Is the management interface, whether HTTP, HTTPS, SSH or (heaven forbid) Telnet running?

Fine … so long as no one outside our network can ever get there.

We call this the "control plane" or "management plane." Think of it as a different network that runs in parallel to your data network, and is used to control, monitor and manage the data network. In huge networks, there is a true network control plane that is completely separate from the data that the device sees. But in many smaller networks, control plane, management plane, and data plane run on the same wire.

You can, and should, secure your network control plane in many ways, but they mostly come down to two techniques: access control lists and self-protection.

ACCESS CONTROL LISTS MANAGE TRAFFIC TO EDGE DEVICES
Access control list protections usually occur when you put a block of some sort in non-firewall devices at the edge and core of your network. A good example is SNMP. Let's say you have an SNMP management station at 10.20.30.161. That represents the one valid flow to and from that management station to network and security devices. Now, any other SNMP traffic floating around on your network, or coming in from the edge, should be blocked. If you have intermediate routers in your network, and certainly if you have firewalls, you should use them to block SNMP traffic -- and any other management traffic -- to your security and network devices, except from authorized sources.

You can get as strict as you want. For example, you can simply block all SNMP anywhere in your network except to and from the official management station. Here's an example using Cisco Systems Inc. access list syntax (once you define these access lists, don't forget to apply them to the appropriate interfaces):

permit udp 10.20.30.161 any eq snmp
permit udp any 10.20.30.161 eq snmptrap
deny udp any any eq snmp log
deny udp any any eq snmptrap log

Or you could put a block in to just protect the network and security devices. Usually, stricter is better, but if you don't know who else might be using SNMP, then you can focus on the devices that run your network.

At the edge, a much stricter approach is appropriate. In this case, you should be blocking all traffic directed at your firewalls, load balancers, and routers on their management addresses. Remember: No one on the Internet needs to send packets to your firewall, or to your external router. They legitimately send packets through those devices all the time, but the packets are never destined (at the IP layer, anyway) directly to the device. They're always for some IP address behind the device. The only time you may want to consider letting traffic come directly to the management IP of your external security and network devices is for PING traffic -- it's a very useful debugging tool and worth letting traffic come in.

Here's an example, using Cisco syntax, of blocking access to a device 128.182.35.42:

deny IP any host 128.182.35.42

If you wanted to block all SNMP incoming, you could do something like this:

remark *** Deny all other SNMP incoming
deny udp any any eq snmp
deny udp any any eq snmptrap

If you're in a NAT environment and you're using the external IP address of your firewall or router both for management and NAT, here is some advice: Don't do that. You're asking for security trouble, because now you have the same IP address being used for two things. IP addresses may be in short supply, but they're not in that short supply. Here's an example in case you can't separate out NAT from other traffic, assuming you know which ports your router or firewall are listening to (not a very good assumption, as the Cisco advisories show):

remark *** Block obvious access to mgmt plane; allow others
deny tcp any host 128.182.35.42 eq 22
deny tcp any host 128.182.35.42 eq www
deny tcp any host 128.182.35.42 eq 443
permit ip any host 128.182.35.42

CONFIGURE SECURITY DEVICES TO PARTICULAR TRAFFIC
Another protective technique should be self protection. With self protection, you configure the network or security device so that it doesn't listen to traffic it shouldn't hear. On devices such as routers, you'll want to create a local access list that only allows management traffic from authorized management networks. If you can, also disable management protocols and interfaces you aren't using. On devices such as firewalls, there is often a series of check boxes that let you turn on or off management on certain interfaces. It doesn't need to be enabled on the outside, ever. That's what VPNs are for, if you really need external management.

Sometimes you want to disable protocols entirely. Most people, for example, do not manage Cisco routers using HTTP. Here's a configuration example that's double overkill: disabling the HTTP server, and then also putting an access list on it, just in case.

no ip http server
ip http access-class 21
ip http authentication local
no ip http secure-server
access-list 21 deny any

And even if you do have management enabled, you should also add lists of authorized management addresses. It shouldn't be possible for someone who happens to be inside your network to connect to the management IP of your firewalls, routers, or other security devices, unless they're on the official management network.

For example, again using Cisco syntax, here is what the SNMP part of the router configuration might look like in a self-protective mode of operation:

snmp-server community public RO 6
snmp-server community vewysekwitpassword RW 6
snmp-server location Opus One/Tucson, Arizona
access-list 6 permit 203.209.92.105
access-list 6 permit 192.245.12.0 0.0.0.255
access-list 6 deny any log

In summary…
1. Your public facing devices should not have non-essential ports open.
2. SNMP is safe when using an access list to limit who your routers will send/receive SNMP traffic to/from.
3. Use a Management or Control plane to isolate the monitoring and management tasks from the other traffic. This allows you to open ports/protocols often necessary to enable the best functionality.

Do you have any network management security tips that you frequently use or follow?

Volume Shadow Copy – Simple Protection That Can Save you Lots of Pain

2009-12-24T09:36:00.000-05:00

Ever lost a document, had a system malfunction because of a new driver or software installation or had a virus impact your files? I'm pretty sure I know the answer to this question.

To avoid such situations consider using the volume shadow copy feature. The feature is on by default in Windows 7 and easily added to Vista.

The feature allows you to launch System Restore and roll back to a working system state from before the installation. If you can’t get your system to boot, you can also do this from the Windows Setup DVD. This process is reversible, i.e. your current state will be automatically saved as a restore point, to which you can later go back.

In another situation, if you accidentally delete 10 pages of your dissertation, you can right-click the document, choose Restore previous versions, and access a previous version of it. You can open it (in read-only mode) or copy it to a new location.

If you accidentally delete a file or folder, you can right-click the containing folder, choose Restore previous versions, and open the folder as it appeared at the time a shadow copy was made (see screenshot below). All the files and folders that you deleted will be there.

I made sure I had the feature turned on based on past painful experiences. Something to consider...

Happy holidays

Security Makes the Headlines Again....

2009-12-21T04:30:00.001-05:00

Interesting article in the WSJ recently about a tool called Skygrabber that insurgents are using to intercept video feeds from US drones over Iraq and Afghanistan. Of course the attention has overwhelmed the skygrabber.com website and is a lesson on being ready for your moment when it arrives but, the real issue here is one of security and how commercial enterprises are thriving on attacking vulnerabilities in networks and making a profit in doing so.

Here is a quote from Andrew Solonikov, one of the software’s developers.

"It (the software) was developed to intercept music, photos, video, programs and other content that other users download from the Internet -- no military data or other commercial data, only free legal content," he said by email from Russia.

Um, last time I checked, “free, legal content” can be downloaded and does not need to be intercepted. Intercepted is what you do when others own the content and you want to steal it. Looks like Andrew and friends don’t mind stealing from musicians, movie producers and software companies but, don’t want to mess with the military.

Any bets that the US intel community is capable of monitoring who downloads this software?

Home Networking Security...Beware

2009-12-10T12:46:00.002-05:00

Guess what happened to me the other day? I was using a DynDNS service to remote into my house and mis-typed the IP address. Instead of being rejected, I was provided a prompt to a DVR system login (I don’t have a DVR). I did a quick Google search for default DVR username/passwords and found a large list of common username and passwords.

It’s amazing how many home devices are now IP enabled, but also concerning when you think about how many people are still using the default password info that comes with the device.
Hopefully it becomes common practice for everyone (inside our industry and outside of it) to change the default information, whenever they get a new device.

P.S.
Did you know there will be 215 million IP enabled devices by 2012?

Put your Day on Auto Pilot with PowerShell Scripting…

2009-12-04T17:51:00.001-05:00

Ok I wish it were that simple, but, it is possible to save substantial time and effort by automating many repetitive and common Windows IT tasks by creating scripts with PowerShell. There are lots of websites and books that have pre-written scripts for you. So, not only can you automate a good chunk of your IT tasks, you can copy and paste your way to automation. With that in mind, here are a few resources I’ve found helpful.

Microsoft Technet
The premier place for basic and advanced topics related to PowerShell. I’ve spent hours on this site and it has everything from training and free scripts to a download center with lots of goodies. Here are some MUST visit sections:

Library – More reading than I could possibly do this year. It’s the place to start with good example code to walk you through the learning process.

Download Center – Get PowerShell and the scriptomatic2 software to make scripts using a graphical user interface.

Scripts – Over 650 scripts on items from managing an IIS server to system backups and restores. Once you know how to use PowerShell, jump start your library here.

PowerShell.com
A great website with tips, tools, a forum, free scripts and lots more on PowerShell.

CBT Nuggets
CBT Nuggets provides an excellent online training program that covers PowerShell. Their sample tutorial is a pretty good primer on several basic commands and the PowerShell pipeline concept (like a workflow).

Quick Reference Card/Cheat sheet
DZone makes a nice set of free cheat sheet reference guides. These are handy to have printed and around when making/editing scripts.

Twitter
For Twitter users, you may want to follow these users:
http://twitter.com/powertip - Tip of the day tweets
http://twitter.com/ScriptingGuys - Tips and ideas straight from Microsoft
http://twitter.com/shitmydadsays - Because it’s funny

Are Businesses Prepared for Workforce Disruptions? New Cisco Study Says No…

2009-11-25T13:05:00.001-05:00

I’ve recently discussed keys to avoiding network failures and tips to being prepared for network disasters. A recent study by Cisco highlights the need to continually keep network continuity at the forefront of our minds.

The survey finds that organizations are not ready to operate as usual during workforce disruptions because they haven’t set-up the proper networking infrastructures to support remote work by a high percentage of their employees.

Here are some of the highlights of the survey:

- 74 percent of the 502 IT decision-makers surveyed said that fewer than half of their employees were currently set up to work remotely.

- Asked why more employees did not have remote access, 38 percent said that business requirements did not necessitate it.

- Only 22 percent of those top decision makers felt that their current remote access solutions have contributed to their disaster preparedness.

- Just 15 percent of the respondents listed "pandemic or other disaster preparedness" as a top business driver for providing remote access to employees, and only 5 percent listed it as the primary business driver.

The study suggests that organizations are more focused on business needs under normal conditions than on remote access for business continuity purposes. In this economic environment that is not so surprising. Of course, it only takes a road closing, really bad weather or widespread illness that affects employee productivity and company revenue to change that focus.

Cisco also posted a YouTube video with a preview of the findings from the survey, if you’re interested in more details.

5 Key Common Culprits for Single Points of Network Failures

2009-11-23T09:26:00.001-05:00

I recently wrote a post about network disaster preparedness and provided some tips on how to avoid network outages. I came across a great blog post that added more depth to the topic by discussing how to avoid the most common culprits for single points of failure on small to midsize networks. The post was written by Derek Schauland from TechReuplic and he highlights some network areas that I agree need particular attention.

1. Network Switches – Keeping spare switches online is ideal, but may be cost prohibitive. Consider having a couple of extra switches around in case of a failure.

2. Tape Drives – Ensure you have redundancy in terms of tape drives for back-up and recovery in case of a worst case scenario. You never know when a tape drive may stop working.

3. Network Interface Cards (NICs) – Use servers with multiple NICS for improved connectivity and for failover in case one of the cards in the server fails.

4. Internet Connections – Having redundant connections can be a critical part of avoiding a single point of failure, especially considering the importance of the Internet to business operations these days. Of course the cost of keeping a connection with two providers active needs to be justifiable for your business. At a base level, it never hurts to have a plan in place to immediately take action to move to a secondary provider if your primary fails.

5. Cabling – I’m adding to Derek’s list here, but cabling issues often cause LAN failures. It’s always worthwhile to have many spare cables of different lengths ready to go. I keep a few really long ones as spares in every telco/IT room. They are great for testing and at times when I need a temporary cable.

This will help you to solve, both the most basic and overlooked issues and the more dramatic ones. This list is not all inclusive, but these fives areas should be considered in planning for a worst case scenario. Do you have any additional areas that you pay particular attention to in your network?

HP Buys 3Com… What Does It Mean for the Networking Market?

2009-11-17T10:43:00.001-05:00

The recent acquisition of 3Com by HP makes me wonder what they are going to do in the networking market. For some time, we have been using HP Procurve switches along side Cisco gear. They have proven reliable and very cost effective. I have been looking forward to HP enchancing its offerings. In light of Cisco expanding into the server market, there was an expectation that HP would more aggressively address the networking market and create better choices for lower cost networking devices. It just doesn’t seem like the 3Com product line is sufficient for HP to go head-to-head with Cisco. This makes me think that HP is not even close to being done from an acquisition standpoint. I wonder when we will see HP drop another huge chunk of change to buy another device vendor. And who will the vendor be?

Anybody want to comment on who they think HP will buy next or do you think 3Com products sufficiently supplement the HP Procurve line?

Want to Become a Service Provider CEO? Try Cisco’s New Simulation Game…

2009-11-13T18:14:00.000-05:00

Looking to try your hand at being a CEO for a day without all the real life pressures? Here’s your chance. Cisco has a free Sim City type real time strategy simulation game called myPlanNet, you can download (only works on Windows though). If you want a preview before downloading (40mbs in size) the game, check out the YouTube video.

You have to register (if you don’t already have an account) to get the game, but it’s worth the hassle. The point of the game is to manage your service provider business as the CEO as it evolves from the dial-up, through to the broadband and mobile connected eras and into the future age of networking.

Cisco created the game as a marketing and educational tool and I’ll admit it is a lot more fun than reading a white paper. Check it out and let me know what you think.

5 Easy Steps to Enabling SNMP on Cisco’s Unified Communications Manager for VoIP Monitoring

2009-11-10T09:16:00.002-05:00

One of our offices has the new Unified Communications Manager (UCM) 6.1, the software-based call-processing component of the Cisco VoIP solution. Did you know that UCM supports SNMP monitoring? Based on a few conversations I had with people there seemed to be some confusion about the topic.

There is a good reason for the confusion. I was doing some SNMP polling and could not get the metrics to appear. It turns out that all previous versions of UCM supported SNMP by default, however the current version requires you to enable the protocol. After a bit of research I found that you need to enable SNMP on both the host server and the Unified Communications Manager application.

With both sets of SNMP services enabled, I was able to monitor both the health and status of the core system and gather quite a few metrics regarding the service. I’ll share a few of my favorite monitoring metrics and some associated screenshots in a later post.

For those of you, who already monitor your Unified Communications Manager with SNMP, let me know what you find useful. For those of you who have not turned on SNMP, here are the steps:

1. Open the web console to CCM

2. In the Navigation dropdown in the upper right, select Cisco Unified Servicability

3. Go to Tools / Service Activation

4. Select Cisco CallManager SNMP Service

5. Click the Save button

Here is a link to where I found the Cisco UCM MIBS.

Random Netflow – A Tool to Keep in Your Kit

2009-11-06T10:19:00.002-05:00

In my network management adventures throughout the years, I’ve found Netflow to be an invaluable tool to troubleshoot a range of network issues – from bandwidth to service and resource problems. It’s an amazing traffic mining tool – it analyzes traffic flows across a network and provides a huge amount of information. That is where the problem lies as well – sometimes Netflow delivers too much information when I just want a small amount data for planning and traffic engineering. I’m sure you’ve come across this issue – right?

I know I’m not the only one, since I came across a great article from Network World on how to solve this issue. The advice is very straight forward and concise on how to solve the information overload issue by using the random Netflow feature. Thought it was worth sharing.

A few of my favorite tips from the article:

- Know your flow. Netflow versions 5 or 9 work if you need to export the data to look at it off device. With other versions you can view the data on the device.

- You can not have Netflow enabled on an interface you want to run random Netflow on. A device always gives full Netflow precedence over random Netflow.

- If you run into any problems there is a debug command: debug flow-sampler.

What was your favorite tip? Or if you have one that isn’t mentioned, I’d love to hear it!

Slow Bandwidth? Remove Unused Protocols to Improve Speed

2009-11-04T10:35:00.001-05:00

Identifying protocols that contribute to slow bandwidth

I’m always looking for easy and effective ways to improve network performance. When I’m unhappy with network performance I try removing unused protocols to help lower traffic and increase network speed. Have you found any other effective methods that you want to share with us?

To give this one a try, check the default network protocol settings used when installing operating systems and network drivers. They often include protocols such as IPv6, LLMNR and PGM, which are not commonly used in most networks. For example, if you have Microsoft Vista, you’re wasting traffic with the IPv6 protocol running, unless you’re actually using IPv6. If you remove it, you’ll open up your network and improve speed.

Common unnecessary protocols

IPv6

Microsoft ships IPv6 as one of the default protocols on Windows Vista and Windows 2008. While IPv6 may be a replacement for IPv4, it is not yet a standard protocol for most networks. Auto enabling all devices with IPv6 may be a bit ambitious, since most LANs and WANs simply are not yet supporting IPv6. Check out this Microsoft article on how to remove IPv6.

IPX Network client

If you’re not using Netware, don’t leave the IPX (Internetwork Packet Exchange) Network client installed. Sometimes it’s left over on older systems and can easily be removed. Uncheck the Client Service for Netware box and reboot the system (see Figure 1).

NetBIOS

Prior to Windows 2000 and DNS, NetBIOS was the method used by Windows for name resolution. Unless your network is running Windows NT systems, it is pretty safe to stop using the NetBIOS functionality. Check out this article for step by step instructions for removing NetBios from Windows 2000/XP/2003 systems.

LLMNR

Link-local Multicast Name Resolution (LLMNR) is used to connect devices when a well established network is not available. It’s used by both IPv4 and IPv6 networks when services such as DNS and DHCP are not available. Ever notice your Windows system auto configures a169.254.0.XXX address when the network isn’t available? This allows devices connected via a hub, switch or cross cable to get some connectivity. If your users are always on a working LAN, this protocol may be unnecessary.

PGM

Pragmatic General Multicast (PGM) is a reliable and scalable multicast protocol. PGM is appropriate for applications that require duplicate-free multicast data delivery from multiple sources to multiple receivers. Not doing multicast? Then you do not need this protocol.

Find Unnecessary Protocols

To find out if your network is running any of the previously mentioned protocols (or any others you may not need), try using a packet sniffer. I’ve used WireShark (a commonly used packet sniffer), but have also heard that Microsoft Network monitor, which shows the process name of the application that is creating the traffic, is being commonly used. You can get both of these products for free:

Wireshark

Microsoft Network Monitor

Start your packet sniffer and collect a reasonable sample size, such as 20-30 minutes of data. Then simply sort or filter by protocol, and see which ones are on your network and causing unwanted traffic. Then simply remove the unwanted protocols to improve network speed and performance. Try this approach and let us know how well it works for you.

Simple Network Management with Syslog

2009-10-29T16:16:00.000-04:00

How do you easily track thousands of network elements and separate truly critical problems from ordinary network events? No easy task, I know. What approach do you use?

I’m a big fan of using syslog to automatically collect event messages from network devices, rather than monitor devices individually. Over the years, the syslog protocol has become an industry standard for creating, sending and collecting event messages.

A standard syslog message includes the following information:
- Facility type (OS, app or service) that originated the message
- Severity level associated with the message
- Date and time the message was sent
- Hostname or IP address of the sending server or network device
- Message text containing the event description

OS’s, applications and services continuously send these messages to centralized syslog servers. Depending on the capabilities of a particular syslog server, syslog messages can be sorted and viewed according to criteria such as message source, event severity or key words in the message text. Isn’t that convenient?

Also, the syslog server may filter syslog messages and raise alarms based on severity level. These alarms let you deal with unstable network elements first and the respective syslog messages give you the details to understand the source of the problem.

Here’s a simple table showing syslog severity levels:

Seems simple right? One challenge is that sifting through a ton of syslogs to troubleshoot a single problem can take hours. You need a way to consolidate, analyze and visualize the information to reduce system downtime and increase network performance. We have a great way for you to see your network status at a glance, check out dVUE6, a cool desktop gadget (for XP and Vista) that monitors the availability and alarm status of your five most alarmed devices in your network. For more information, and to download the gadget, follow this link.

Here is a graphical view of dVUE6

What is Fueling Future Network Growth? Your Thoughts...

2009-10-22T15:45:00.005-04:00

What do you think is driving future network growth?According to a new Cisco study, many residential, business, and mobile IP networking trends are being driven largely by a combination of video, social networking and advanced collaboration applications, termed “visual” networking traffic.

Service provider networks are carrying a significant amount of visual networking traffic, with more than one-third of the average global broadband connection supporting video, social networking and collaboration applications each month. Maybe social networking isn’t a fad.

Cisco VNI (Visual Networking Index) Usage Highlights:

Aggregate Broadband Findings (Q3CY09):

- Globally, the average broadband connection (primarily residential subscribers and some business users) generates approximately 11.4 gigabytes of Internet traffic per month.

Per connection per day, this amount is roughly equivalent to downloading 3,000 text emails, 100 MP3 music files or 360 text-only e-books.)

- Globally, the average broadband connection consumes about 4.3 gigabytes of visual networking applications advanced services such as video, social networking and collaboration) traffic per month.

Per connection per day, this amount is roughly the equivalent of approximately 20.5 short-form Internet videos or approximately 1.1 hours of Internet video, whether streamed on its own, embedded in a Web page, or viewed as part of video communications.)

- Top 1 percent of global subscribers generated more than 20 percent of all traffic.

- Top 10 percent of global subscribers generated more than 60 percent of all traffic.

Peak Broadband Usage During Internet Prime Time:

- In an average day over the reported quarter, Internet "prime time" spans from approximately 9 p.m to 1 a.m. around the world. This contrasts with broadcast TV prime time, which is generally from 7 p.m. to 11 p.m. across most global markets.

- 25 percent (or 93.3 megabytes per day per connection) of global Internet traffic is generated during the Internet "prime time" period.

- A peak Internet hour has 20 percent more traffic than a nonpeak Internet hour. The peak Internet hour averages 18 megabytes of traffic per connection (per hour), while nonpeak Internet hours average 15 megabytes of traffic per connection (per hour).

The peak Internet visual networking hour has almost 25 percent more traffic than average hourly Internet traffic.

It’s one thing to imagine the amount of traffic passing through networks every day, but it’s another to actually see the numbers. My favorite statistic is the number of GBs used per connection per day compared to text messages, e-books and music. The numbers are huge! I can’t imagine sending 3,000 text messages per day, can you?

What do you think about these findings? What are the future implications? I’m interested in hearing your thoughts.

Network Disaster Preparedness Tips

2009-10-16T15:09:00.001-04:00

With the winter season approaching, big storms bringing everything from heavy rain and lightning to snow and wind will be a constant threat to network operations. When was the last time your local IT team reviewed disaster preparedness procedures? Now is a great time to start. If any form of a disaster hits, do you or your team know your capabilities and how to react? Here are some important questions that your IT team should be able to answer and use to improve your disaster procedures:

1. Are you aware of your power situation?
a. What happens when a power outage occurs?
b. What is the operational status of the UPS system?
c. How long will the UPS backup systems sustain key functions?
d. What do we do if the outage is longer?

2. What if the building becomes unavailable? (fire or water damage)
a. Are the offsite backups current?
b. If a network device or server is ruined, what is the procedure to replace it?
c. Does everyone know the primary and secondary facility contacts to use should an after-hours emergency occur?

3. What if access to the building is limited? (snow, tornado warnings, etc)
a. Is VPN access updated for all employees that may need to work from home?
b. Can all of the required maintenance procedures be done remotely or skipped for several days?

4. What if the phone and/or Internet connection is lost?

5. What is the customer impact when any of these conditions occur?

Even monitoring your network with disaster prevention in mind can be helpful in avoiding unnecessary failures. These tips are a great starting point:

Enable redundant polling of critical devices
Map out HSRP primary and secondary links
Know the status of the UPS systems
Make sure you have 24x7 access to your management system client

If you have tips for network disaster prepardeness, please share them with us.

Resolve Network Problems Faster with Wireshark

2009-10-14T12:07:00.001-04:00

I’m a big fan of Wireshark, an open source tool to capture and analyze network traffic. Wireshark can be very helpful in terms of network troubleshooting and analysis. I recently came across a great tip from Chris Greer, a Senior Network Analyst on how to add useful columns, as well as recommendations for which columns are most commonly used (detailed below). If you have any tips that you would like to share to help network managers, please send them along.

What are the best columns to display?
Wireshark allows you to easily display specific packet data in the summary view. Depending on the problem you are looking for, it may be useful to add or remove custom columns so you only see information that will really help you solve the problem. For example, it’s not always useful to display the IP identification number for every packet in the trace file as a column on the top of the screen. But, one thing that is quite useful to display for most problems is the size of each packet.

How to add and remove columns.
Open up any trace file in Wireshark. At first, in the top screen, you will see a frame number, a time column (usually elapsed time from the start of the capture), source and destination addresses, what protocol is used, and finally a summary of what the packet contains. While this data is great to start out with, it won’t take long before adding a column of specific data will help.

To add a column, select Edit Preferences. This will bring up the Preferences window where Columns can be selected from the left. The default columns will be displayed here. To add a column, click the Add button and select the desired information to add from the format menu. Name the column and then you are done.

For example, to add the packet length, select add, name the column Length, then select Packet Length from the Format Bar. By default, it will be added at the bottom of the list, which will make it appear on the far right of the summary view. To move it up, just drag and drop it up where it can be more easily seen, such as between the destination and protocol fields.

After adding the column, click the apply button and the length of the packet will now be displayed in the summary view of Wireshark.

What are the most useful columns?
This of course depends on what problem you are trying to resolve. Here are the ones I use with a description of why:

Delta Time - Handy to have in just about any situation. It is needed for measuring server response time, network roundtrip time, and other delays. Delta time can be displayed by modifying the already present time column in the View menu, or by adding delta time as its own column.

Cumulative Bytes – When moving large blocks of data, this column displays how much data has been sent. You can then divide by the time it took to send it and figure out the throughput used by the application.

In this data copy, after filtering on one direction of traffic and resetting the timers, we find that in .022 seconds, there was 193,220 bytes sent. (193,200 x 8)/.022 = Bitrate. This transfer took up 70Mbps of my line. Very useful when looking at backups!

TCP Window Size – Useful when TCP Window size is an issue, usually in larger file transfers. It can be added by selecting Custom from the column menu, then entering tcp.window_size in the field name. This column will show when and how often the TCP window drops, without needing to dig for this value in the packet details.

IP TOS (DiffSrv) – When monitoring traffic using the TOS field, such as VoIP, this column is helpful in viewing what bits are set and if QoS is configured for this value. It can be added selecting the IP DSCP Value option.

Using these columns makes it easier to spot problems in the summary view. They save you from needing to dig deep into every packet for a specific field, which saves a ton of time when troubleshooting!

Announcing the release of dopplerVUE 2.0

2009-10-09T12:32:00.015-04:00

dopplerVUE 2.0 is now available for download with exciting new features including discovering and mapping HSRP primary and secondary links, a new interface with graphics for better visibility, improved SNMP table polling and more! The 30-day trial is free, just like it was for the pre-release.

OPSCenter Screenshot

Netflow Screenshot

For those of you who missed the pre-release announcement, here’s the new feature list:

New interface with new graphics for better readability
Manage ANY metric on ANY device with improved SNMP table polling
Discover and map HSRP primary and secondary links
New WMI wizard
Easily create personal workspaces with the new dVUE templates
Distributed architecture to extend the number of managed devices
Improved database and architecture for increased performance

Plus - for distributed enterprise networks dopplerVUE connects with NeuralStar to create a two-tiered, centrally monitored, fully replicated enterprise network management system that provides:

Increased fault tolerance
Improved performance through load balancing
Powerful disaster recovery capabilities
Enhanced scalability

I’d love to hear any dopplerVUE or network-related comments or questions you have!

IT Hiring Improving?

2009-10-07T15:45:00.005-04:00

Here are some interesting data points about IT hiring from an industry article I just read. As usual there are some mixed indicators, but hopefully the market continues to improve.

• IT unemployment rate (5.5%) is only about half the overall market (9.8%)

• IT budgets are expected to grow a bit in 2010 (IDC predicts 2.9% growth and Gartner estimates a 1.53% increase)

• Hiring is increasing in areas including New York, Washington, D.C., Chicago, Los Angeles, Dallas and Houston (according to Robert Half Technology)

• Robert Half reports that health care organizations plan to increase IT hiring by 5 percent in the fourth quarter, while overall IT hiring is expected to remain flat

• Network security, especially securing government data, is one of the most desired skills (according to Dice.com)

• Many projects with higher paying skills have been put off, but the associated skills remain in demand : .Net, ERP development, SharePoint development, Virtualization (according to Dice.com and Robert Half Technology)

• Much of the hiring is occurring on the desktop side, desktop support analysts, PC techs, as well as program analysts and web development (according to Robert Half Technology)

If you’re looking for open positions, check out the careers section of our website. We currently have a web developer position open as well as many other IT positions in various geographic locations.

Before Adding More Bandwidth…

2009-10-01T09:00:00.002-04:00

Does your network reach capacity at similar times every day? If so, before you decide to add more bandwidth at additional cost, think about adjusting traffic patterns at no cost.

As a first step, consider using a network monitoring tool to baseline the most common time periods when your network is at capacity. With this critical information, you can take some pro-active steps to optimize your network traffic.

Move maintenance tasks such as back-ups, updates, source control synchronization and large file transfers to off peak periods to decrease the load on the network.

If you can’t alter the timeline for maintenance tasks, encourage users to schedule bandwidth intensive tasks (video teleconferencing and webcasts) that are not time sensitive to business operations to off peak periods. Most users want the best possible viewing experience and will appreciate being able to schedule online events to take advantage of improved network availability.

Of course, if you don’t have flexibility to adjust traffic patterns to optimize the network, it may be time to add more bandwidth.

3 Key Steps to Actively Monitoring HSRP…

2009-09-29T15:03:00.008-04:00

I recently discussed how to build a resilient network using HSRP/VRRP and as a follow-up, here are a few key steps to actively monitoring HSRP.

With HSRP on our network, there is a good deal of network reliability for end users. As the network engineer, this means when a link fails, end users rarely notice it. The backup link simply handles the load and business continues as usual. Just the way I want it. While my monitoring system does provide an alert to the link down condition, I like to handle these situations as a higher priority, since it has become a single point of failure.

Here are a few tips to actively managing your HSRP implementation:

1. Map out each pair – know when a primary route goes out, what path has been designated as the alternate (if you have many HSRP routes you can combine them onto a single map. The pre-created map makes it easy to find the paired item).

2. Create custom alerts for HSRP interfaces that indicate which path is a primary or secondary HSRP link. The HSRP interfaces need to be treated differently than a switch port to a user workstation due to their critical nature.

3. After service has been restored, review the interface load of the secondary link and evaluate how well it handled the traffic. Use this information to ensure your backup pipes have adequate capacity. This will improve your disaster recovery planning for any future events.

Here are some monitoring screenshots that show my HSRP map and an active alarm.

Figure 1. HSRP MAP (Primary is solid line, Secondary is dashed line)

Figure 2. HSRP Active Alarm – (identifies HSRP link route impacted)

Looking to Reduce IT Costs…Optimize Network Traffic

2009-09-23T11:26:00.002-04:00

In these days of pinching pennies and saving dimes, the best way to help your organization is to find ways to reduce costs. Do you know which network resources are costing you the most? Answering this question can lead to optimizing network traffic and cutting costs.

For instance, the cost of LAN traffic within your office is usually fairly affordable, however, once the packets hit the WAN, the price tag increases significantly.

You can use Netflow to identify which network resources are adding the most to your monthly bill. Start monitoring the circuits that make up the majority of your high cost list with Netflow and you might find some network efficiencies that lead to savings that have a big financial impact.

To find cost savings, I use a network management tool, dopplerVUE, that has a bandwidth locator that sorts and finds top bandwidth users in networks. dopplerVUE provides Netflow support to give you multiple ways to view traffic in your network.

If you want more details on where all your traffic is going and how to configure Netflow to give you the answers, check out this recent post.

Pre-Release of dopplerVUE 2.0 Now Available

2009-09-18T08:20:00.006-04:00

To piggyback on the post last week about HSRP, I’d like to share that the pre-release of dopplerVUE 2.0 is available for download. dopplerVUE 2.0 has exciting new features including discovering and mapping HSRP primary and secondary links, a new interface with graphics for better visibility, improved SNMP table polling and more! The 30-day trial is free, and who doesn’t like free?

Here is the new feature list:

New interface with new graphics for better readability
Manage ANY metric on ANY device with improved SNMP table polling
Discover and map HSRP primary and secondary links
New WMI wizard
Easily create personal workspaces with the new dVUE templates
Distributed architecture to extend the number of managed devices
Improved database and architecture for increased performance

Plus - for distributed enterprise networks dopplerVUE connects with NeuralStar to create a two-tiered, centrally monitored, fully replicated enterprise network management system that provides:
Increased fault tolerance

Improved performance through load balancing
Powerful disaster recovery capabilities
Enhanced scalability

If you decide to check it out and have questions, please don’t hesitate to post here in the blog or send me a message! I’m happy to help with network related questions.

Here are a couple of screen shots of the new dopplerVUE interface:

Three Easy Techniques for Cutting Alarm Clutter

2009-09-17T14:11:00.003-04:00

Have you ever missed (or almost missed) a critical network alarm that could have prevented a serious network performance or availability problem because it was hidden among non-essential alarms? Hopefully the answer is no, but the situation highlights a serious problem – “alarm clutter”.

Today’s network devices and servers are capable of providing a dizzying set of alarms on almost anything from packet errors to available memory. That’s a lot of power for troubleshooting and problem solving, but it can also mean that even in a small network of only a few hundred elements you can become overwhelmed by a storm of alarms.

Here are three easy techniques for managing the volume of alarms and their relative severity. Using them in the right circumstances can help you find and fix problems more quickly by spending less time wading through a sea of distractions.

Technique 1: Duration-based alarming
Duration-based alarming is a common technique for reducing the number of alarms from a particular device or server. Instead of reporting every instance of an alarm condition, an alarm is issued only if the condition persists for an unusual period of time.

For example, suppose interface utilization on a router occasionally exceeds 90% every few minutes. Normally, this wouldn’t be a concern and an alarm isn’t warranted (in fact, it could mean the router is optimally “sized” for the expected or nominal level of traffic for the interface). On the other hand, if interface utilization exceeds 90% for 15 minutes or more, a bottleneck has developed and an alarm should be generated. With duration based alarming, you are notified only when an actual problem develops—not every time a short, transient condition occurs.

Technique 2: Average-value alarming
Average-value alarming offers a similar approach. Instead of creating an alarm every time a measure exceeds a pre-determined threshold, an alarm is issued only if the average value of the measure over time exceeds the threshold.

It’s not uncommon, for example, to see processor utilization periodically “spike” at 100% for a few seconds. However, if a processor experiences an average of 90% utilization for 20 minutes that would be cause for concern and you would fully expect an alarm.

Technique 3: Severity-level alarming
Rather than setting just one alarm threshold, try setting multiple threshold values that represent increasing levels of severity.

Disk space used, for example, increases gradually to the point where applications can no longer function. Obviously, you want an alarm when available disk space is at 90%, but wouldn’t it be helpful to know when disk space is at 70% and then 80% so you have time to “clean up” the disk before applications suffer? You could configure a minor alarm when available disk space is at 70%, a major alarm at 80%, and finally a critical alarm at 90%.

These are just three of the most useful ways to reduce alarm clutter to focus on actionable alarms. Using them will help you identify significant network issues earlier, before users are impacted.

Building a resilient network using HSRP/VRRP

2009-09-11T13:41:00.004-04:00

A group of key servers losing network connectivity can lead to a real bad day. You can improve your network routing resiliency by adding hot-standby routers and HSRP (Hot Standby Routing Protocol) or use a similar method such as VRRP (Virtual Router Redundancy Protocol) for non-Cisco devices. HSRP provides a straightforward approach by having two physical routers accessible by any given switch. It’s a great approach to improving the reliability of your key equipment. Here are some quick basics on how it works:

1. Two routers share a virtual IP address that is used as the gateway IP.
2. A primary and secondary router are designated with each given a priority number. The primary router priority number is higher than the secondary router.
3. The primary router sends a Hello packet to the secondary on a timed basis. If this packet is not received then the secondary becomes the primary. Very low packet loss occurs during a failover and most transmissions using TCP are completed seamlessly due to the re-try mechanism. The re-try mechanism can be controlled by adjusting the length of the time between Hello packets.
4. Once back online, the primary router sends out a notification that includes its priority number. The router with the highest priority number becomes the primary.

This process can be used in groups with multiple routers offering to become the primary router in the event of a failure. Some devices even support using the same interface for multiple groups. This can be helpful when cross connecting multiple departments and to minimize the amount of duplicate hardware necessary.

The following is a sample set of IOS commands necessary to implement HSRP.

Router> enable
Router# configure terminal
Router(config)# interface ethernet 0
Router(config-if)# ip address 172.16.6.5
255.255.255.0
Router(config-if)# standby 1 ip 172.16.6.100
Router(config-if)# end
Router# show standby
Router# show standby ethernet 0

For more information review the Cisco documentation.

Looking Forward to the Modern Day Marine Show

2009-09-10T09:08:00.004-04:00

I’ve attended a lot of events lately, and it’s not over yet! I’ll be attending the Modern Day Marine show, held September 29th – October 1st in Quantico, Virginia. The show focuses on systems and technology, but also caters to equipment and services, making it attractive for all areas of interest. It looks like there are a good number of vendors exhibiting (there are three large tents and an outside exhibitor area), and a few events outside of the expo such as a large Robotics Rodeo and a grand banquet and reception.

This should be a great opportunity to hear more about the U.S. Marine Corps wants and needs in the network management space. It will also be a great venue to get feedback on the upcoming dopplerVUE 2.0 and NeuralStar 9.5 releases. Keep your eyes peeled for my post-show report in early October. Stay tuned for more information on the new release later this week!

Think you might be interested in attending Modern Day Marine? Check it out, here. There will also be two additional Marine Military Expos, Marine South and Marine West, held in 2010.

A Tip for Managing Wired Networks

2009-09-03T16:08:00.003-04:00

Earlier in the week, I posted three tips for managing wireless networks. Thought I would also share a tip for managing wired networks to round things out for the week. Here is a response to a question I often get from customers.

How can I tell when a Cisco device configuration has been altered or accessed?
You can be notified of any configuration changes or attempts by enabling the CiscoConfigManEvent trap. This feature sends you a trap whenever a user exits the configuration session. Simply point the trap to your network management system to see when somebody accesses a Cisco configuration session.

For dopplerVUE Users
You can forward traps as an email for 24x7 instant access to changes on network devices. To read more about this trap and how to configure it, please reference the following Cisco article.

3 Tips for Managing Wireless Networks

2009-09-01T15:06:00.002-04:00

The convenience of wireless networks can’t be underestimated. In today’s environment, mobile computing is an expectation. So when users run into connectivity and bandwidth issues, you can be sure that complaints are soon to follow. Here are three tips for managing wireless networks to help you avoid some potential headaches.

1. Improve wireless connectivity to the access point
If users frequently lose their wireless signal it’s going to be a frustrating situation. When wireless coverage drops, check for an increase in environmental disruptions. Look for Bluetooth headsets, video cameras and microwaves. These personal wireless devices can cause interference and often are the culprits.

If users still cannot connect reliably (or they were never able to connect at all), you may have a coverage problem, which frequently can be fairly easy to resolve. Use a laptop and the wireless strength meter to map coverage holes in your wireless system. Some free tools such as Netstumbler provide detailed graphs of signal strength and noise level. In addition, periodically perform a laptop survey to find rogue wireless routers to limit their use and ensure optimal network performance. Simply use the same laptop and wireless utility to scan for wireless networks for various points within your buildings.

2. Tracking the availability of the wireless access point
This is the intersection between wired and wireless network management. At a minimum, periodically ping all wireless access points to check their up and down status, making sure they are working and can interconnect to the wired network. Some network management tools like dopplerVUE let you do this on a regular schedule. For SNMP enabled wireless devices such as the Cisco 1200 series, you will also be able to monitor the CPU load and other metrics to know when the device is overloaded, slowing down or dropping all traffic on the access point.

3. Assure sufficient bandwidth to the access point
Once you know users have a decent connection, managing bandwidth may become an issue. Many wireless systems can handle 20 or more users. Monitoring each user on an ad hoc network is likely to be of limited value. Since all users are funneling through the same fixed wire connection, monitoring bandwidth where your access point connects to the network will provide a good summary of the traffic volume. This will help you understand when to upgrade a system and alert you before users call to complain about connectivity issues.

Tip for dopplerVUE users:
For a better understanding of when your network is busy, include wireless access points in your managed network inventory. dopplerVUE will monitor them for their up and down status and core system performance such as CPU load. Use the bandwidth usage finder to watch the real time traffic flow, comparing performance to the automatic benchmarks calculated by dopplerVUE. You will always know the availability status of your wireless access points and how much traffic is generated on each.

LandWarNet 2009 in Review

2009-08-28T17:03:00.006-04:00

I spent the week of August 17th in Ft. Lauderdale, FL attending the LandWarNet Conference. This was my first time at the conference, so I figured I would share a bit of my experience with you.

This year’s theme was, “A Global Network Enterprise Enabling Full Spectrum Operations for the Joint Warfighter”, and the exhibiting companies came from a range of technology industries including government consulting, military equipment to software.

While the show is predominately Army-focused, there were some smaller mixed groups in attendance as well. Attendance was strong, considering the state of the economy and the majority of the show sessions were full. The show floor was lively the first two days, but emptied out on day three. According to many LandWarNet veterans, the show is a magnet for hurricanes and has been closed early numerous times, so I’m not surprised people didn’t stick around the entire time.

Here are a few pictures from LandWarNet:

5 Tips For Getting the Most Out of Your Network Management System

2009-08-27T09:17:00.002-04:00

Monitoring and managing network devices is becoming increasingly challenging. But it shouldn’t require a computer science degree or weeks of training to use a network management system (NMS). Here are five tips to help you improve the quality of your monitoring efforts and reduce licensing costs using your NMS.

Tip 1: Only monitor devices you really care about.
Be sure to review the inventory list discovered by your NMS. Remove any devices that your team does not manage or that you wouldn’t respond to if a failure occurred. You may be tempted to keep these “just in case,” but they can clog your database, slow your system and make it harder to see more important issues. This can even save you money, since most vendors charge by the number of devices you monitor.

Tip 2: Reduce the number of SNMP community strings.
Networks that have a large number of SNMP community strings take more time in discovery, often much more time since discovery systems must test each community string and timeout before moving on. It’s a common problem since strings frequently get added whenever a new Network Engineer joins the team. A better option is to create a uniform policy with no more than one SNMP community string for each type of device. For example, you could create a unique community string for routers & switches, security appliances and servers. If you need additional security, consider SNMP v3 or use the SNMP security feature on most devices to block SNMP requests from unknown destinations.

Tip 3: Use visual aids.
When appropriate, use a floor plan or geographical background image as part of your network map. Network layouts become more tangible and you’ll recognize devices and where problems or bottlenecks are occurring more quickly by using a visual aid.

Tip 4: Implement a standard naming convention for your network.
Use a naming convention that is readable and can grow with your network. It may seem hard to go back and change all the devices now, but recognizing those elements will become much easier in the future. Try something like this:
.....<#> SFOCA.1.RTR.CSO.4500.1
Which in friendly terms, means: San Francisco California, Site 1, router, cisco4500 #1. Now you’ll know right away where the problem is and on what device. In addition to being clearer, these types of conventions are scalable. Even though you may not support multiple sites or cities today, you’ll be ready when your organization grows.

Tip 5: Set rules and alerts.
Red lights and green lights are fine for showing the hard up/down status of devices, but there are many states in between. Take some time to understand normal performance levels in your network then tailor the rules of your NMS accordingly. It will pay off if you can be alerted when conditions start to deteriorate and allow you to respond before customers experience a problem. For example, monitor the interface utilization of end users or the switch ports they are on. If a user switch port is at 70% utilization, you may want to be alerted of high bandwidth consumption. On the other hand, bursts above 70% may be normal for your users, so that type of rule would cause an excessive amount of false positives. Instead, some systems will let you set alerts only when the interface utilization stays above 70% for an extended period, say 30 minutes.

Take some time to consider these five tips and if you have any feedback let me know.

Using SNMP for Network Troubleshooting

2009-08-21T17:42:00.002-04:00

Here is a network troubleshooting tip to consider. Simple Network Management Protocol (SNMP) is used for getting notifications and performance data about networking devices. It can also be useful in a non-traditional way as well.

When most networking devices are very busy they stop responding to management requests and focus on core routing or traffic-level tasks. As a result, if you see increasing SNMP response times or worse complete SNMP response failure, it’s likely a leading indicator that a device’s performance is nearing the user impact stage. The device may not be down yet but, it very well could be shortly. Use this indicator to your advantage and start monitoring SNMP response time and failure rates. Be sure to keep a close eye on these devices and you’ll know about problems before it's too late.

Why use SNMP v3?
Need stronger security than community strings and access lists can provide? Consider moving to SNMPv3 if you haven't done so already. SNMP v1 and v2 are sufficient for many networks. When management traffic must pass over the public Internet, however, SNMP v3 provides improved message security that can be important.

Enhanced security features in SNMPv3 include:

- Message integrity to ensure a packet has not been tampered with in transit.
- Authentication and verification that the message is from a valid source
- Encryption of packets to prevent snooping by an unauthorized source

Whirlwind Tradeshow Tour...

2009-08-19T08:57:00.003-04:00

This week I'm in Ft. Lauderdale at the LandWarNet show and next week I'm off to AFITC in Montgomery, AL. The whirlwind tour is off to a good start. The skies are bright and no hurricanes are on the forecast. For those that won't make it to LandWarNet this year, I'll be updating the blog with some information about the show and the seminar tracks.

It's always interesting to see what technologies industry is providing the military to improve their information advantage in the battlespace at these shows. If you're interested in learning about some solutions Kratos Defense will be presenting drop by booth #1513 at LandWarNet and booth #542 at AFITC. We are going to be demonstrating some interesting solutions including example workspaces created to provide Program Managers with a centralized view of all project related information, business intelligence dashboards displaying operational metrics, network management solutions for strategic and tactical networks and learning solutions to optimize workforce development.

Hope to see you soon.

Preview the next set of Free Network Utilities…

2009-08-14T16:48:00.005-04:00

I just finished previewing three free network utilities that Kratos Defense & Security Solutions has developed. These have NOT officially launched yet, but I wanted to give blog readers the first crack at downloading and checking them out. You can choose from Army or Air Force skins (or both) and use these utilities from your desktop to:

1. Test download speeds (nice to know if your T1 is doing well)
2. Monitor any SNMP OID metric (Poll a CPU Utilization from a router etc…)
3. Monitor Syslog events (I sent a few firewall activities at it)

These will officially be released at upcoming Army and Air Force events in late August (LandWarNet & AFITC).

The skins make for a very cool display, everybody that came by my desk today asked about them. Just don’t tell anybody where you found the links or, I might not be given the preview next time :)

Free Network Utilities Download Links:

AirForce

Army

Five Ways to Get IT Training Cost-Effectively

2009-08-13T11:09:00.003-04:00

In these tough economic times, keeping up-to-date and sharp with the latest high-tech skills can be very beneficial for the health of your career. Here are five creative ways to get training cost-effectively according to Network World.

1. Share the cost with your employer
One option is to offer to split the cost of training with your employer. It would cost the company more to bring in a new person than to train you in the skills they need. The solution serves both parties well.

2. Train yourself
You can gain a wealth of knowledge from self-study from online courses, books, videos and webcasts. Another resource for IT pros looking to learn is CBT Nuggets, which offers fee-based and free training products online.

3. Build your own learning environment
Building a home lab can help progress your career and be done cost-effectively (in some cases). Finding used parts and complimentary software can help with Microsoft and Cisco self-training. Check Microsoft for free trials of their products online and open source tools. Two open source projects worth reviewing include Dynamips, for simulating Cisco networks, and Olive for simulating Juniper networks.

4. Practice your skills
Use your knowledge and skills to help friends, family, charities or small businesses at low or no-cost to gain valuable experience. The effort can pay dividends on your resume and help you learn about new technologies without investing in training. This can also serve as the start of your own business.

5. Look for training discounts
Many training vendors are offering significant discounts because of the recession. It may be worth the time to do a little research to find some cost-effective training. Many vendors offer educational content at events and online as part of their marketing efforts. Keep an eye out for specific opportunities at your favorite vendors’ websites and for upcoming low cost or complimentary technology tradeshows.

Maintaining Network Awareness with Twitter…

2009-08-07T17:25:00.008-04:00

Wanted to try a fun experiment and feed my network management alerts to Twitter instead of my email. Now let me explain, I’m using this for the alerts that are between super critical that need my instant attention (and are emailed to me) and those that can simply sit and wait all weekend or more for my attention (i.e. when I feel like looking at the NMS screen). By sending some events to Twitter (its on my phone and TweetDeck is on my pc) I can maintain “network awareness” while tweeting J or on the go.

Using the dopplerVUE network management tool, all alerts can be sent to a .Net assembly. Since Twitter has an API this part was simple – email me and I’ll send you the necessary files so you can create updates with your own Twitter account information.

Here are the steps to implement a twitter feed (takes about 5 minutes).

The ABCs of adding a twitter feed to dopplerVUE
A. Update your system with the new twitter.dll and EventService.exe.config files
B. Create a Twitter action that can be re-used.
C. Define a rule that will use the Twitter action

A – Updating the dopplerVUE system
1. Add the twitter.dll to the //systechnologies/dopplerVUE/Server folder
2. Back up your existing //systechnologies/dopplerVUE/EventService.exe.config file and replace with the new one provided.
3. Edit the EventService.exe.config file user and password lines with your actual Twitter account username and password.
4. Preference>dopplerVUE System>dopplerVUE Services Then restart the dvEventService and dvDataService

Now the Twitter action is ready to use.

B - Create a reusable Twitter action
1. Expand the NetOps> Action tree
2. Right Click on Actions and select Create Action
3. Enter an Action Name
4. Select Action Type: Custom DLL
5. Enter the assembly value of: Twitter.dll
6. Select Create.

C- Define a rule that will use the Twitter action
1. Expand the NetOps>Metric>Rules tree
2. Right click on an existing rule and select edit
3. At step 5, expand the Custom DLL folder and select the Tweet This! Action
4. Select Finish.

LandWarNet2009…IT in the Battlefield…

2009-08-05T10:32:00.002-04:00

One of the cool parts of my job is that I get to attend a variety of technology tradeshows. On August 18th-20th the LandWarNet 2009 conference will be held in Ft. Lauderdale. If you want to see an interesting collection of IT products mixed with military gear like radio controlled mini robots that hold assault rifles, this is the place for you. If you are attending, please come by the Kratos booth (#1513) and say hi. Send me an email in advance and I’ll be sure to have an extra special gift waiting for you (compliant with govt. policies of course).

Will you Cause the Next Cyber Security Breach?

2009-08-03T14:34:00.002-04:00

Friday’s edition of the USA Today contained an interesting article on the front page of the Money section “Virus targets firms’ financial accounts”. It goes on to explain how the Clampi virus is focused on attacking business computers where the administrator account is being used. Once hijacked, this account is then used to access PCs that perform banking transactions. Once the virus gains access to banking information, the damage can be quite severe.

The article discusses a series of steps to prevent these types of breaches, but, one in particular stands out. Don’t use your administrator privileged account for anything other than administrator duties. Create and use a “Normal” account for your day-to-day duties and ANY time you are surfing the net.

IT staff often use their admin accounts for everything. It’s simpler and saves time. Of course, this posting is written using my admin account… promise by tomorrow I’ll stop using it…

Getting A Handle On Dropped Packets – 4 Key Troubleshooting Tips

2009-07-30T13:39:00.001-04:00

In today’s net-centric environment, organizations often depend on the network for voice over IP, video conferencing and webcasts. Network problems caused by packet loss can create noticeable performance issues.

Is packet loss a problem your organization is experiencing? Could it be contributing to larger problems? One thing’s for sure, almost every network experiences packet loss to one degree or another. Dropped packets can originate in almost any part of the network path, from bad cables to flakey applications. Here are a few common causes and what you can do to fix them:

1 . Find the source. First, understand where the packet loss is occurring. The command line tracer tool helps determine the exact location. Then, learn the extent of the problem by using the “Netstat –s –p tcp” command. This will display the total segments sent and total segments retransmitted. (Check out this site for more information on how to use command line tools)

2. It's probably the cables. More often than not, it’s this simple. Check that nothing has been placed on top of the cable and that the connections are tight. Test by replacing the potentially bad cable with a known good one. Frequently, very long cables will only show excessive problems when they are processing a heavy load.

3. Check for duplex mismatches. Many systems auto negotiate the duplex speed, however errors do occur. Consider manually setting it to a known level and see if the problem goes away.

4. Unleash the routers! If your routers are overwhelmed, they will drop packets. Check for excessive utilization across each link and make sure the system overall is not saturated. Not all routers drop packets at the same traffic level. Some Cisco routers can begin dropping packets at a CPU load of 50%; on other models this may not occur until 95% or more.

Tip for dopplerVUE users: The Locator view lets you sort all interfaces by packet loss so you can isolate the location of dropped packets instantly.

Taking Advantage of Network Virtualization

2009-07-24T15:16:00.002-04:00

I’ve been hearing a lot about the benefits of virtualization for network management. From improved productivity to increased efficiency, network virtualization holds much promise. However, for all the benefits that virtualization brings to the field of network management, it also brings a few challenges.

How do you keep track of your virtual assets and real ones? Do you need a special team, tools or hardware to get the job done? It turns out that the most popular virtualization system (VMware), makes this an easy job for most network management systems when configured correctly.

VMware’s workstation product gives you three choices for network virtualization: Bridged, NAT and Host Only.

Bridged: This mode creates a virtual switch that sits between the host NIC and the VM instance. The VM instance looks like another PC on the network, it shares the host NIC resources and has an IP Address assigned via DHCP or static entry. A bridged VM instance looks and feels very much like a separate server on the network. It provides full monitoring capabilities similar to that of the host.

NAT: NAT mode uses the host machine's IP address to communicate with the network. As a result, no external IP address is assigned and the VM instance is not visible to the external network. This method provides a high level of security, but does not allow you to poll the VM instance directly. This method requires additional specialized software and agents.

Host Only: This method sets up a network that is completely contained within the host. It has no ability to communicate with the outside world. You will not be able to see the VM instance at all.

As you can see, the methods used for setting up networking on a virtual instance will determine what an IT management application will “see” and monitor. While this example is specific to VMware, most products offer similar options.

If you’re a dopplerVUE user you can create a group and associate the virtual devices to a physical device. dopplerVUE groups provide a view of all alarms and performance overlays in a single view, and allows drill down access into the performance of each virtual server.

Free Cyber Security Training! – No catches (ok you have to be a US citizen)

2009-07-23T11:27:00.003-04:00

FEMA has put together a nice Cyber training website that is open to all US citizens. Once you enroll, there are a variety of courses on Cyber security (listed below) for both the technical and non-technical.

I took the program on “Network Assurance” and found it to be well written and learned quite a bit. It filled in some gaps and adjusted my knowledge on some terminology.

Where Is All This Traffic going?

2009-07-17T15:17:00.007-04:00

Have you ever wondered where all the network traffic is going? The standard SNMP data gives an overview of all traffic in and out of an interface, but little in the way of details regarding source/destination and protocols in use. To learn where the traffic is going and what protocols are in use, you should check out what flow-based products can provide. The most popular is NetFlow, although there are other similar products available as well (JFlow, sFlow, etc…). Each product version has a few unique attributes, but they all provide a core set of information.

So what does a flow based product do?
It provides an answer to the question,“Where is the traffic going?”. Netflow displays the top source and destinations (who and what destination IP), and does packet level inspection of your network traffic to check for source and destinations and ports and protocols. So, not only can you tell who is going to what server or website, but you can also tell what port and protocol is being used. This can often be used to identify popular applications and external “resources”. Here are some sample Netflow reports:

With this report I can see the top conversations – multiple people hitting the same IP.

Here I can learn more about the type of traffic on my network.

And here I can see the top sources coming into my network. Very helpful as a supplement to your security measures.

*Note – the IPs have been changed to protect the innocent. A 192 address would not normally be an incoming source.

What do you need to get started with Netflow?
NetFlow is already installed on many Cisco routers, so make sure to check the Cisco website for your model and version or buy a Netflow enabled router. You’ll also need a Netflow enabled network management system to create quality reports. Keep in mind, monitoring flow based data is information intensive and will use resources on the router and storage space on your network management system. One option to save storage space is to use Netflow on demand: only enabling the monitoring when necessary to troubleshoot.

It’s not hard to configure!
Here is a sample of the steps for setting up NetFlow v5:
1) Enter global configuration mode on the router, and issue the following commands for each interface on which you want to enable Netflow:

a) Router#configure terminal

b) Router >(config)#interface {interface} {interface_number} (Example: interface FastEthernet 0/1)

c) Router >(config-if)#ip route-cache flow

d) Router >(config-if)#exit

Export Netflow data to your netflow enable network management system:

a) Router#enable

b) Password:

c) Router#configure terminal

d) Router >(config)#ip flow-export 9996

e) Router >(config)#ip flow-export version 5

There is much to learn about Netflow. When you’re ready for the deep technical stuff, check out this Cisco article.

Network Troubleshooting: IP SLA+ WMI = Better Web Services

2009-07-14T15:31:00.004-04:00

Why is the network so slow? I’m sure you’ve never heard this complaint before :) Diagnosing the problem isn’t always easy with so many possible culprits. You can start by running down the network troubleshooting checklist:
The DNS service?
The web server?
The WAN link?

IP SLA and WMI information is critical to diagnosing potential network problems. For most Cisco devices, IP SLA can give you performance information for the connectivity layers of a net-centric service like a web application or VoIP. In Microsoft environments, WMI can do the same for the application/server/desktop layer. Combining WMI with IP SLA provides performance information about both layers and gives an end-to-end view of your web application or other net-centered service to most efficiently troubleshoot any issues.

Using IP SLA to Access the User Experience
IP SLA (Internet Protocol Service Level Agreements) is embedded in the Cisco IOS (Internet Operating System) for most Cisco routers and switches. IP SLA operations can measure delay (round trip time), jitter, packet loss, connectivity, voice quality scores, and many other key metrics for monitoring and troubleshooting network elements.

Additionally, threshold levels can be set for most metrics. When a metric crosses a threshold level, IP SLA sends an SNMP trap to the specified IP addresses.

You can configure an IP SLA HTTP operation to monitor the overall user experience for the “connectivity layer” of a web application (or any other net-centered application such as email, VoIP or videoconferencing). This operation uses a synthetic web transaction to measure the total round trip time (RTT) to perform a DNS query, establish a TCP connection to the HTTP service, and retrieve the web site’s home page. By configuring the HTTP operation on the LAN switch closest to users, the total RTT (or latency) is an accurate measure of the users’ experience (as opposed to measuring RTT from a central network management server).

Next, configure an IP SLA ICMP Echo operation to monitor RTT between the switch on the user LAN and the switch to which the web server is connected. This way, if the HTTP operation indicates the web transaction is slow or unresponsive, you can check the WAN RTT between the switches to see whether the problem is related to the WAN link or something on the web server.

Watching the Applications and Servers: Adding WMI
WMI (Windows Management Instrumentation) is an instrumentation tool similar to IP SLA that Microsoft has created for its products. WMI provides thousands of performance metrics for applications such as MS Exchange and MS SQL Server, as well as for server hardware and operating system components.

Microsoft has a built-in performance administration tool for monitoring WMI data for applications and servers. Using the tool you can view each server’s CPU utilization, physical memory and free disk space. Each of these sub systems is critical to the server’s performance regardless of the application running. Lack of memory, CPU cycles and low disk space are common causes of slowdowns on a server. You’ll have to go into each server to view the individual performance counters or you can use network management software to simplify the process by collecting any of the thousands of available WMI counters from across multiple servers.

Getting the End-To-End View
An end-to-end view of the network will really help you troubleshoot network problems much faster and avoid the common complaints you often hear. To get an end-to-end view consider network management software such as dopplerVUE that integrates fault and performance data from a variety of sources, including SNMP, syslog, WMI and IP SLA, you can integrate metrics from both layers of a web service into a single end-to-end dashboard view. Using dopplerVUE’s drag-and-drop interface, you can quickly create an integrated view of both layers of the service without having to shift between tools or viewers (screenshot below).

Heading Off Trouble with Exchange Servers

2009-07-13T17:11:00.006-04:00

I recently discussed the frequency of email failures in a June post. As a follow-up I wanted to provide some practical tips on managing Microsoft Exchange Servers to ensure the highest possible service levels for your users and head off problems before they become critical.

For Exchange servers, Microsoft's Windows Management Interface (WMI) performance counters provide a simple and effective method for monitoring Exchange servers. If your network management solution supports WMI, you can easily leverage WMI to manage Exchange servers.

Monitoring Queue Size
With over one thousand WMI performance counters available for an Exchange server, you can get very sophisticated in managing your devices and processes. For most people, however, the following counters for the Information Store service can provide a good indication of overall Exchange performance.
- MSExchangeISMailbox:SendQSize
- MSExchangeISMailbox:ReceiveQSize
- MSExchangeISPublic:SendQSize
- MSExchangeISPublic:ReceiveQSize
These counters reflect the message queue sizes for each instance of the public or mailbox stores. Although brief spikes are not uncommon, all of these counters should be close to zero during normal operations. Queue sizes that do not return to nearly zero within 10 to 15 minutes indicate a potential issue with message routing or service processing; however, larger environments may have queue sizes ranging from 5 to 10 while exhibiting acceptable performance. For these environments, queue sizes between 5 and 10 are not uncommon.

Another counter to consider is the MTA Work Queue Length (MSExchangeMTA:WorkQueueLength), which shows the number of queued messages being sent to or received from email servers other than Exchange Server 2003. A queue size that consistently exceeds 10 or 20 messages may indicate a problem with the MTA service.

Monitoring Email Delivery
Additionally, six more performance counters related to email delivery can provide a more rounded view of Exchange server performance. The counter values are unique to each environment, but monitoring them over time provides a baseline for a server’s steady state performance.
- MSExchangeISMailbox:AvgDeliveryTime(s)
- MSExchangeISMailbox:MsgsSentPerMin
- MSExchangeISMailbox:MsgsDeliveredPerMin
- MSExchangeISPublic:AvgDeliveryTime(s)
- MSExchangeISPublic:MsgsSentPerMin
- MSExchangeISPublic:MsgsDeliveredPerMin

Average delivery time values should be in the range of 600 to 900 milliseconds. Values greater than 1500 milliseconds indicate a performance problem. While the number of messages sent and delivered per minute is mostly informational in nature, it provides a good indication of general performance.

Monitoring Server Performance
To effectively monitor an Exchange server, it is important to monitor the underlying server resources as well. Again, there are thousands of available performance counters, but the following counters offer a good overview of server performance and resources without swamping you in data.
- Processor:%ProcessorTime. Processor or CPU utilization, on average, should be less than 70%. Utilization greater than 85-90% for more than 30 minutes, or 90-100% for more than 10 minutes, indicates an overloaded server.
- PagingFile:%Usage. The paging file for virtual memory should be less than 75%. Excessive paging, say 85-90% for any period of time, is cause for concern.
- Memory:AvailableMBytes. Physical memory values below 20MB indicate insufficient RAM.
- LogicalDisk:%DiskTime. The amount of time a disk spends reading and writing data should be in the neighborhood of 60-70%, although brief spikes are not unusual.
- LogicalDisk:%FreeSpace. Exchange uses a lot of disk space, so overall free space should be monitored closely. The Windows and Exchange volume should have 256MB of free space; the Exchange database volume should have 1GB of free space; and the transaction log volume should have 100MB of free space.
- NetworkInterface:CurrentBandwidth. Acceptable interface bandwidth will depend on the type and size of the network, but generally speaking the average bandwidth should be 50-60% of maximum capacity.

If your network management solution doesn't support WMI or you are looking for a proven solution consider dopplerVUE. It provides powerful network management capabilities in an easy to use software package.

Monitoring Bandwidth Part 2: Examining SNMP Traffic Data

2009-07-10T12:02:00.010-04:00

Let’s start by discussing what we really want to know about bandwidth:

1. How much is moving across any given interface?
2. Is the interface maxed out?
3. Is the device or devices beyond this one slow (or down)?

SNMP MIB-II enabled devices provide the following key metrics that will be used to derive answers to 1 & 2.

ifSpeed - The interfaces current bandwidth in bits per second
ifInOctets - The total number of octets received on the interface
ifOutOctets - The total number of octets transmitted out on the interface
Source: RFC 1213

The octet metrics are simple counters that grow as traffic is passed on an interface. Using these metrics we can poll devices two times and use some “simple” math to determine the delta between the polling jobs. This will give us the amount of traffic that has passed in the interval. You can divide this by the amount of time to get an average bit per second rate. Or you could simply use a tool like dopplerVUE that does the math for you (screenshot below).

* Important Tip - The measurement for the size of a file and the speed that an interface passes traffic is not the same. Despite looking and sounding similar each measurement is calculated in a different way. This is a common error. For example, network speeds are notated in bits per second. Files are normally referred to in bytes. There are 8 bits in a byte, then you need to factor in that file notation grows by 1024 not simple 1000s.

Notation examples:
Network Speed
1 Kbps = 1,000 bits per second
1 Mbps = 1,000,000 bits per second
1 Gbps = 1,000,000,000 bits per second

Data file size
1 KB = 1,024 Bytes
1 MB = 1,024 KB
1 GB = 1,024 MB

Now that the amount of traffic is known you can compare this information to the ifSpeed metric to determine the percentage of the pipe that is full. You can figure out the math or let the tools do it for you (dopplerVUE screenshot below).

To answer the final question about if the traffic is causing a slowdown on the network, check the ping response time to the device and devices beyond (if router or switch).

There are many other items we can look at regarding traffic that indicate problems in the network. You can look for packet loss, discards and errors that are occurring (dopplerVUE screenshot below). We’ll explain why these issues occur and how to correct them in a different posting, but you should consider checking these metrics as well.

Cisco Live…Great Training, but Not Much New Technology

2009-07-02T14:44:00.002-04:00

Cisco Live 2009 was this week, if you didn’t attend here are a few observations:

There were MASSIVE amounts of training sessions, high quality keynotes, but not much new in terms of technology at this event. It’s not just a show, it’s a training session. While many of the educational items cost money, not all of them do. Even some of the vendor presentations can offer you insights into the types of thinking you should be considering (see OPNET and their explanation of the types of problems that can cause application delay). Much of the free educational content can be had by getting an online account at the CiscoLive Virtual center.

Cisco recently launched a wiki providing simple content and clear explanations. It still needs to grow some but, the content is a good start for key Cisco products and technologies.

Counted only 3 green/power saving programs – Really in S.F? I expected more considering all the talk about green computing in the industry.

The B-52s and DEVO were the bands for Wednesday night – WOW!!!

If you came looking for new technologies, you would be disappointed. I didn’t see anything that wasn’t at Interop or some of the other shows earlier in the year. I think it’s more about making do with what we have and squeezing out all the value possible.

The next post will be a continuation on how to monitor bandwidth – helping you pack more through the pipes you already own.

Implementing a Bandwidth Monitoring Program: Getting Started

2009-06-26T17:30:00.010-04:00

Nearly every network engineer I work with is either looking for a way to monitor their bandwidth or ways to improve how they monitor their bandwidth usage. So, popularity wins out this week and the next couple of posts will be a series on implementing bandwidth monitoring.

Why monitor bandwidth usage?
We each have our reasons, here are some of mine:

1. When the network slows, lots of people call and complain, and I don’t like that

2. Need to have data supporting when an upgrade to the T1 line is necessary and validation that we are getting the service we have paid for

3. Helps to understand what servers are being used heavily and when the load should be split into multiple servers

4. Lets me identify high bandwidth consumers and adjust the network topology keeping the key users close to their end systems

5. Allows me to locate end users who are downloading high volumes of data and request they stop during sensitive times (executive webcasts etc…)

Getting started: SNMP enable your network
To effectively monitor bandwidth usage it requires that you have a method of accessing the bandwidth consumption statistics for each device. SNMP is the industry standard and works with all major brands of networking devices, server and workstation operating systems. It uses a software agent installed on each device and a collector type system to aggregate and report the data. With SNMP you will be able to collect bandwidth data such as utilization % for each interface, total packets, discards and more. Here is a screenshot of a typical interface display for an SNMP enabled device:

To retrieve this information on a device, you will need to set a community string (aka password) that your monitoring system will use when retrieving the bandwidth statistics. At the bottom of this article are the steps to enable SNMP on Windows and Cisco devices.

For more overview information check out these website links:
http://www.dopplervue.com/bandwidth.php and the tutorial at http://www.dopplervue.com/tutorials_show.php?what=Managing_Bandwidth.

The next blog post will discuss monitoring systems that can gather this data, what to do with the information, alerts and rules that can be set and common reports that you will want to use for bandwidth monitoring.

Enabling SNMP on a Windows System

Windows 2003 and XP
1. In the Control Panel, click Add Remove Programs.
2. In the left pane, click Add/Remove Windows Components.
3. Select the Management and Monitoring Tools checkbox and click Details.
4. Select the Simple Network Management Protocol checkbox, click OK, and then click Next.
5. If prompted, insert the Windows 2003 or XP disc to finish the setup.

Windows Vista
1.In the Control Panel, click Programs and Features.
2. In the left pane, click Turn Windows features on or off.
3. Select the SNMP Feature checkbox and and click OK.

On a Windows system, you must configure security for the SNMP service by adding a community name(s) and permissions to a list of communities that can send it SNMP requests. This is known as a "community string":
1. In the Control Panel, click Administrative Tools, and then click Services.
2. Right-click the SNMP Service, click Properties, and then select the Security tab.
3. In the Accepted Community Names pane, click Add.
4. You may accept the default community rights, and then enter a community name (case sensitive). Click Add.
5. Select Accept SNMP packets from any host, and then click OK.
This ensures all SNMP packets from all SNMP hosts belonging to any community listed in Accepted community names are processed. No SNMP packets are rejected on the basis of the host name or IP address of the source host or the list of acceptable hosts.
6. Ensure the SNMP Service is selected and click Restart the Service to initiate the changes.

Enabling SNMP on Cisco Devices
Log in to the router and enter configuration mode: Router#configure terminal

1. Enable SNMP on the router (note that "public" and "private" are for example purposes):
Router(config)#snmp-server community public RO
Router(config)#snmp-server community private RW
Router(config)#exit

Networking Spending to Keep Steady, Despite Gloomy 2009 IT Outlook

2009-06-23T16:15:00.001-04:00

Came across some information on IT spending that I thought I would share. Spending across IT sectors is set to remain low throughout 2009 and is not expected to pick up until 2010, according to a new report by TheInfoPro (TIP). The bi-annual global survey has seen budget cuts across the board, with only networking holding its own with 36 percent of organizations planning to increase spend (at least there is some good news) compared with 41 percent looking for cuts. This information is in line with Gartner’s survey where nearly half of businesses reduced their IT budgets in the first quarter of this year.

Email Failure – Not Again…

2009-06-17T16:08:00.005-04:00

A common complaint I hear and a pain I’ve experienced myself (too often) is email going down. Email is now the most common form of business communication and its use is only growing. According to Osterman Research, email traffic between 2008 and 2012 is projected to grow by 68%.

In any given 12-month time period, there is a 72% likelihood of an unplanned email outage and a 24% likelihood of a planned email outage in any given company according to a Dell survey.

One major cause of email downtime is network connectivity failures. Connectivity loss can be caused by anything from a hub, switch or router failure to a broken or damaged cable or fiber. Not to mention a whole host of other complicated issues.

To reduce the chance of an outage, consider proactively monitoring and managing your network to avoid a failure or respond as early as possible to a problem – saving you the headache of a bunch of complaints.

The network management software I recommend and work with everyday has the ability to generate alarms based on both network faults and network performance. This integration allows alarming on multiple issues to best anticipate and accurately pinpoint network problems and avoid system downtime. Below is a screenshot showing this functionality.

Put More Value into your Network Where it Matters Most…

2009-06-10T19:33:00.007-04:00

Are you worried about budget cuts in the IT department? These days, budget concerns are fairly common and many IT professionals, including myself, are coming up with ways to show value to their organization. Think about it- beyond email and Internet access, few individuals in the company really understand the complexity of a network and the need to have high-caliber individuals proactively monitoring and managing it.

It’s our responsibility to make that value tangible and put forward a simplified method of displaying the network and quantifying its performance. People understand dashboards very well and the right network display can help them visualize the value of network management in a way that makes sense. I would suggest projecting your network display in your company’s IT or NOC area. This will give decision makers something to show for their investments in IT and make a compelling case that much will be lost if budget cuts occur.

For example, this display (below) shows the status and topology of key resources and additional metrics (total bandwidth in/out network, alarm history, and response time to company sales website) regarding the company website. The availability of the company website and its effect on revenue is always a great reminder of the importance of network management.

Other example maps that I’ve seen that communicate tremendous value are those displaying the entire network connectivity for a specific business process. For example, your HR executive may want to see how the payroll, timecard, and HR intranet website are connected and how much bandwidth is being used by these servers. Making a business process that is critical to successful business operations more transparent is sure to turn some heads.

Weighing in on the new Palm Pre

2009-06-08T15:03:00.003-04:00

Yup! I just got myself a Palm Pre and I really like it so far. The navigation, web surfing, email and keyboard work well and it feels good in the hand. The NASCAR app was an unexpected fun little app (in car live camera views during the race). I've had too many chores around the house to really put it to the test, however, next week I’m traveling and will get a chance to blog more about what I like and don’t like on the phone.

Is SOA dead? – Not at All…According to Forrester Research

2009-06-04T14:14:00.007-04:00

According to a recent Forrester Research survey, SOA is alive and well! Here are a few of the highlights:
- Only 1% of current SOA adopters have received little or no benefit from the methodology
- 60% of IT executives have seen some benefits
- 75% of IT executives and technology decision-makers said they will be using SOA by the end of 2009
- 60% of current SOA users are expanding their use of the methodology
- 30% of respondents appear to see SOA as a potential vehicle for strategic business transformation

This is great news from my perspective, since the network is such a critical success factor for successful SOA implementations.

If you’d like to read further, check out Joe McKendrick’s guest post on TechRepublic’s blog.

Can you Spend Less Money, Time and Effort and Still Go Green?

2009-06-02T14:26:00.002-04:00

Recently I've had several people ask me for advice on how to use their network to become more green without spending lots of time, money or effort. I came across an article that had some common sense ideas that supported many of my favorite thoughts on the topic. Tech Republic’s – IT Cost Cutting: The Ninja Guide is worth a quick browse if you have a few minutes. There are some great suggestions for using VoIP, telepresence, and web meetings to cut phone and travel costs and to embrace telecommuting to go green. Of course, a reliable network is critical to making these initiatives work, so I always mention network monitoring as a key ingredient to success.

Interop Las Vegas in Review

2009-05-29T15:47:00.002-04:00

I spent last week in Las Vegas at Interop and thought I’d share my experience with you. Attendance was definitely down this year, but exhibitor attendance was about the same and booth extravagance seemed to be at an all time high. The exhibitor floor was much smaller and orange seemed to be the color of choice. However, it was easier to spend quality time with attendees that stopped by the booth. I had many great conversations with folks about their network management challenges and the need for enhanced visualization, alarm and bandwidth management and the benefits of all-in-one tools. The conference sessions were worth attending and covered the hottest topics including cloud computing, virtualization, green IT, SOA and web 2.0. I was tweeting live from some of the conference sessions – take a look at the trail of tweets, if you’re interested in some details about each session. All-in-all it was a great trip – got some good leads from the show and came home without losing too much face at the blackjack table.

Minimizing the impact of Alarm Storms...

2009-05-27T17:06:00.008-04:00

I was working with a client today that just converted to dopplerVUE from a “traditional" log system that uses an event viewer to display each individual event. This was a big problem because he could not see how many different types of problems were occurring. The screen refreshed so fast leaving him with a new batch of alerts that he was unable to read or interpret since the last batch of alerts displayed. Let me show you an example of the screen and the problem:

In the below screenshot, identical copies of alarms are displayed in a new row.

Example 1: syslog event viewer

This type of event viewer becomes nearly useless when you are getting a large volume of alarms. Often times, the most valuable alarms are hidden in the clutter and are off the screen before you can react. You can only see the last few alarms and they may not be the critical ones.

These systems provide filtering to help you go back and search the log history. This is good if you want to get more detail about an old alert and you were able to write down or memorize the syntax. But, an even better way exists…

The dopplerVUE and NeuralStar displays are designed to consolidate identical alarms into a single row and display the total count and the first and last time when these alarms began occurring.

Alarm grid from dopplerVUE (http://www.dopplerVUE.com)

In this picture, you can clearly see what the different types of alarms are, how many of them have occurred and when they started occurring. Now, real time monitoring of alarm conditions has value and is actionable. In this display, you even have syslog, snmp performance, snmp traps aggregated side by side for a complete picture.

A Shot of Caffeine While on the Go…

2009-05-17T16:06:00.001-04:00

I found a great cure to satisfy my caffeine addiction while on the go! I was hunting down some registration information on the Interop site for my annual trip when I came across the Handpresso - a small gadget that delivers an espresso wherever you go, whenever you want. Sounds like heaven doesn’t it? On the last day of the show when everyone is starting to drag - an energy boost could be a life saver and make this gadget worth the $100 price tag. Something to think about…

Welcome to the Network Zone…Let’s Talk About Network Management Needs

2009-05-15T14:37:00.002-04:00

Thanks for coming by to read this blog. I look forward to hearing your views and comments on this post and future ones. I’ll keep the posts fun and helpful.

I read a great article on SearchNetworking by Shamus McGillicuddy. It discussed the state of the market for network management products and more importantly, some of the top issues network management staff are facing. Here are some of my take aways from reading it...

There is a clear need for network management that lets engineers move away from spreadsheets, manual processes and tools that simply require too much overhead to use. The proof is in the IDC research that shows the market is growing in these tough times, and it looks like more specialty vendors are becoming both competitors and complementary players in the space.

The article references the network management space as still being part of the Wild West. The growth in new products and modules is staggering. One vendor actually boasts their core product has over 45 utilities (I can only handle about 5-6 tools then its overload).

Often so many tools are being used that it creates a new problem...

"Too many tools can lead to a lack of integration," said Steven Guthrie, director of product marketing at CA. "The success of low-end niche tools in the enterprise tells us that these point products come in for good reasons. But then they outlive their usefulness, and they end up stalling mean-time-to-repair. That data source [in the niche tool] may not sync up with other data sources you may have."

As network engineers, we’re bombarded with new information all the time and simply don't want or have the time to keep learning and finding the right application when a crisis occurs. A central point of management is necessary. Shamus was right on when he wrote...

"But, clearly, IT pros would love to consolidate the number of management tools they use on a daily basis, if for no other reason than to save money and make their operations more efficient."

Tools that have a single database, can consolidate multiple sources of information and have a low maintenance overhead will ultimately win out. In the long run they make your life simpler.

To read the full article on SearchNetworking.com http://searchnetworking.techtarget.com/news/article/0,289142,sid7_gci1355151,00.html