[comp.protocols.tcp-ip] Looking for comments on network analyzers

marcus@cpva.saic.com (Mark Jenkins, (619) 458-2794) (03/29/91)

We have been evaluating network analyzers.  The list has been narrowed to the
Network General Sniffer, Micro Technologies LANager, and the Novell LANalyzer.
Our prime protocol requirements are TCP/IP, DECnet, and Appletalk, with Novell,
NFS,  and OSI to follow at some point in the future.  Physical media types are
limited to various Ethernets right now, although being able to snoop on V.35
WAN links (between routers) would be a bonus.

The Sniffer and the LANager are very similar, because MTI buys the Sniffer
software from Network General and supposedly reworks it slightly.  MTI seems to
be able to price the LANager better than the Sniffer.  The Novell LANalyzer is
nothing like the Sniffer or LANager, but costs substantially less (about 1/2
the price with a discount).

Does anyone have experience with any pair of these to offer a basis for
comparison?  We have demo'd the Sniffer and the LANalyzer, but its hard to tell
without extensive use just how handy some of the features are.  Very often
*some* kind of analyzer is better than no analyzer at all.

The protocol decoding and various media support capabilities (Ethernet, V.35
WAN, LocalTalk) of the Sniffer-type analyzer are great, but are they worth the
extensive extra $$$s, especially the extra $$s per protocol suite over the
Novell LANalyzer cost?  Just how does the LANager differ from the Sniffer - are
they exactly the same or substantially the same?

Please email any comments/critiques/information to me below.  I'll send
summaries (including my own information) to persons requesting them via email.

Thanks very much in advance for any help -

-- 
Mark Jenkins, SAIC         CPVA::Marcus - SPAN    [28119::Marcus]
Marcus@CPVA.SAIC.COM or Marcus%CPVA.SPAN@sds.sdsc.edu (elsewhere)

lanmaint@nssdcb.gsfc.nasa.gov (Dave Yoest) (03/29/91)

In article <5336.27f1d691@cpva.saic.com>, marcus@cpva.saic.com (Mark Jenkins, (619) 458-2794) writes...
>We have been evaluating network analyzers. 

> (* TEXT DELETED *)
> 
>Does anyone have experience with any pair of these to offer a basis for
>comparison?   
> (* TEXT DELETED *)

>-- 
>Mark Jenkins, SAIC         CPVA::Marcus - SPAN    [28119::Marcus]
>Marcus@CPVA.SAIC.COM or Marcus%CPVA.SPAN@sds.sdsc.edu (elsewhere)


We have a LANALYZER (bought from Excelan before the Novell buyout)
that we have used for 4 or 5 years. I have also demo'ed the SNIFFER
and find them to be comparable. In my opinion the SNIFFER is just
a little better at protocol decoding and the LANALYZER is a little
better at finding physical layer hardware problems. Overall they 
are just about equal, If you're more into protocol "problem tracking"
then you might be better off with the SNIFFER. If you do more hardware
problem solving then the LANALYZER might be a better choice.


Not to cloud the issue since you have already narrowed the field, but 
did you look at the Hewlett Packard 4972 LAN protocol analyzer.
I like it better than both the SNIFFER and LANALYZER (my opinion).
If you add the plotter option then you can also use the 4972 to
create some really impressive multicolor graphs/charts for 
presentations on paper or overhead projector transparencies.
It also doesn't "drop" packets on very busy ethernets.

Dave Yoest
LAN section Supervisor 
Allied Aerospace/Bendix Field Engineering
NASACOM/Telecommunications Branch 
Code 543.8
NASA/Goddard Space Flight Center
Greenbelt, Md 20771 USA

DYOEST@ZAPHOD.GSFC.NASA.GOV
DYOEST@128.183.43.16 

snorthc@relay.nswc.navy.mil (Stephen Northcutt) (03/29/91)

Mark Jenkins, SAIC  writes:
>We have been evaluating network analyzers.  The list has been narrowed to the
>Network General Sniffer, Micro Technologies LANager, and the Novell LANalyzer.
>Our prime protocol requirements are TCP/IP, DECnet, and Appletalk, with
Novell,
>NFS,  and OSI to follow at some point in the future. 

We have two of the three you listed, HPs and several others you didn't.
They all work.  For what its worth I kinda like FTP SW's LANWatch product,
because it is so convienient, many times, I happen to be on the
same subnet as the problem, so all I have to do is turn on my PC.
The price is also a factor in LANWatches favor.

In conjuction with a piece of simtel-ware called robo-key, we have
been able to use lan watch to collect data on far flung subnets,
then use ftp sw's rcp/rsh to beam the data up to a unix system for
awk processing; works pretty durn well.
===================================================================
Stephen Northcutt (snorthc@relay.nswc.navy.mil)     News Admin
Work: (703) 663-7745                                High Speed Nets 
Home: (703) 371-4184                                Local GOSIP guru 
Paper Mail: Code E41, NSWC, Dahlgren VA 22448       Parallel Research

adams@ADAMS.PC.CS.CMU.EDU (Duane Adams) (03/30/91)

Brian,
Thanks for the input.
Duane

elf@oldearth.EBay.Sun.COM (Ed Fleschute) (04/12/91)

In article <4669@dftsrv.gsfc.nasa.gov>, lanmaint@nssdcb.gsfc.nasa.gov
(Dave Yoest) writes:

|> (TEXT DELETED)
|> We have a LANALYZER (bought from Excelan before the Novell buyout)
|> that we have used for 4 or 5 years. I have also demo'ed the SNIFFER
|> and find them to be comparable. In my opinion the SNIFFER is just
|> a little better at protocol decoding and the LANALYZER is a little
|> better at finding physical layer hardware problems. Overall they 
|> are just about equal, If you're more into protocol "problem tracking"
|> then you might be better off with the SNIFFER. If you do more hardware
|> problem solving then the LANALYZER might be a better choice.
|> 

I'll second the evaluation that Dave has performed.  The LANALYZER is
a great tool for doing physical layer analysis.  If you are experiencing
hardware problems on a cable the LANALYZER is phenominal at pinpointing
the source of the trouble very quickly.

The SNIFFER is excellent at higher level protocol analysis.  If I was looking
to find a NFS protocol bug I definitly would prefer the SNIFFER.


|> 
|> Not to cloud the issue since you have already narrowed the field, but 
|> did you look at the Hewlett Packard 4972 LAN protocol analyzer.
|> I like it better than both the SNIFFER and LANALYZER (my opinion).
|> (TEXT DELETED)
|> 

Two things I don't like about the HP 4972.  

	1) It is VERY heavy.  If this isn't going to be mounted in a rack
	   or on a cart, get something else.

	2) I found the HP difficult to program.  With the software they
	    had two years ago it was difficult to do a display sorted on the
	    hosts with the highest error counts.  This may have been updated
	    in the last couple of years.

 
Ed Fleschute (My opinion only)