pleticha@mpad.span.nasa.gov (Dennis Pleticha/MDSSC-ESD @ (713) 283-4207) (09/01/90)
I've noticed that the interfaces statics from our cisco don't correlate well with those of the Network General Sniffer hanging off the same interface. In particulare collisions, framing errors, runts, and CRC errors reported by the cisco router is orders of magnitude greater than those of the Sniffer! Who do I believe and/or should I be concerned? Thanks, Dennis Pleticha (713) 283-4207 pleticha@sweetpea.fmnet.jsc.nasa.gov or pleticha@mpad.span.nasa.gov
hedrick@athos.rutgers.edu (Chuck Hedrick) (09/02/90)
There is some ambiguity about what errors should be reported. E.g. do you report errors only in packets addressed to you, or in all packets? (If a packet is damaged, there may be no way to tell reliably who it is addressed to.) When there's a collision, there are typically fragments of packets, which one could conceivable report as runts, etc. I believe the MCI's generally report everything they see, and they're fast enough to see a lot. Other vendors may have made more conservative choices. Generally it's not clear that these differences in philosophy matter. As long as a given interface works consistently, you can tell when a net is degrading and needs work. In my opinion the higher error rates on MCI's are not a problem, and may even be an advantage. Apparently cisco has gotten enough flack about this that they are going make changes to reduce the number of errors reported. I'm a bit worried about this. I rely on the fact that I can look at error counters on our cisco boxes to show the overall health of the network attached to it. This may no longer be true if cisco starts being careful to report errors in packets only if they can be identified as being addressed to the specific interface. I'm hoping that if they really do change, they'll provide me a configuration option to keep getting the old behavior.
oberman@rogue.llnl.gov (09/02/90)
In article <25514@boulder.Colorado.EDU>, pleticha@mpad.span.nasa.gov (Dennis Pleticha/MDSSC-ESD @ (713) 283-4207) writes: > > I've noticed that the interfaces statics from our cisco don't correlate well > with those of the Network General Sniffer hanging off the same interface. > In particulare collisions, framing errors, runts, and CRC errors reported by > the cisco router is orders of magnitude greater than those of the Sniffer! > Who do I believe and/or should I be concerned? My experience with the Sniffer is that it is a good protocol analyzer, but a so-so network analyzer. I also use an HP analyzer and it shows far more errors and such than the Sniffer. Because the Sniffer uses a more or less standard interface, it can't seem to see some types of errors. The HP has a fully custom interface and seem to catch EVERYTHING. (But it's not much of a protocol analyzer.) I suspect that the counts on the cisco are correct. R. Kevin Oberman Lawrence Livermore National Laboratory Internet: oberman@icdc.llnl.gov (415) 422-6955 Disclaimer: Don't take this too seriously. I just like to improve my typing and probably don't really know anything useful about anything.
doerfler@hpccc.HP.COM (Mike Doerfler) (09/05/90)
>My experience with the Sniffer is that it is a good protocol analyzer, but a >so-so network analyzer. I also use an HP analyzer and it shows far more errors >and such than the Sniffer. Because the Sniffer uses a more or less standard >interface, it can't seem to see some types of errors. The HP has a fully custom >interface and seem to catch EVERYTHING. (But it's not much of a protocol >analyzer.) We did some investigation into the very same situation. What we found out is that the cisco's can increment multiple error counters on one error. Take collisions for instence, collisions can result in multiple increments of runts, collisions etc. As far as the HP4972, it is a very good product but does not catch everything. There are some runt filters that when activated can fillter out information that you may what to see. My recommendation is read through the manual and deactivate the runt filtering capabilities and take a closer look. As far as the HP4972 not being a very good protocol analyzer, you need to puchase the approprate software to run on the analyzer to get better results. Contact HP for ordering information. Mike, HP