If you answered "protocol analyzer" to all three questions, you're in good company. Network administrators count on protocol analyzers the same way doctors rely on stethoscopes and carpenters depend on nail gu
ns.
Agilent Technologies, a Hewlett-Packard spin-off, claims its portable, Windows-based Agilent Advisor PC can analyze virtually any kind of traffic and can connect to any type of network segment. The company says the Advisor can capture every frame from even the fastest, busiest network and can even monitor WAN links for service-level agreement compliance. To find out if Agilent's claims were true, we asked the company to submit a unit to our Connecticut lab for review.
Agilent's odd-looking PC device pleasantly surprised us with the number of protocols it could decode, the ease with which we could connect it to various points in our network and the sophisticated engineering design it exhibited. The software's Multiple Document Interface (MDI)-like interface even let us run a number of network tests concurrently, despite Windows 98's primitive multitasking environment. The Agilent Advisor competes favorably with protocol analyzers such as Network Associates' hardware-version Sniffer or Wandel & Goltermann's hardware analyzers.
An agile tool
Agilent's protocol analyzer, formerly called Internet Advisor, is a laptop-sized (not notebook-sized) PC specially constructed to accept a data acquisition undercradle for the actual capturing and buffering of network messages. The undercradle contains its own CPU and memory along with a variety of network connectors. The PC, which Agilent terms a mainframe, has a 300-MHz AMD K6 CPU, 128M bytes of RAM, and a 2.5G-byte hard drive, but no built-in CD-ROM drive. The Fast Ethernet undercradle we tested has connectors for 100Base-TX/10Base-T (hub and switch), Ethernet attachment unit interface and Fast Ethernet media independent interface. The PC has built-in V-series interfaces (RS-232C/V.24, RS-449/422/423, V.10/V.11 and V.35) and a slot for ISDN Basic Rate Interface and Primary Rate Interface, T1, E1, E3 and Synchronous Transport Module-1/OC-3c slide-in modules. Agilent also offers undercradles for Ethernet, switched Ethernet, Gigabit Ethernet, FDDI, Token Ring and STM-4c/OC-12c (622M bit/sec ATM) as well as analog Foreign Exchange Office and E&M interfaces for voice-quality testing.
Connecting the Advisor alternately to our Fast Ethernet LAN, a T-1 line and a frame relay DSU/CSU port was simple and straightforward. The software's frame relay analyzer separately decodes traffic for all Data Link Connection Identifiers, identifies top talkers, displays the distribution of protocols flowing through the link and, using Frame Relay Forum specification FRF.13, shows trafficc statistics such as the number of packets bursting above the committed information rate (CIR). The result is an accurate and detailed look at frame relay usage that, unlike the measurements by software products offered by DSU/CSU vendors, doesn't depend on the brand of DSU/CSU you have. The frame relay analyzer module also successfully decoded traffic in our voice over frame relay tests.
Agilent says the Advisor can decode more than 400 protocols. It had no trouble with any of the varied mix of traffic we subjected it to, which included the frame relay cells, streaming video, Oracle TNS and Sybase/Microsoft TDS database transactions, AppleTalk, High-Level Data Link Control, Network Information Services, NetWare Core Protocol, Server Message Block, a range of Cisco discovery and routing protocols and even Multicast Open Shortest Path First (MOSPF) messages.
The Advisor performed reliably and accurately in most situations. It became unresponsive in the Windows 98 environment only once during one of our long-running tests.
Impressively, the intuitive Windows-based user interface let us run several tests (Agilent calls them measurements) concurrently. Among these are an expert mode test for troubleshooting general network problems (such as those needing point-to-point filtering of specific traffic), an IP device discovery test, NetWare-specific tests (for problems such as a client that's not able to find the nearest server), address resolution tests, media access control-layer node tests, various tests for gathering statistics and a test for generating traffic to produce a known load on the network. The ability to send SNMP alerts to a network management product is a feature we would've liked included in the Advisor.
We also tested the software-only, less -expensive version of Agilent Advisor. Naturally, it lacks the Advisor PC's plethora of connectivity options and the data acquisition undercradle for assuring the capture of every single network message, but the software version sports the full protocol decode and analysis ability we found on the Advisor PC. Installation on an 850-MHz notebook was child's play. We additionally used Agilent's $695 reporting option to create useful and effective baseline reports, as well as capacity planning analyses. Moreover, the software didn't miss a frame when we flooded it with streaming video over Fast Ethernet. The Agilent Advisor documentation is comprehensive and easy to follow.
The different Advisor configurations cover virtually every possible type of network and protocol you'd need to diagnose or measure, and they work well. If you don't already have a protocol analyzer, or are thinking about adding more analyzers to your network, we recommend you look closely at the Agilent Advisor.
