Troubleshooting Remote Site Networks – Best
Contents
1. trunks to the desktop are becoming more common especially in VoIP deployments which support multiple broadcast domains together with both untagged and tagged traffic It is therefore necessary to be able to detect all VLANs on a link and measure the traffic distribu tion across all those VLANs In addition traffic statistics on a specific VLAN to allow discovery generate traffic and capture traffic only on that selected VLAN is essential to identify protocols top hosts and conversations limited to that particular VLAN Baselining It is also necessary to baseline the existing remote network not only to create documentation of the current network state but also to understand what normal traffic levels are at the remote site This provides a reference to work from in order to determine abnormal activity and be able to measure against to validate potential problems Fluke Networks www flukenetworks com 2 White Paper IT staff must evaluate current network performance including traffic patterns with protocol and application usage bandwidth utilization Internet connectivity and last but not least potential network vulnerabilities To provide this level of information it is necessary to deploy a network analyzer at the remote site accessible from corporate headquarters to make the process outlined above easier 2 OptiView Reporter testnet103 testnetwork com 010 248 001 000 Current aga Fie view Agent Pr2. staff members are off site because data can be shared by launching a Soons multiple user interfaces with the analyzer for assisted analysis and EO carmen ii collaboration during implementation 7 prem NETBIOS DGM NETBIOS NS NTP The OptiView analyzer then provides discovery information on SNMP DOMAIN SRYLOC network and device problems and identifies protocols in seconds It also speeds reporting for complete infrastructure documen tation With the OptiView analyzer network professionals can conduct a complete inventory of all network devices where they re connected and which services are running on them It can do ren PEA N OpriView Worxcroup Anacyzer Series Ill A automated mapping creating maps of the network in its current state An engineer can plug the OptiView into the network let it run the discovery then go through a simple multi step process for Fluke Networks 5 www flukenetworks com printing the map The OptiView Reporter formats discovery data and exports that data to Microsoft Visio so network professionals get the data in a familiar format which can easily be used when troubleshooting the remote site Using the OptiView analyzer network professionals can verify and prove network readiness for network expansions mergers consolidations and upgrades They can validate and document performance and verify new configurations to ensure the stability of the network And they can
3. the network becomes important not only does the analyzer need to discover IP addresses but it also needs to discover the associated MAC addresses and decode the White Paper SEE Opti iew a11443 010 248 001 106 via the Management Port Front Page Statistics Device Detail Cable Test Utilization YLANs Protocols Top Hosts Top Conversations Host Protocols Host Conversations al tagged and untagged Clear Counts UDP Protocol Distribution by Packets H IGMP H IPY4 OTHER E TCP sam H BOOTPS H DOMAIN p ECHO H FLUKE NETWORKS REMOT H HP OMNIBACK ve HSRP H LDAP se NETBIOS DGM H NETBIOS NS p NTP H SNMP SRYLOC H SSDP UDP OTHER H IP V 6 a IPX i NETBEUI 4 Q Setup Protocols P FLUKE NETWORKS REMOTE HP OMNIBACK Monitor protocols manufacturers prefix Then by sorting the discovery database by MAC address it is easy to scan the list and look for MAC prefixes that are not normally part of the network if a suspicious MAC prefix is discovered IT staff needs to know where that device is connected to the network and so they can shut down the switch port remotely Reactive Tasks When remote users complain of a slow network the IT staff must have an analyzer at the remote site in order to perform a plethora of different tests First it is critical to identify the problem domain to prove who or what is at fault Secondly IT staff need to identify the mos
4. the protocols in use which is BU PN DR OAA I Click here for Analysis Tools E Errors of Pkts 0 0 0 0 0 0 0 users consuming valuable WAN bandwidth for non business related Monitor switch ports especially important for the traffic traversing the WAN link Are applications It is no longer enough for an analyzer to simply recognize HTTP as a protocol on the network because this could be a valid business application But now the analyzer must go deeper into the HTTP packet to determine the payload and identify for example streaming video or audio Additionally seemingly minor problems such as incorrect subnet masks duplicate IP addresses etc should also be reported Fluke Networks C3 www flukenetworks com Then there is the security aspect that needs to be considered Peer to peer applications such as Skype BitTorrent KaZaa eDonkey and Gnutella to name but a few can pose a security threat for the remote site network Therefore the analyzer has to be capable of deep packet inspection in order to identify the potentially dangerous applications and also be able to identify the users of those applications Unauthorized unprotected rogue wireless access points how are these discovered if there are no IT staff at the remote site to be able to walk around the site with a wireless network ana lyzer to find those rogues Again this is where in depth discov ery from the wired side of
5. Networks Services P Problems t 56 All Devices BMS ey Devices fgg 17 Interconnect E 8 Routers H E 12 Switches E 0 SNMP Hubs a Access Points H H 2 Servers 9 Fluke Tools G9 0 Printers HIB 38 SNMP Agents gt JB 38 SNMP v1 f 2 MIB 0 SNMP v3 E A 0 YoIP Devices H 0 YoIP Call Managers fp 0 VoIP Phones fai 16 Other Hosts Add Key Device Last tested 11 50 09 AM 11 50 09 AM 11 49 39 AM view key devices with test results of All tests t Device Status Response time E TAC_C4006CAT_BSMT Test passed 7 ms Visual LocalRtr 2 tests passed i w2kserver testnetw 4 tests passed Key Device Tests for w2kserver testnetwork com 010 248 001 030 Rerun testis Test Results Info Success opening port HTTPS 443 M TCP Connectivity TCP connection setup time lt 1 ms Success opening port DOMAIN 53 TCP connection setup time lt 1 ms Success opening port crn fo41 2I Remove from Key Devices Device Detail Filter Monitor server connectivity and application response time i TCP Connectivity h TOD Cannectivitys V Discovery COMPLETE the analyzer must be capable of providing in depth analysis at the remote site in order to identify the root cause of the problem Fluke Networks www flukenetworks com White Paper Some problems encountered at remote sites can also be intermittent and recreating those problems i
6. White Paper Troubleshooting Remote Site Networks Best Practices Management and remote site employees expect the same level of network service as the headquarters site However when IT staff are faced with limited resources to support fe Pe Table of contents remote site networks often the applications l SON Introduction 00 00 cece eee 2 services and performance at those sites is not PEE PT E esse Best practices for troubleshooting 2 Network discovery 00000 2 See how to deliver a high level of network Baselining nnna nanan nunana 2 service at remote sites using the best practices Proactive tasks eeeeee 3 a Reactive tasks 0 00 cece eens 4 outlined in this white paper Maintenance window tasks 5 Solution Integrated analyzer 5 FLUKE Networks White Paper Introduction The need to establish a presence in strategic areas is forcing businesses to open new branch offices where remote employees expect the same network applications services and performance as employees located at corporate headquarters Unfortunately IT organizations do not have unlimited budgets or headcounts Therefore in most cases there are no IT support personnel permanently available at remote locations Although server centralization consolidation and the move towards web enabled applications have business benefits optimal productivity can still only be achieved
7. all Managers fp 0 VoIP Phones fia 16 Other Hosts lt Discovery COMPLETE ad TAC _C2524_2C4 E Tac_c2950 l TAC_C3560G_2C4 E3 TAC_C4006CAT_BSMT E TAC_C5500_BSMT E TAC_EXSMMT_2c4 E3 TAC_FNDRY2402_2C4 E3 TAC_FNDRYFSTIRN_2C4 J TAC_Visual_c2800 ge tacapO2 testnetwork com TESTNET testnet104 testnetwork com testnet105 testnetwork com SB testnet107 testnetwork com testnet117 testnetwork com BS testnet119 testnetwork com testnet120 testnetwork com BS testnet121 testnetwork com amp testnet123 testnetwork com testnet124 testnetwork com 8 testnet127 testnetwork com V ThisOptiview fy vIsuaL 010 248 001 024 010 248 001 243 010 248 001 009 010 248 001 029 010 248 001 013 010 248 001 060 010 248 001 010 010 248 001 193 010 248 001 254 010 248 001 051 010 248 001 106 010 248 001 104 010 248 001 105 010 248 001 107 010 248 001 117 010 248 001 119 010 248 001 120 010 248 001 121 010 248 001 123 010 248 001 124 010 248 001 127 010 248 001 128 010 248 001 253 Cisco 3e41ef Cisco c2d5c0 Cisco 6b1240 Cisco 0857ff Cisco dde4ff Extrem F41070 Foundr 79b564 Foundr 0a1610 Cisco 8d9d60 Cisco cO46ae Intel cF13dd Fluke a30187 3Com 5ff88e Intel bcc7a4 Dell 4cc0f7 Dell dea2ac Yisual Llead26 Dell b2d9a Fluke a11453 Fluke a037e3 Dell S8b61F Fluke a11443 Dell Scbde3 m Remove from Key Devices Device Detail Filter C Broadcast domain only Network discovery
8. ion diagrams are available and traffic levels have been baselined it will be necessary to automatically r h rter ff h n r r ffi r OptiView a11443 010 248 001 106 via the Management Port ale t eadqua te a sta m ove all t a levels p Statistics Discovery D Cable Test Capture Generate Setup individual critical switch port traffic has exceeded what is consid vevcs visusrrocarer v alloevces lt lt gt 4 4 by 4 verview ctive Tes raceroute ables Interfaces VLAN ered to be normal levels In order to provide this level of detail Ce Ate et terose QLS Swe Tees Inierfaces LAN f vew _ E liu History WAN Sort by Avg Utilization v the analyzer deployed at the remote site must be capable of ais MultiPort Statistics Sorted by Average Utilization monitoring individual switch ports and WAN interface traffic and if E Good Frames provide a method to determine when specific traffic thresholds 10 E Errors have been exceeded on those interfaces either by error rates or TE utilization rates This will alert the IT staff to potential network a Max Errors degradations before they become significant problems at that 0 1 Interface 4 Slot 3 Up Prop Serial 1 544 Mbps Serial0 1 0 v 7 Data Source n urreni v ax T Pkts remote site PB Ra REAREN E uti a F BW aa im Aek Ter E Errors of Pkts 0 0 0 0 0 0 0 It is also necessary to monitor
9. oblem Device Tools Reports NetworkMap Help particularly if the device includes all of the following Discovery Trending iy Devices opens Trend Device evice Device ThisOptiview 010 248 001 103 nterface 1 1 Up Ethemet 100MBits sec capabi lities a i a aa lad ala Utilization M e Network discovery aes Ma e Mapping documentation capabilities _ oe hk _ ioi SAAS a aac en e SNMP polling to baseline switch and router performance e Wire speed hardware packet capture and protocol analysis 2 GSMA to measure application response times E l a Utilization Peaks Bandwidth Percentage Packets Percentage Time Date 3 43 14 PM 8 7 2007 lt gt e Traffic monitoring to determine which protocols are used on Stic Evo Det Statistic of Pkts Packets Error of BW of Pkts the network Ryu mg ton a ee eet ae at z Undersize Pkts 0 00 0 00 Eiaon we D Oversize Pkts 0 00 0 00 Enrors 0 00 0 Fragments 0 00 0 00 e Host management utilities telnet ssh to view and change infrastructure device configurations For Help press F1 Latest Discovery 3 54 PM 8 7 69 Devices Device trending Next steps Network professionals responsible for remote sites have to consider multiple tasks in order to support that site These can generally be divided into the following e Proactive tasks e Reactive tasks e Maintenance window tasks Proactive Tasks Once up to date network configurat
10. s getting more complex and in some cases may be impossible if you cannot reproduce the problem would it be safe to say that no problem exists Unfortunately not it is often difficult to determine what happens on the wire at line rate when application error messages are received So there is a need to provide a capability to capture traffic that is more relevant and analyze the data when time is available not necessarily when problems occur In order to solve these problems and to speed troubleshooting triggers that stop or start capturing when an event is detected both save time and provide more flexibility through e Unattended monitoring capture the traffic whenever the event occurs e Minimizing number of captures required by ensuring the event is captured the first time and avoid doing random traffic captures that may not contain anything of interest e Analyzing the captured traffic when time is available not necessarily when the event occurred e Capturing traffic before after or around the event and only as much as needed by using capture filters to limit the amount of traffic captured and avoid having to review megabytes of traffic Maintenance Window During network maintenance times ensure that the WAN links to the remote sites are capable of supporting the allocated bandwidth In order to perform this task an inter network throughput test should be run between the analyzer at the remote site and a similar analyzer at the headq
11. t likely problem domain is it the network application server or client and subsequently be able to pass on problems with confidence by providing enough data to avoid finger pointing and to confidently direct the problem to the responsible IT organization but not necessarily solve an application issue To assist in identifying the problem domain a network services test must be provided to ensure that vital network services are available and operating correctly These services at a minimum would be DHCP DNS and 802 1x authentication The capability of adding additional DNS server addresses is necessary to perform both address to name or name to address resolution tests especially when applications are hosted on multiple servers at the headquarters site that use round robin DNS services for load balancing and look ups To validate application connectivity the analyzer needs to be capable of selecting specific TCP ports from a remote site to a server at the headquarters site and attempt to open those ports to provide details on the connection setup time to ensure that 1 application servers are available 2 there is a communica tion path and 3 there is an acceptable response time Once basic services and application connectivity are validated Opti iew a11443 010 248 001 106 via the Management Port Front Page Statistics Discovery Device Detail Cable Test Capture l Generate Setup E Devices tg
12. uarters site The test needs to be performed at various traffic rates and different frame sizes to determine if the WAN link is capable of handling the traffic to determine packet loss and more importantly in which direction the packets are being lost If there are dropped packets or the link will not support the advertised data rate the analyzer needs to have features available to diagnose the source of the problem How the OptiView Series Ill Workgroup analyzer makes managing remote sites easier All the functionality of multiple tools is combined into one device making remote site management and troubleshooting easier and faster when engineers no longer have to switch from tool to tool to conduct a full array of tests In addition network professionals can conduct all the necessary tests at the remote site without ever leaving the headquarters site Just plug the OptiView analyzer OptiView a11443 010 248 001 106 via the Management Port DER into your network at the remote site and you ll get 24 7 visibility Utilization YLANs Protocols Top Hosts Top Conversations Host Protocols Host Conversations into the network its like having a virtual network engineer us saa And more then one person can view the data with the OptiView AI tagged and untapped x UDP Protocol Distribution by Packets analyzer network professionals can also work together when some ovens I Ho Reap pale e EE
13. uld affect remote sites and interfere with operations Additionally the ability to enable staff to resolve problems from the headquarters site will avoid the need to dispatch staff and results in timesavings and increased network availability Best practices for remote site troubleshooting Network Discovery Opti iew a11443 010 248 001 106 via the Management Port Front Page Statistics Discovery Device Detail Cable Test Capture Generate Setup Z Devices tg Networks Services y Problems a t Name Before attempting to troubleshoot a problem at a remote site IP Address MAC Address IT staff must first know what they are dealing with This is especially relevant when corporations have made acquisitions or mergers where the remote site equipment configuration and network design is disparate from the headquarters equipment and network design Discovery not only means what kind of equipment exists but who are the users and how are they connected to the network Discovery must include information on hardware inventory switch and router configurations and network connectivity Today inter switch trunks are widely deployed and now access af 3 Key Devices nag 17 Interconnect E 8 Routers E 12 Switches 0 SNMP Hubs i a Access Points HH 2 Servers 9 Fluke Tools g o Printers IB 38 SNMP Agents WIB 38 SNMP vi fy2 IB 0 SNMP v3 0 VoIP Devices H 0 VoIP C
14. use the OptiView analyzer to identify VLAN configurations validate network health audit switch router configurations and performance Contact Fluke Networks Phone 800 283 5853 US Canada or 425 446 4519 other locations Email info flukenetworks com Fluke Networks C6 White Paper VISION Fluke Networks P 0 Box 777 Everett WA USA 98206 0777 Fluke Networks operates in more than 50 countries worldwide To find your local office contact details go to www flukenetworks com contact 2008 Fluke Corporation All rights reserved Printed in U S A 2 2008 3276477 A EN N Rev A www flukenetworks com
15. when the same level of services are available in remote sites as in the corporate headquarters Unfortunately even the best planned deployment can potentially leave remote offices and users vulnerable to performance degradation and availability issues This creates additional challenges for the headquarters IT staff in maintaining remote site performance availability security and visibility Just as in the headquarters environment when remote users complain about poor performance IT staff must be able to determine the root cause of the problem and correct the situation Remote office network outages and slowdowns are made far more difficult to solve because of the challenges presented by distance travel time and the need for tools that may not necessarily be available at the remote location Organizing the necessary tools and dispatching staff to remote locations to troubleshoot problems is both time consuming and expensive One method of solving these issues is to implement a strategy that spans both the remote site and the corporate headquarters site With the right information and tools IT staff are able to understand and resolve issues quickly and efficiently Adding the appropriate level of visibility IT staff could even identify remote network degradations before they become significant problems at that remote site This strategy provides IT staff with the opportunity to take proactive action to eliminate congestion and other problems that co
Download Pdf Manuals
Related Search