The

New Generation
of Network
Monitoring
Systems

ATG’s Communications &

Networking Technology
Guide Series

This guide has been sponsored by

 Table of Contents
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Networks are Critical Assets . . . . . . . . . . . . . . . . . 4
Operational Analysis and Monitoring
Management . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Techniques for Network Monitoring. . . . . . . . . . . 9
Users of a Monitoring System . . . . . . . . . . . . . . 11
Monitoring Systems Architecture . . . . . . . . . . . . 15
Development Systems for Analysis and
Monitoring Networks. . . . . . . . . . . . . . . . . . . 17
What needs to be monitored? . . . . . . . . . . . . . . . 19
The True Cost of a Network Monitoring
System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Monitoring System Requirements . . . . . . . . . . . 25
Summary and Conclusions. . . . . . . . . . . . . . . . . 28
Acronyms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . 30
About the Editor…
Gerald P. Ryan is the founder of Connections Telecommunications Inc., a
Massachusetts-based company specializing in consulting, education and soft-
ware tools which address Wide Area Network issues. Mr. Ryan has developed
and taught numerous courses in network analysis and design for carriers, gov-
ernment agencies and private industry. Connections has provided consulting
support in the areas of WAN network design, negotiation with carriers for
contract pricing and services, technology acquisition, customized software
development for network administration, billing and auditing of telecommuni-
cations expenses, project management, and RFP generation. Mr. Ryan is a
member of the Networld+Interop program committee.

This book is the property of The Applied Technologies Group and is made
available upon these terms and conditions. The Applied Technologies
Group reserves all rights herein. Reproduction in whole or in part of this
book is only permitted with the written consent of The Applied Tech-
nologies Group. This report shall be treated at all times as a proprietary
document for internal use only. This book may not be duplicated in any way,
except in the form of brief excerpts or quotations for the purpose of review.
In addition, the information contained herein may not be duplicated in
other books, databases or any other medium. Making copies of this book, or
any portion for any purpose other than your own, is a violation of United
States Copyright Laws. The information contained in this report is believed
to be reliable but cannot be guaranteed to be complete or correct.
Copyright © 1997 by The Applied Technologies Group, One Apple Hill,
Suite 216, Natick, MA 01760, Tel: (508) 651-1155, Fax: (508) 651-1171
E-mail: [email protected] Web Site: http://www.techguide.com
 It is clear that the speed of network change is accelerating.
Networks have become more complex, more interactive, signifi-
Introduction
cantly more costly and certainly more mission-critical. There is
much more at stake than ever before for network managers, and Corporate networks are core assets for almost any
almost everyone is experiencing an increased level of tension and company in the fast-paced, globally-oriented world we
uncertainty as new systems, applications, and services are live in today. Data network technologies have evolved
deployed. Vendors proposing complex solutions are equally very rapidly; the low-speed circuits of a SNA network
concerned that their solutions meet the needs of all their are transforming into multiservice distributed informa-
customers. The need to deliver analyses and monitor the functions tion systems. There is even a move towards the conver-
of new technologies such as Frame Relay, ATM, Fast Ethernet, gence of traditionally distinct facilities such as
and the Internet has never been greater. There is also a need to telephony and data networks. Instant access to high-
justify deployment costs and to validate assumptions before quality voice, data, image, and video transport services
systems become operational. Maintaining the value of all is available almost anywhere and yet the ability to
resources throughout the network’s life cycle has also become an analyze and monitor network operations has not kept
objective. This Technology Guide looks at the changing network pace with its importance. The desire to keep track of
environment in terms of today's greater need to provide precise, what is happening on the network and understand how
highly-accurate analysis and monitoring of both test-bed and well it is performing has never been greater.
operational network components and services. The deployment of The components of a modern network are often
fully functional, integrated network analysis and monitoring provided by more than one supplier and may need to
systems is shown to be the best solution for examining contempo- be installed and maintained anywhere in the world.
rary networks. Testing the quality and compatibility of these compo-
nents, both before and after purchase, is an important
part of the overall network planning, design, and
deployment life cycle. Providing the tools for analysis
and monitoring of these networks has become critical
to the success of network-dependent businesses.
Furthermore, as new protocols are deployed with
complex interactions with other protocol sets, there is a
need to simulate and test these environments, with load
generation stress testing and real-time monitoring.
This Technical Guide examines the requirements
for network analysis and monitoring that justifies the
overhead of implementing analysis and monitoring
systems, especially for high-speed multi-protocol
networks. We take a fresh look at the growing need for
comprehensive network analysis and monitoring and
how it can be used effectively. We discuss the benefits
of deploying analysis tools and monitoring capabilities
and suggest an architecture for describing what must

2 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 3
be provided. With the help of this Guide, the network levels of complexity and interactivity are involved,
planner can assess the impact of network analysis and much greater speeds are achieved, and immature
monitoring systems, define the overall benefits and protocols are being deployed, such as the various stan-
make the case for an up-front investment in the tools. dards for integrating ATM with legacy protocols (e.g.
Multiple Protocols Over ATM MPOA) all of which
make functional outages and quality degradation much
more likely. Various network technologies are also
Networks are Critical Assets being combined in new ways - frame relay overlaid
onto ATM, IP tunneling over the Internet, video over
Most companies know intuitively that their tele- ATM, and voice and video over an Ethernet LAN are
phone networks are mission-critical. Many do not yet examples – and these are often incompatible across
realize the significant business cost of data network vendors. Recently, quality of service has been the
outages. Banks, for example, would be severely subject of hot debate in the industry, especially as the
restricted if their teller networks were unreliable. business use of the Internet and Intranets expand.
Virtually everyone depends on “the network” in one Frame Relay, ATM, very high speed routers and
form or another, and this dependency means that switches, 100Mbps and pending gigabit LANs,
networks have become critical corporate assets. They SONET, and TCP/IP-based intranets are examples of
are expected to be available anytime, to be accessible advanced technologies that all share a common trait –
anywhere, and to operate flawlessly, and their high speeds with lots of traffic flowing. These, when
managers are expected to know when these expecta- combined with legacy networks that range from plain
tions aren’t going to be met. old telephone service to SNA display terminal
It is becoming more and more difficult to keep networks, lead to complex integration, interoperability
track of what network elements are installed, what between applications, and management challenges.
protocols are operating , how they are interacting with Many of the traditional network providers no longer
multiple technologies, and what changes are occurring. provide end-to-end service and support, leaving users
It has been claimed that more than 30% of network to develop their own monitoring, analysis, diagnostic,
users move every year in a typical corporation – a good and maintenance capabilities.
reason alone for continuous analysis and monitoring of A variety of network middleware solutions have
network assets and configuration. The rate of change is also been developed. Virtual LANs, on-line transaction
accelerating as the technologies improve and more processing, message handling, World Wide Web
users demand both internal and external network serving, and client/server computing are a few exam-
bandwidth and reliable access (e.g., Internet). ples. These are overlaid onto the physical network,
Information system technologies are being devel- thereby creating a logical networking environment that
oped faster than ever before, resulting in high rates of also needs to be monitored and controlled.
change both within the network and around it. Greater

4 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 5
 A highly simplified modern networking environ-
ment is illustrated below.
Operational Analysis and
Monitoring Management
The A network analysis and monitoring system is
Internet
successful when it provides the owners and managers
with the information they need to plan, organize,
Wide Area Legacy implement, operate, administer, and control the
Networks Networks
Intranet
(Frame Relay, (SNA, IPX, network. Today’s networks are challenging to monitor
ATM) XNS, etc.)
effectively and even harder to manage, and the degree
of difficulty increases with size and capacity (i.e., the
shear volume of data involved is daunting).
Mission-critical applications are routinely using Effective and appropriately placed monitoring of
these networks, often with little confidence that the an operational network can contribute to the solution
“state of the net” is well known or trustworthy. Since of a wide range of network-related problems. The
the network has a direct impact on the achievement of overall goal is to detect service-threatening conditions
business goals and contributes to maintaining corpo- before they become visible to the end user (thereby
rate profitability, network analysis and monitoring is a avoiding the loss of business productivity). Some
necessity. typical uses for an on-line network analysis and moni-
toring system include:
The Need for Network Analysis and Monitoring • detecting changes in user accesses, node activities,
Network analysis and monitoring can be defined topology, status and performance ratings, and
as the capture, filtering, decoding, and organization of debugging network problems;
observations about the functioning of a network • tracking who is using the most bandwidth on the
service, the facilities that provide the network services network and whether they are authorized;
or any of the components that make up a communica-
tions facility. Monitoring and analysis provides • identifying and alerting management of service
feedback concerning the “health” of the network and outages, degrading performance and component
allows corrective actions to be initiated when and faults;
where necessary. • monitoring of network interfaces for communica-
In a laboratory testing environment, it assumes tion problems;
new dimensions in which it provides the ability to build
• maintaining event histories, trends, and loading
various protocol models and to simulate protocol inter-
statistics; and
actions, while providing real-time monitoring capture
and analysis of data streams. • on-line simulation and capture of live traffic
analysis.

6 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 7
 Analysis and monitoring can also be used in a relevant network analyses and to do it in a timely
laboratory environment for simulation and load gener- manner.
ation testing and in an inoperative network to perform If a network analysis and monitoring capability
diagnostics, analysis, and load tests. Some typical off- were not embedded into the system, it would be
line uses for an analysis and monitoring system are: impractical to do many important network evaluation
• providing industry standards, benchmark data tasks. In general, moreover, without monitoring and
testing for product specifications and service level analysis, the role of the network manager would at best
agreements; be a labor-intensive, reactive process that would seldom
meet user requirements. Traffic capacity planning
• developing conformance tests for the multiple would be almost impossible, quality of service could
technologies being used; not be regulated, security breaches might go
• simulating traffic profiles and performance tests; undetected, and unplanned service disruptions would
and occur.
• integration and compatibility testing.

Multi-layer Analysis and Monitoring

Although analysis and monitoring is most often
Techniques for Network
introduced at the network element level (e.g., a hub, Monitoring
router or switch) it also applies to the end-to-end
service being offered and to the end user’s traffic. A fundamental division among network
Monitoring of the network, the business applications monitoring systems related to whether the monitoring
and the analysis of system platforms may or may not is done off-line (while only test messages are flowing) or
be combined. Often it will be found that events are on-line (while user traffic is on the network), or both.
correlated across the entire distributed system. For Techniques for monitoring networks when they are
example, failure of an application gateway between an out of service involve the generation of test sequences
internal and an external network can disrupt a service and the monitoring and analysis of the results, to
just as thoroughly as would the failure of a carrier’s determine measurable levels of performance and
data link. By simulating hypothetical network configu- protocol conformance. Such tests can be in a test
rations with typical traffic patterns, most network fail- bench environment, manufacturing floor, network
ures can be isolated prior to mission critical applica- operations center or may be during an outage in an
tions being implemented onto the new network. operational network.
Various signaling and control systems are impor- The process of on-line monitoring and analysis
tant network elements that also need to be analyzed may be performed on a continuous basis, scheduled at
and monitored. The ability to observe the operation of various times of day, or invoked only when
the entire network and all of its OSI layers is a funda- circumstances (such as load changes or quality
mental prerequisite for any viable Network. The key is concerns) demand a closer scrutiny.
to provide the network manager or field operator with Continuous monitoring (intrusive testing) is the
precise, highly accurate information concerning all the most costly alternative in terms of resources and time,

8 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 9
but is also the most beneficial from a user’s viewpoint. to the added difficulties of problem determination.
A very large number of access points may be required, This approach could be completely acceptable for
and they would usually be dedicated to the monitoring medium to large networks, priority networks, and
system. The amount of data that needs to be collected would scale up to larger, or shared networks.
and possibly transported to a remote database can also
be very high. The benefit, however, is that proactive Data Collection (Capture and Analysis)
management and dynamic recovery can be a reality. The data collected by the network monitoring
The key cost-benefit trade-off is completeness: the system can be capture directly to hard disk, floppy disk,
number of points of observation, the frequency of or transferred to a central database management
polling, and the degree of summarization performed at system immediately. It can be filtered, edited, and
the source. chained together for subsequent uploading, or it can be
Scheduled monitoring and filtering reduces the analyzed at the point of capture and only the results
cost by executing the monitoring functions only at forwarded to the control center. If the monitoring
certain times (e.g., only monitor during peak times) or function directly controls a dynamic, adaptive network,
at a specific subset of locations at set times. This much of the data need not be transferred at all since it
reduces the volume of data collected and the is used proactively at the control point. All data
processing required. A variety of scheduling strategies collected must, as a minimum, be uniformly defined
is possible: random testing, regular polling, and and understood so that correlation of data across
responding to user requests are three examples. There multiple protocols, events or locations, can be achieved.
is a greater chance of missing an important event,
however, and some uncertainty occurs when the test
points are not event driven. By engaging filtering prior
to monitoring the network, you can selectively trap Users of a Monitoring System
events and errors. The filtering technique can be
utilized during test bed stages, implementation turn-up, Users of network analysis and monitoring systems
and operational maintenance. can be divided into four major categories:
Reactive monitoring is performed in reaction to
an outage or performance failure, in which monitoring a) Original Equipment Manufacturers and
is turned on only when a trouble ticket is opened. The Laboratories: The development of any
end user most often provides the initial alarm mecha- network device - a bridge, a router, or a gateway,
nism. The number of simultaneous test points would for example - involves complex hardware and
be relatively low, but geographic coordination and software, using network protocols that are existing
correlation of the tests would be more difficult. By or relatively new and untried. A network analysis
implementing a remote diagnostic monitoring system and monitoring system serves as a verification tool
such as a protocol analyzer, reactive monitoring can be by providing a traffic generator, simulating a desti-
activated prior to performance failures . This would nation node or multiple nodes, or detecting and
minimize system cost, reduce the expense of people reporting upon protocol violations. This can
costs, and would likely decrease the outage times due considerably reduce the time it would take to “get

10 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 11
 it right” in the rush to bring products to market. goals with efficiency and precision. Isolating
Compliance verification also provides a level of points of congestion, locating sources of transient
confidence for the buyer. faults, and generally proving out a design are
Monitoring is also essential for performance important for long term stability.
testing and benchmarking of network components. c) Carriers and Internet Service Providers:
This is helpful both to the supplier who wishes to Carriers, ,network providers, and Internet Service
sell a product based on superior performance and Providers have very large, complex networks to
also to the purchaser who needs to know what to implement, operate, and manage. Carrier-based
expect from the product. Test tools that do not networks may be shared among thousands of
impose a processing overhead on the node being corporate users whose needs can vary widely.
tested are most suitable for this type of application. These same carrier networks usually span wide
Monitoring and analysis systems would also be geographic areas where reliability and maintain-
needed for stress testing under fault conditions ability become a more important issue and are
(i.e., create faulty traffic and invalid protocol almost always interconnected with other carrier
sequences) and for life cycle testing to determine networks. Internal monitoring and analysis
the MTBF ratings of the device. systems are essential if a carrier is to provide high
b) Suppliers and system integrators: A new quality services, and these must work with the
network design or a new equipment proposal is user’s own systems if end-to-end service testing is
much more credible when the existing network is to be achieved.
clearly understood and when bottlenecks, conges- In a large carrier’s network, the cost of
tion, or other performance problems are identi- OAM&P (operations, administration, maintenance
fied. A portable monitoring and analysis system and provisioning) can escalate very rapidly, making
would be an important tool for anyone trying to manual methods of monitoring and control
document an existing network or audit its actual impractical. The network monitoring and analysis
performance. The ability to see what is system must be standardized, scalable, and reliable
happening in a live environment is essential both if it is to be combined across multiple administra-
for gathering design data and also for discovering tions and interconnected with customer network
integration issues. It is also critical when perfor- management performance tools.
mance benchmarks are part of the acceptance Monitoring of network usage is also a critical
cycle. This is usually done through a process of requirement for carrier billing systems. Unless a
monitoring the operation in conjunction with the facility is dedicated to a single user, the costs of
customer and capturing protocol errors . Good the resources must be allocated according to their
monitoring and analysis systems allow both the use. Monitoring must be done at wire-line speeds
customer and supplier to measure acceptance when QoS limits are involved or when usage has

12 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 13
 to be recorded for billing. Automation of the
monitoring function in high-speed networks such
Monitoring Systems
as Frame Relay and ATM is especially important. Architecture
d) End Users: Any corporate network has two
types of user: the organization’s typical employee A network monitoring and analysis system can be
who simply uses the network as a transparent structured in a number of ways, depending on the
utility and who reacts to problems or intended use, with many variations and combinations
performance impairments with complaints, and also being possible. However, a number of basic func-
the network operator who is responsible for main- tions must be included in any monitoring and analysis
taining the end-to-end service. For the network systems architecture, as is illustrated below:
operator, network monitoring and analysis
provides the means to become proactive (i.e., to Network Analysis &
Monitoring System
detect faults prior to receiving a user’s complaint).
It also allows them to manage service level Network Test Points

contracts, to be assured of day-to-day operations Configuration Fast Ethernet

Database ATM, Frame Relay
and to validate system changes. and History Routers, Severs, Switches

The organization’s typical end users and the Triggers

success of the business applications that live on

Graphical User
the network are the ultimate beneficiaries of all Interface
the various network monitoring activities that are Applications
Traffic Load Generation
performed within the network. However, the end Definable Configurations Full Rate Capture and Decode
Simulation & Emulation Automatic Filtering, Statistics
users are least aware of the infrastructure behind Realtime Monitoring
the service. They simply need a quality of service
that meets their business needs and which, by its
very quality and predictability achieves a certain The network monitoring and analysis system is a
invisibility. It is the goal of achieving this “invisi- flexible application in its own right, and shares many of
bility” of consistently good service that makes the requirements of any distributed system. It can be
the added cost of monitoring and analysis tools based on a separate set of processing resources or it
justifiable. may be integrated into the network. The following
functions, however, are common to any approach:
• Network access test points,
• Network capture and filtering processing,

14 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 15
 • Data repository Histograms and statistical reports • Monitoring of user versus test traffic in live or test
(and consolidation), bed situations, and
• Operator interface (Intuitive user interface for • Standards-based versus product-specific
quick response), and monitoring.
• Traffic generator (wire-line speed for load
generation). Hardware vs. Software
Hardware test tools tend to be reactive. When a
The architecture of the monitoring and analysis problem occurs, the tool is plugged into a node or a
system can vary considerably, most often depending on circuit and monitoring is turned on. This provides
what needs to be monitored, filtered, and captured. limited access to the network and works best in shared
The specific needs of the network operators and of the networks where the basic problems relate to the inter-
associated network management system will dictate the ference among users (such as congestion or protocol
type of instrumentation that is necessary. One of the errors). Software-based monitoring tools, on the other
most critical areas for network monitoring and analysis hand, can observe a large number of points in the
today is the quality of service (QoS) provided to the network either continuously or on command, without
user. This includes testing for utilization, error rates, the need for manual intervention. As networks move
delays, etc. towards switched approaches and dedicated LAN
Major architectural decisions to be made during segments, a combination of both hardware and soft-
network planning include: ware monitoring may be the most effective, allowing
proactive monitoring to be combined with in-depth
• Centralized versus distributed processing (network
diagnosis and testing.
test points are, by definition, distributed),
• Portable versus embedded applications for
performing monitoring and analysis tasks,
• Continuous versus “connect and look” modes of Development Systems for
data collection, Analysis and Monitoring
• Wire-line speed versus “store and process” modes
of operation,
Networks
• Larger buffer capacity for report generation, The use of integrated development systems as part
• Proactive versus reactive management techniques, of a monitoring and analysis software suite is crucial to
validating the operation of new network arrangements.
• Protocol (wireline) versus component (node hard-
Often, developers are confronted with the need to work
ware and software) monitoring,
with and perhaps integrate legacy and new, immature,
• Functional versus performance monitoring, protocols.

16 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 17
 For example, TEKELEC uses integrated develop-
ment capabilities to customize applications; to create
What needs to be monitored?
and test proprietary protocols; and to validate the oper-
ational parameters of various immature protocols. In any layered network architecture the services of
These capabilities are also used to customize user one layer support the needs of the layer above (see the
definable interfaces for multiple applications. The illustration of the OSI seven-layer model below). Each
TEKELEC system includes the Protocol Monitoring layer represents one or more functions and protocols
Development System (PMDS), and Tool Command that are logically, if not also physically, separated from
Language/Tool Kit (tcl/tk). With these flexible devel- the others. A network monitoring and analysis system
opment tools, the network manager can predict traffic must have access to and understand the protocol
patterns, node failures, potential congestion points, and messages at each level. In a multiprotocol environment
bandwidth characteristics throughout the network. this can be an onerous task, especially if proprietary
protocols are included. With PMDS and PASM simu-
lation , monitoring and analysis can be used to validate
Multi-Protocol Support and confirm application connectivity, protocol interac-
One of the fundamental architectural tions, addressing, priorities setting mechanisms,
requirements of analysis and monitoring systems is the throughput, end-to-end delay, network overhead,
ability, at wire-line speeds, to capture and decode routing table exchanges, etc. – literally anything that is
multiple types of protocols at multiple levels of the needed to establish, initiate, operate, and regulate the
network, as is illustrated to the right using the OSI network and its connections.
Reference Model. A system should allow protocols to
be individually designed and implemented for a partic- User Applications Gateways
Application Support Application
ular test sequence, or to support a general implementa- Analysis &
Presentation Distributed Systems Protocols
tion that models the interaction of multiple protocols. Middleware
Monitoring
Systems
Session
TEKELEC’s Protocol Monitoring Development Code Converters
Transport Security and Control
System (PMDS) provides the capability of creating new
Routers Switches
protocols and testing them with capture and analysis Network
Routing Protocols
Bridges Switches
tools. The Protocol Adaptable State Machine (PASM) Data Link
LANs VLANs

has been used successfully by TEKELEC to speed Physical Wiring

Hubs Patch Panels Switches

protocol testing and support. PASM allows users to

develop generic tools for ad-hoc protocol evaluation
and testing thereby allowing the immediate creation of Monitoring can be divided into three categories
new and proprietary protocols. Once the laboratory according to the layers involved:
has created a simulated protocol using PASM, it can
• Monitoring and analysis of the underlying trans-
generate and apply traffic loads to actual or test bed
port network and of the services it provides to its
networks. This can be used in conjunction with test
users;
sequences for any defined protocol-based technologies.
It creates, edits, and views user-defined messages that • Monitoring and analysis of the end-to-end traffic
are protocol compliant. among user and system applications; and

18 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 19
 • Monitoring and analysis of the hardware changes to the quality of service); about the users
platforms and operating systems that support the and applications; and about the environment.
operation and management of the network and its Without at least basic monitoring and analysis,
users. there can be no feedback to a Network Operation
Center (NOC) and no control by managers.
This translates into different sets of monitoring c) Trend monitoring: Network monitoring and
and analysis tasks. analysis systems can provide more than simply
a) Protocol testing: Manufacturers of new silicon collection of raw data. Alarms for exception
with new or proprietary protocols need to test conditions and faults are also a natural function of
their products against some known system and the system. In more advanced systems, thresholds
determine performance benchmarks. Compliance and limits can be set for trends as well instanta-
to standards, adherence to functional specifica- neous events.
tions , and operating conditions and limits are
other reasons for a priority testing. This implies a
Hubs as Monitoring Centers
laboratory environment with load generation,
production simulation , monitoring and analysis The intelligent wiring hub is a key element from a
to effectively produce quality results. monitoring perspective. Hubs provide the “first point of
Analysis and Monitoring is an essential part of contact” for an end system attached to a network, and
any test environment but the requirements may serve as an observation point at which data flowing to
be quite different from a “live’ operation where and from the end user can be examined. Virtually all
protecting user data may be paramount. In a hubs can allow monitoring and analysis of both the
laboratory environment, much of the surrounding functioning of the hub itself and the traffic flowing
network can be simulated, many more points of through the hub. In a TCP/IP environment, the SNMP
attachment for test points may be available, and and RMON protocols are used for this purpose.
much more powerful testing applications may be The current state and port configuration of a hub
available through flexible test tools such as PASM provides much information concerning topology and
or PMDS. physical configuration schemes, an indication of the
Of particular importance is the assurance that health of the network and, more importantly, it allows
the protocols can meet speed and quality of the capture of traffic arriving from an end user’s node.
service requirements even when stressed. Bridges and switches that operate at Layer 2 are
also important network elements. The protocols of
b) Operational network monitoring: A moni- Layer 2 (the Ethernet MAC, the TCP/IP PPP protocol
toring and analysis system for an operational and so on) are designed for moving frames within a
network must collect information about the single network domain. It is this layer that most
network itself (e.g., changes in the network’s network monitors would examine to determine the
protocols); about the state of the network services quality of operation of a network.
being offered (including both protocol errors and

20 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 21
Routers as Monitoring Points The True Cost of a Network
Another network element of critical importance is
the router, which operates at Layer 3 of the OSI Monitoring System
Model. Routers are used to interconnect logically sepa-
rate networks (forming an internetwork). Monitoring While network monitoring increases the overall
and analysis of the operation of routers and the cost of the hardware and software facilities, it signifi-
routing process provides considerable information cantly reduces the total cost of ownership for a distrib-
about the network. By detecting trends and events as uted network-based system. Cost of ownership drops
seen by the routers, it is possible to take preventive dramatically with remote access on network points that
actions, to isolate problem components, and to gener- handle the majority of the traffic. With today’s
ally minimize the impact of faults. The Internet IP networks supporting increasingly mission critical busi-
protocol, which is the key to internetworking, operates ness applications, it is imperative that they keep
at this level. New IP switching on Layer 3 will require running with efficiency and resiliency. Justifying up-
protocol analysis to capture performance and quality of front costs in order to get downstream benefits in this
service parameters. environment is not difficult, since technology is
advancing quickly and more of the corporate asset is
on the network. It is, therefore, important to justify the
Monitoring at Other Points
initial integration of a network monitoring and analysis
Monitoring the operation of applications and plat- system as new technologies and applications are
forms is also highly desirable. Gateways provide for the deployed, rather than simply adding it after-the-fact in
interconnection of applications that are not directly response to serious network problems or failures.
compatible and for the conversion between different Every business manager believes a key part of his
protocol suites. Middleware and platform applications or her job is to monitor and control the assets for
provide services for distribution, for security, and for which they are responsible. The network
identification. operator/manager is no exception, given that the
In any of these components there will be a trade- ability to monitor the network is a prerequisite to
off between the processing load of the monitoring controlling it. The cost of a monitoring and analysis
functions, the memory required for buffering the obser- system can be balanced against the cost of decreased
vations, and the amount of data collected. Spot availability and increased operator involvement. A
checking, continuous monitoring, and targeted analysis necessary, ideal model in this network milieu is
change the amount of data collected and therefore the dynamic operations, high reliability design, and contin-
cost of performing the monitoring. The higher the uous analysis of all parts of the network at all times,
speeds involved the more data that will need handling thereby allowing detection and correction of events
and the more important it is to operate at least at the prior to an outage occurring.
wire-line speeds. The relative cost of the monitoring system, the
cost and number of personnel, and the business impact
of the networked applications will determine the actual

22 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 23
“return on investment” of any investment in • less timely work, greater difficulties in global
monitoring systems. These costs are highly dependent operation,
on the specific circumstances of each network with the • slower products to market
lack of a mission critical network service sometimes
being very costly indeed. • lower quality performance, and
The following chart highlights key costs and bene- • network stability with multiple protocols.
fits related to the deployment of a network monitoring
system. Using a monitoring and analysis system in a devel-
opment environment is almost essential, since few
Costs and Benefits of a Monitoring System customers would buy products whose specifications are
not available.
Costs Benefits
In an operational environment the goal is to estab-
• More hardware and software • Lower people costs due to automation
required lish a balance between investing in monitoring and
• Uses network capacity • Reduces downtime (mean time to analysis systems versus the cost of people and the relia-
repair)
• Development and deployment • Allows proactive management bility needed for the applications served.
required
• Potential compatibility problems • Permits trend analysis
Without some level of monitoring and analysis,
there would be virtually no reasonable way to detect
• Standardization required for • Reduces cost of product
information development
and correct faults, and certainly no way to identify
• Lower testing costs and shorten test trends and directions that could be impacting service.
cycles
• Proactive analysis and monitoring with
multiple test tools
Remote access to multiple technolo-
gies and applications
New products get to market quicker Monitoring System
• Reliability and quality of new products Requirements
• More rigorous data collection

A full-featured network monitoring and analysis

Another way of judging the value of a monitoring system would require most, if not all, of the following:
and analysis system is to examine the impact of
• test points that are either portable or are located
allowing poor quality networking facilities. Some of the
at defined network observation points;
results are:
• common definitions for data elements, events, and
• higher total cost of ownership (more people
actions;
devoted to problem resolution),
• data collection mechanisms that either make use
• reduced productivity of individuals,
of the network or are totally separate;
• poorer collaboration among groups and even
• data management tools for data reduction, organi-
companies,
zation, storage, and analysis;

24 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 25
 • presentation tools for viewing the consolidated • Monitoring of longer term trends and changes in
data; modeling tools to validate protocols and configuration that is usually accomplished in an
network performance; and off-line mode.
• a traffic generation facility for testing under simu-
lated loads. What are the Elements of a Superior Network
Monitoring System
Any monitoring and analysis system may be The various operational elements of a good moni-
portable or rack-mounted. It should be capable of toring and analysis system are illustrated in the
interfacing with a wide variety of networks and be previous diagram. They include:
scaleable from small to large networks. It must be able • an intuitive graphical user interface,
to generate and receive a variety of protocols and be
able to deliver simulation and real-time decodes on all • automated processes, detection and
layers of the protocol suite. The monitoring should be measurements,
capable of full-rate data capture to support accurate • comprehensive operations and management
performance but must also be able to poll the test analyses,
points to allow either sampling or continuous
• a common and consistent operational command
monitoring on a per access basis.
language,
Ideally, monitoring and analysis systems can
operate with both software and hardware interfaces. A • simultaneous support for multiple technologies on
software interface copies and forwards the data passing a single platform,
a certain point of observation, which allows observa- • remote access to test points via network connec-
tions at locations that would not normally be accessible tions,
to a test system. Software monitoring, however,
requires suitable features to be built into the device • customizable user interfaces incorporating
(filtering) and also consumes resources that might powerful GUI features,
distort the real situation. Hardware interfaces can be • extensibility to accommodate new technologies
less intrusive but are limited to physically accessible and scalability to large networks,
points, and typically operate on a per segment basis.
• open system platform, and
Network monitoring and analysis system require-
ments differ according to the intended purpose of the • real-time (wire-line speed) operation for multiple
system. The three major categories of the system are: points of attachment and a wide range of network
speeds.
• Network component capability and performance
monitoring that is used during development;
• Event and usage monitoring that is performed
during normal operation of the network; and,

26 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 27
Summary and Conclusions Acronyms
The ability to communicate digitally as well as
ATM Asynchronous Transfer Mode
using voice has become critical to business success,
(network)
resulting in greater dependency on complex global
networks and their component suppliers. Management IP Internet Protocol
of the internal corporate network and of the intercon- LAN Local Area Network
nection of multiple corporation’s networks has become
a very visible task, one that would be impossible SONET Synchronous Optical Network
without the tools for monitoring of activities, events, SNA Systems Network Architecture
performance, and usage. There is a highly magnified
need for testing and monitoring systems to support TCP Transport Control Protocol
contemporary applications and technologies. PASM Protocol Adaptable State Machine
Every network involves multiple stages in its devel-
PMDS Protocol Monitoring Development
opment life cycle: component development, carrier
System
service production, integration testing, operational
monitoring, and application usage control. The ability MAN Metropolitan Area Network
to monitor the network is fundamental to success at all
GAN Global Area Network
times from the product test labs to application load
control.
The need for, and benefits of, accurate monitoring
of all the different technologies currently being used is
clear. In the past, the up-front costs needed for imple-
menting and integrating a comprehensive monitoring
and analysis system had occasionally been difficult to
justify. However, with the dramatic increase in business
costs of network failures and the increasing complexi-
ties of the technologies, it has become evident that
automation of the monitoring and management func-
tions has considerable payback for everyone involved:
producers, carriers, integrators, and end users.
Since it is the monitoring capability that provides
the basis for most forms of network management, any
investment in monitoring and analysis tools and tech-
niques is bound to be re-paid many times over.

28 • The New Generation of Network Analysis and Monitoring Systems Technology Guide • 29
Glossary Asynchronous Transfer Mode (ATM)—(1) The
CCITT standard for cell relay wherein information for
multiple types of services (voice, video, data) is conveyed
10BaseT—The IEEE 802.3 specification for ethernet in small, fixed-size cells. ATM is a connection oriented
over unshielded twisted pair (UTP). technology used in both LAN and WAN environments.
(2) A fast-packet switching technology allowing free allo-
100BaseFX—100 (Mbps) Ethernet implementation cation of capacity to each channel. The-SONET
over fiber. synchronous payload envelope is a variation of ATM.
100Base-T Fast Ethernet—A 100 Mbps technology (3) ATM is an international ISDN high speed, high-
based on the Ethernet/CD network access method. volume, packet switching transmission protocol
standard. ATM currently accommodates transmission
802.3—CSMA/CD (Ethernet) standards, which apply
speeds from 64 Kbps to 622 Mbps.
at the physical layer and the media access control
(MAC) sublayer. ATM Adaptation Layer (AAL)—Each AAL consists
of two sublayers: the segmentation and reassembly
802.5—Token ring standards.
(SAR) sublayer and the convergence sublayer. AAL is a
802.6—MAN standards. IEEE 802 standards become set of four standard protocols that translate user traffic
ANSI standards and are usually accepted as interna- from higher layers of the protocol stack into a standard
tional standards. A MAU is referred to as a transceiver size and format contained in the payload of an ATM
in the Ethernet specification. cell and return it to its original form at the destination
node.
Access Rate—The transmission speed, in bits per
second, of the physical access circuit between the end AAL 2 is used with time-sensitive, variable bit rate
user and the network. traffic such as packetized voice.
Add/Drop Multiplexer (ADM)—A multiplexer ATM Data/Channel Service Unit (ATM
capable of extracting or inserting lower-rate signals DSU/CSU)—Segments ATM-compatible information
from a higher-rate multiplexed signal without into ATM cells and then reassembles them at their
completely demultiplexing the signal. destination.
Advanced Intelligent Network (AIN)—Carrier Available Bit Rate (ABR)—A class of service in
offering more than ‘pipes’ to users. which the ATM network makes its “best effort” to meet
traffic bit rate requirements.
Application Layer—Layer 7 of the OSI Reference
Model; implemented by various network applications Bandwidth on Demand (BoD)—Dynamic alloca-
including file transfer, electronic mail, and terminal tion of line capacity to active users, inherent in
emulation. FastComm FRADs.
Asymmetrical Digital Subscriber Line Bit Stuffing—The insertion of extra bits into a data
(ASDL)—A new standard for transmitting at speeds up stream to avoid the appearance of unintended control
to 7 Mbps over a single copper pair. sequences.

30 • The New Generation of Network Analysis and Monitoring Systems Glossary • 31

Bit Synchronous—A way of mapping payload into Campus Area Network (CAN)—A network which
virtual tributaries that synchronizes all inputs into the encompasses interconnectivity between floors of a
Vts but does not capture any framing information or building and/or buildings in a confined geographic
allow access to subrate channels carried in each input. area such as a campus or industrial park. Such networks
For example, bit synchronous mapping of a channel- would not require public rights-of-way and operate over
ized DS1 into a VT1.5 does not provide access to the fairly short distances.
DSO channels carried by the DS1.
Carrier Sense Multiple Access/Collision
Bridge/Router—A device that can provide the func- Detection (CSMA/CD)—A channel access mecha-
tions of a bridge, router or both concurrently. nism wherein devices wishing to transmit first check the
Bridge/router can route one or more protocols, such as channel for a carrier. If no carrier is sensed for some
TCP/IP and/or XNS, and bridge all other traffic. period of time, devices can transmit. If two devices
transmit simultaneously, a collision occurs and is
Broadband Inter Carrier Interface (BICI)—
detected by all colliding devices, which subsequently
A carrier-to-carrier interface like PNNI (private
delays their retransmissions for some random length of
network-to-network interface) but lacking some of the
time. CSMA/CD access is used by Ethernet and IEEE
information offered by PNNI. Carriers are not likely to
802.3.
let their switches share routing information or detailed
network maps with their competition’s equipment. BICI Channelization—Division of an E1/T1 signal into
now supports only permanent virtual circuits between multiple data channels, which may or may not follow
carriers; the ATM Forum’s is currently addressing time slot boundaries depending on the application.
switched virtual circuits.
Circuit Emulation—A connection over a virtual
Broadband Inter-Switching System Interface circuit-based network providing service to the end users
(B-ISSI)—Between ATM nodes. that is indistinguishable from a real, point-to-point,
fixed-bandwidth circuit.
Broadcast and Unknown Server (BUS)—ATM
Forum-defined specifications in support of LAN-to- Circuit Switching—(1) Switching system in which a
LAN connectivity, called LAN emulation. BUS defines dedicated physical circuit path must exist between
that set of functions implemented in an ATM network sender and receiver for the duration of the “call”. Used
that provide LAN-to-LAN transmission support while a heavily in the phone company network, circuit
LAN connection is being established. It also supports switching often is contrasted with contention and token
LAN broadcast services. passing as a channel-access method, and with message
switching and packet switching as a switching
Byte-Interleaved—Bytes from each STS-1 are
technique. (2) Basic switching process whereby a circuit
placed in sequence in a multiplexed or concatenated
between two users is opened on demand and
STS-N signal. For example, for an STS-3, the sequence
maintained for their exclusive use for the duration of
of bytes from contributing STS-1s is 1,2,3,1,2,3......
the transmission.

32 • The New Generation of Network Analysis and Monitoring Systems Glossary • 33

Classless Inter-Domain Routing (CIDR)— Network Service (data gram service). CLNP is the OSI
A method for using the existing 32-bit Internet Address equivalent to Internet IP, and is sometimes called ISO IP.
Space more efficiently.
Constant Bit Rate (CBR)—Delay intensive applica-
Code Division Multiple Access (CDMA)—Spread tions such as video and voice, that must be digitized and
spectrum; broadcast frequency changes rapidly in represented by a continuous bit stream. CBR traffic
pattern known to receiver. requires guaranteed levels of service and throughput.
Coding Violation (CV)—A transmission error Continuation of Message (COM)—Type of
detected by the difference between the transmitted and segment between BOM and EOM (ATM, SMDS).
the locally calculated bit-interleaved parity.
Copper Distributed Data Interface (CDDI)—
Committed Information Rate (CIR)—The trans- FDDI over UTP or STP copper media.
port speed the frame relay network will maintain
Customer Premises Equipment (CPE)—
between service locations.
(1) Telephone terminal devices, such as handsets and
Common Application Service Elements private branch exchanges (PBXs), located on the
(CASE)—Application protocol (MAP). customer’s premises. (2) Terminating equipment, such
as terminals, phones, routers and modems, supplied by
Common Protocol Convergence Sublayer
the phone company, installed at customer sites, and
(CPCS)—Pads PDU to N x 48 bytes, maps control
connected to the phone company network.
bits, adds FCS in preparation for SAR.
D Channel—Full duplex 16 Kbps (basic rate) or 64
Conference on European Posts &
Kbps (primary rate) ISDN channel.
Telecommunications (CEPT)—Conference of
European Postal and Telecommunications administra- Data Communicating Equipment (DCE)—In
tions, a body that sets policy for services and interfaces RS232 communications, a device implementing the
in 26 countries. interface and handshaking of a data communications
device (such as a modem).
Connection Admission Control (CAC)—The
function of an ATM network which determines the Data Exchange Interface (DXI)—(1) ATM: A vari-
acceptability of a virtual circuit connection request and able-length frame-based ATM interface between a
determines the route through the network for such DTE and a special ATM DSU/CSU. The ATM
connections. DSU/CSU converts between the variable-length DXI
frames and the fixed-length ATM cells. (2) Defines the
Connectionless—The model of interconnection in
format for transmitting information that has gone
which communication takes place without first estab-
through the ATM convergence sublayer.
lishing a connection. Sometimes (imprecisely) called
datagram. Examples: Internet IP and OSI CLNP, UDP, Data Link Connection Identifier (DLCI)—
ordinary postcards. A value in frame relay that identifies a logical connection.
Connectionless Network Protocol (CLNP)—The Data Link Control (DLC)—The SNA layer respon-
OSI protocol for providing the OSI Connectionless sible for transmission of data between two nodes over a
physical link.

34 • The New Generation of Network Analysis and Monitoring Systems Glossary • 35

Data Terminal Equipment (DTE)—The part of a Far End Receive Failure (FERF)—A message sent
data station that serves as a data source, destination, or back upstream that the receiving network element has
both, and that provides for the data communications received a failure condition or alarm indication.
control function according to protocol. DTE includes SONET uses the FERF message at the Line Layer.
computers, protocol translators, and multiplexers.
Fast LAN—Term given to two emerging standards;
Defense Advanced Research Projects Agency IEEE 802.3u (called Fast Ethernet) for Ethernet oper-
(DARPA)—Agency of the Department of Defense ating at 100 Mbps over Cat-3 or 5 UTP, and IEEE
responsible for managing research projects and coordi- 802.12 (called 100VG-AnyLAN) for Ethernet or Token
nating activities among participating agencies, universi- Ring operating at 100 Mbps over CAT-3/4/5 UTP,
ties, research institutions, etc. STP or optic fiber.
DNS Spoofing—Assuming the DNS name of another File Transfer Protocol (FTP)—(1) An IP applica-
system by either corrupting the name service cache of a tion protocol for transferring files between network
victim system, or by compromising a domain name nodes. (2) An Internet protocol that allows a user on
server for a valid domain. one host to transfer files to and from another host over
a network.
Domain Name Service or Server (DNS)—The
DNS interprets host names into IP addresses. (Also see Filter—Generally, a process, or device that screens
IP Address.) incoming information for certain characteristics,
allowing a subset of that information to pass through.
Dynamic Routing—Routing that adjusts automati-
cally to changes in network topology or traffic. Fractional E3/T3—Fractional E3/T3 refers to the
leasing of portions of E3/T3 bandwidth (a specific
End System to Intermediate System Protocol
number of time slots) by carriers. FE3 or FT3 allows for
(ES-IS)—The OSI protocol by which end systems such
more economical networking in some applications.
as networks personal computers announce themselves
to intermediate systems such as hubs. Frame—A logical grouping of information sent as a
link-layer unit over a transmission medium. The terms
Enterprise Network—A geographically dispersed
packet, datagram, segment, and message are also used
network under the auspices of one organization.
to describe logical information groupings at various
Ethernet—(1) A baseband LAN specification invented layers of the OSI reference model and in various tech-
by Xerox Corporation and developed jointly by Xerox, nology circles.
Intel, and Digital Equipment Corporation. Ethernet
Frame Relay Forum—A voluntary organization
networks operate at 10 Mbps using CSMA/CD to run
composed of Frame Relay vendors, manufacturers,
over coaxial cable. Ethernet is similar to a series of
service providers, research organizations, and users.
standards produced by IEEE referred to as IEEE 802.3.
Similar in purpose to the ATM Forum.
(2) A very common method of networking computers
in a local area network (LAN). Ethernet will handle Full Duplex—LAN Technique for transmitting full
about 10,000,000 bits per second and can be used with duplex between a LAN station and the wiring hub.
almost any kind of computer. Supports 10 Mbps in each direction (20 Mbps) for

36 • The New Generation of Network Analysis and Monitoring Systems Glossary • 37

Ethernet and 16 Mbps in each direction (32 Mbps for specifies an encapsulation method for data on synchro-
Token Ring. Only support single stations, not LAN nous serial data links. Various manufacturers have
segments. proprietary versions of HDLC, including IBM’s SDLC.
Gateway—(1) A set of functions intended to facilitate High-Speed Peripheral Parallel Interface
electronic access by users to remote services and vice (HIPPI)—Computer channel simplex interface clocked
versa. Gateways are intended to provide a single source at 25 Mhz; 800 Mbit/s when 32 bits wide, 1.6 Gbit/s
through which users can locate and gain access to a when 64 bits.
wide variety of service. Gateways typically offer a direc-
High Speed Serial Interface (HSSI)—Standard
tory of services available through them, and provide
for a serial interface at high speeds (64 Kbps and higher
billing for these services. (2) Technically, a gateway is a
up to 52 Mbps) between DTE and DCE equipment
hardware and/or software connection that translates
over very short distances. Used for the physical connec-
information between two dissimilar protocols. The term
tion between a router and a DSU.
has come to be used, however, to describe any mecha-
nism for providing access from one system to another. High-bit-rate Digital Subscriber Line (HDSL)—
A standard defined by the TlE1.4 standards committee,
Generic Cell Rate Algorithm (GCRA)—An ATM
designed to be a cost-effective method of delivering
Forum-developed traffic shaping algorithm that utilizes
T1/E1 line speeds over unconditioned copper cable.
the traffic parameters defined on a given virtual circuit
to smooth wide fluctuations in cell traffic volumes and Hyper Text Markup Language (HTML)—(1) The
to enforce the traffic limits defined in those parameters. language used in the World-Wide Web to create web
pages with links to other documents, rich text enhance-
Gigabit—One billion bits.
ments (bold, italic, etc.) and so on. The “source” file for
Half-Duplex Transmission—Data transmitted in what you see on a web page is written in HTML. (2)
either direction, one direction at a time. The language with which World Wide Web documents
are formatted. It defines fonts, graphics, hypertext links,
Header—The five bytes in an ATM cell containing
and other details. HTML is an implementation of
address and control information. It includes payload
SGML.
type, virtual path identifier, virtual circuit identifier,
generic flow control, and cell-loss priority. Integrated IS-IS—Routing protocol based on the
OSI routing protocol IS-IS, but with support for IP or
High Definition Television (HDTV)—Television
other networks. Integrated IS-IS implementations send
systems which aim to offer approximately twice the
only one set of routing updates and are more efficient
vertical and horizontal resolution of the existing
than two separate implementations.
receivers and to provide quality approaching that of 35
mm film and audio quality equal to that of compact Interim Local Management Interface (ILMI)—
discs. See Advanced Television. Defined for ATM by the ATM Forum in the UNI 3.0
specification.
High Speed Data Link Control (HDLC)—A
protocol defined by the International Standards Interior Gateway Protocol (IGP)—The protocol
Organization and used in X.25 communications. It used to exchange routing information between collabo-

38 • The New Generation of Network Analysis and Monitoring Systems Glossary • 39

rating routers in the Internet. RIP and OSPF are exam- software players, so you can download and run them on
ples of IGPs. any computer. (2 An object-oriented language, devel-
oped by Sun Microsystems, for writing distributed Web
International Organization for Standardization
applications.
(ISO)—Best know for the 7-layer OSI Reference
Model. Jitter—Analogue communication line distortion
caused by a variation of signals from its reference
Internet Control Message Protocol (ICMP)—
timing positions. Jitter can also cause data loss, particu-
A network-layer Internet protocol that provides message
larly at high speeds.
packets to report errors and other information relevant
to IP packet processing. Documented in RFC 792. Joint Photographic Experts Group (JPEG)—
Industry organization developing standards and specifica-
Internet Engineering Task Force (IETF)—
tions for the encoding and transmission of photographic
An organization that provides coordination of
images over various media and network technologies.
standards and specifications development for TCP/IP
networking. LAN Emulation Configuration Server (LECS)—
ATM Forum-defined specification in support of LAN-
Internet Gateway Protocol (IGRP)—
to-LAN connectivity called LAN emulation. LECS
A proprietary IGP used by Cisco System’s routers.
defines that set of functions implemented in an ATM
Internetworking—General term used to refer to the network that provide LAN DTEs with information
industry that has arisen around the problem of regarding the location of other LAN Emulation services.
connecting networks together. The term can refer to
LAN Emulation Network-to-Network Interface
products, procedures, and technologies.
(LNNI)—Enables each vendors’ implementation of
IP and ARP over ATM—An adaptation of TCP/IP LAN emulation to interoperate. This is essential for
and its address resolution protocol (ARP) for ATM building multivendor ATM networks.
defined by the Internet Engineering Task Force in
LAN Emulation Server (LES)—ATM Forum-
Requests for Comment 1483 and 1577. It places IP
defined specifications in support of LAN-to-LAN
packets and ARP requests directly into protocol data
connectivity called LAN emulation. LES defines that set
units (PDUs) and converts them into ATM cells.
of functions implemented in an ATM network in
IP Version Six (IPv6)—Also known as Ipng. support of LAN-to-LAN connection establishment.
Jabber—An error condition in which a network device LAN emulation User-Network Interface (L-
continually transmits garbage onto the network. In UNI)—The definition of how legacy LAN protocols
IEEE 802.3, a data packet whose length exceeds that and applications will coexist within an ATM network.
prescribed in the standard.
LAN segmentation—Dividing LAN bandwidth into
Japanese Signaling Level 2 (J2)—Japanese stan- multiple independent LANs to improve performance.
dard for digital transmission at 36.312 Mbps.
Latency—The delay between the time a device
Java—(1) A programming language developed by Sun receives a frame and the frame is forwarded out of the
Microsystems. Applets written in Java include their own destination port.

40 • The New Generation of Network Analysis and Monitoring Systems Glossary • 41

Layer—A level of the OSI Reference Model. Each which allows higher-layer protocols, such as IP, to be
layer performs certain tasks to move the information routed over ATM.
from sender to receiver. Protocols within the layers
Network Analyser—A hardware/software device
define the tasks for networks, but not how the software
offering various network troubleshooting features,
accomplishes the tasks. Interfaces pass information
including protocol-specific packet decodes, specific pre-
between the layers they connect.
programmed troubleshooting tests, packet filtering, and
Leaky Bucket Algorithm—A form of flow control packet transmission.
that checks an arriving data stream against the traffic-
Network Basic Input Output System
shaping parameters specified by the sending node. Cells
(NetBIOS)—The standard interface to networks on
arriving at an ATM network switch are placed in a
IBM and PC compatible systems.
memory buffer (“bucket”), which is allowed to reach its
capacity but not overflow. The bucket is “leaky” in that Network Information Center (NIC)—Originally
it allows cells to flow out to their destinations which ulti- there was only one, located at SRI International and
mately allows more cells to be added to the memory tasked to serve the ARPANET (and later DDN)
buffer. community. Today, there are many NICs, operated by
local, regional, and national networks all over the
Line Overhead (LOH)—18 bytes of overhead
worlds. Such centers provide user assistance, document
accessed, generated, and processed by line terminating
service, training, and much more.
equipment. This overhead supports functions such as
locating the SPE in the frame, multiplexing or concate- Network Operations Center (NOC)—Any center
nating signals, performance monitoring, automatic tasked with the operational aspects of a production
protection switching, and line maintenance. network. These tasks include monitoring and control,
trouble-shooting, user assistance, and so on.
Local Access and Transport Area (LATA)—
(1) A geographic area established for the provision and Open Shortest Path First (OSPF)—Routing
administration of communications service. It encom- protocol for TCP/IP networks.
passes one or more designated exchanges, which are Open Systems Interconnection (OSI)—A 7-layer
grouped to serve common social, economic and other architecture model for communications systems devel-
purposes. (2) Contiguous local exchange areas that oped by ISO and used as a reference model for most
include every point served by a Bell Operating network architectures.
Company within an existing community of interest and
that serve as the dividing line for the allocation of assets Operations, Administration and Maintenance
and liabilities between AT&T and the Bell Operating (OAM)—ATM management cells defined by the ATM
Companies. (3) A telephone company term that defines Forum in the UNI 3.0 specification for the management
a geographic area; sometimes corresponds to an area of ATM devices.
code. Out of Band Signaling—An exchange access
Multiprotocol encapsulation over ATM—The signaling feature which allows customers to exchange
process for enabling an ATM device or application to call control and signaling information over a communi-
add a standard protocol identifier to the LAN data cations path which is separate from the message path.

42 • The New Generation of Network Analysis and Monitoring Systems Glossary • 43

Out-of-Frame (OOF)—An Out-of-Frame condition Point-to-Point Protocol (PPP)—(1) Successor to
occurs when a specified proportion of consecutive SLIP. Provides router-to-router and host-to-network
framing bits are in error. connections over both synchronous and asynchronous
circuits. (2) A protocol which allows a computer to use a
Packet Switch—The vehicle of the Local Public Data
modem and a regular telephone line to make a TCP/IP
Network which performs the switching function. For
connection directly to the Internet. PPP is gradually
Local Public Data Network service, this is a Telephone
replacing SLIP for this purpose.
Company facility Hub.
Private Network—A leased, private transmission
Path Overhead (POH)—A 9-octet header in the
network that links multiple locations of a company or
payload of a SONET or SDH frame that defines the
other organization, using voice and/or data communi-
structure and content of the payload. (2) Overhead
cations lines reserved exclusively for that company’s
accessed, generated, and processed by path terminating
traffic.
equipment. This overhead supports Junctions directly
related to assuring reliable end-to-end transport 6f Private Network-to-Network Interface (P-NNI)—
services, including performance monitoring, access to A routing protocol that allows multiple vendors’ ATM
virtual tributaries, and / or access to the service carried. switches to be integrated. It automatically and dynami-
Path overhead includes nine bytes of STS Path cally distributes routing information, enabling any switch
Overhead and, when the frame is VT structured, five to determine a path within the network.
bytes of VT Path Overhead.
Protocol Data Unit (PDU)—A discrete piece of
Payload Type Indicator (PTI)—A three-bit field information like a frame or a packet in the appropriate
contained in the ATM cell header. The first bit format for encapsulation and segmentation in the
indicates which AAL to be used to format the data in payload of a cell.
the payload; the second provides Explicit Forward
Pseudo-Random Binary Signal (PRBS)—
Congestion Indication (EFCI); the third indicates
A repeating pattern of 2x-1 bits which simulates “live”
whether the cell contains data Operations,
data.
Administration and Maintenance (OAM) information.
Q.2931—ITU-TSS signaling standard for ATM to
Permanent Virtual Circuit (PVC)—A defined
support SVCs. Based on the signaling standard for
virtual link with fixed end-points that are set-up by the
ISDN.
network manager. A single virtual path may support
multiple PVCs. Q.933—ITU-TSS signaling standard for Frame Relay
to support SVCs. Based on the signaling standard for
Physical Medium Dependent (PMD)—A sub
ISDN.
layer of the physical layer that interfaces directly with
the physical medium and performs the most basic bit Q.93B—Older name for ITU-TSS signaling standard
transmission functions of the network. for ATM to support SVCs.
Pleisiochronous Digital Hierarchy (PDH)— Quality Of Service (QOS)—Term for the set of
Present multiplexing scheme from T1 to T-3 and parameters and their values which determine the
higher; contrast with SDH. performance of a given virtual circuit.

44 • The New Generation of Network Analysis and Monitoring Systems Glossary • 45

Remote Access—The process of allowing remote mation. (2) A dedicated computer hardware and/or
workers to access a corporate LAN over analog or software package which manages the connection
digital telephone lines. between two or more networks.
Remote Access Server—Access equipment at a Routing Information Protocol (RIP)—An IGP
central site that connects remote users with corporate supplied with Berkeley UNIX systems. It is the most
LAN resources. common IGP in the Internet. RIP uses hop count as a
routing metric. The largest allowable hop count for RIP
Remote Monitoring (RMON)—Subset of SNMP
is 16.
MIB II allows flexible and comprehensible monitoring
and management capabilities by addressing up to ten S/T Interface (ISDN BRI)—A four-wire interface
different groups of information. between an NT1 device and a terminal adapter. Outside
North America, the local carrier usually provides the NT1
Remote Procedure Call (RPC)—A TCP/IP mech-
and the end user has the option to buy or lease a TA.
anism that provides a standard for initiating and
controlling processes on remote or distributed computer Segmentation And Reassembly (SAR)
systems. sublayer—Converts PDUs into appropriate lengths
and then formats them to fit an ATM cell format. At
Request for Comment (FRC)—(1) The document
the destination end-station, the SAR extracts payloads
series, begun in 1969, which describes the Internet suite
from the cells and converts them back into PDUs to be
of protocols and related experiments. Not all (in fact
ultimately used by applications.
very few) RFCs describe Internet standards, but all
Internet standards are written up as RFCs. (2) The Service Advertising Protocol Identifier (SAPI)—
name of the process—as well as the result—of creating Address between layers in protocol stack; e.g., subfield
standards on the Internet. New standards are proposed in first octet of LAP-D address.
and published on line, as RFCs.
Simple Network Management Protocol
RJ-45—Standard 8-wire connectors for IEEE 802.3 (SNMP)—The Internet network management
1BaseT networks. protocol. SNMP provides a means to monitor and set
network configuration and runtime parameters.
Robbed Bit Signaling (for T1)—In voice applica-
tions, the use of the least significant bit in each time slot Single Attachment Station (SAS)—Also known as
in every 6th frame for signaling purposes. “Robbing” of Class B station, a SAS is a device attached to FDDI
these bits has no significant effect on the quality of media through a single PMD connection. Typically, the
voice transmission. PMD connects to a Class A concentrator.
Router—(1) An OSI Layer 3 device that can decide Single Mode—Used to describe optical fiber that
which of several paths network traffic will follow based allows only one mode of light signal transmission.
on some optimality metric. Also called a gateway
Single-Attached Concentrator (SAC)—An FDDI
(although this definition of gateway is becoming
(or CDDI) concentrator that connects to the network by
increasingly outdated), routers forward packets from
being cascaded from an M (master) port of another
one network to another based on network-layer infor-
FDDI (or CDDI) concentrator.

46 • The New Generation of Network Analysis and Monitoring Systems Glossary • 47

Single-mode Fiber—Also called monomode. Single- Switched Virtual Circuit (SVC)—A virtual link,
mode fiber has a narrow core that allows light to enter with variable end-points, established through an ATM
only at a single angle. Such fiber has higher bandwidth network. With an SVC, the user defines the end-points
than multimode fiber, but requires a light source with a when the call is initiated that are subsequently termi-
narrow spectral width (for example, a LASER). nated at the end of the call. With a PVC, the end-
points are predefined by the network manager. A single
SMDS Network Interface (SNI)—Generic name
virtual path may support multiple SVCs.
for all layers of the interface between an end use and
the SMDS network. Switching Hubs—Hubs that use intelligent Ethernet
switching technology which interconnects multiple
SNA Network Interconnection (SNI)—A facility
Ethernet LANs and higher speed LANs, such as FDDI.
that provides cross-network communication between
two or more independent SNA networks. Synchronous Transport Module 1 (STM-1)—
SDH standard for transmission over OC-3 optical fiber
SNMPv2—SNMP version 2. The “second generation”
at 155.52 Mbps.
SNMP.
Synchronous Transport Signal 1 (STS-1)—
Spanning Tree—An algorithm, the original version of
(1) SONET standard for transmission over OC-1
which was invented by Digital Equipment Corporation,
optical fiber at 51.84 Mbps. (2) A SONET frame
used to prevent bridging loops by creating a spanning
including overhead and payload capacity. The basic
tree. The algorithm is now documented in the IEEE
SONET frame is the STS-1. STS-1s can be
802.1d specification, although the Digital algorithm and
multiplexed or concatenated with no additional over-
the IEEE 802.1d algorithm are not the same, nor are
head.
they compatible.
Telecommunications—Any transmission, emission,
Static Routing—A system in which routing informa-
or reception of signs, signals, writings, images, and
tion is manually entered into the routing table.
sounds or intelligence of any nature by wire, radio,
Station Management (SMT)—FDDI X3T9.5 spec- optical, or other electromagnetic systems.
ification that defines how ring stations are managed.
Telnet—(1) The virtual terminal protocol in the
Switched Ethernet—Configuration supporting an Internet suite of protocols. Allows users of one host to
Ethernet hub with integrated MAC layer bridging or log into a remote host and interact as normal terminal
switching capability to provide each port with 10 or 100 users of that host. (2) A software service packaged with
Mbps of bandwidth. Separate transmissions can occur most operating systems that allows the user to enter a
simultaneously on each port of the switching hub, and system via a network just as if he or she were using a
the switch filters traffic based on the destination MAC terminal attached directly to the system.
address.
Terminal Emulation—A very popular network
Switched FDDI—A technique of transparently application in which a computer runs software that
connecting separate FDDI networks at full 100 Mbps makes it appear to a host across the network as a
wire speed. directly attached dumb terminal.

48 • The New Generation of Network Analysis and Monitoring Systems Glossary • 49

Transmission Control Protocol (TCP)—A reli- UNIX to UNIX Copy Program (UUCP)—
able, full duplex, connection-oriented end to end trans- A protocol used for communication between consenting
port protocol running on top of IP. UNIX systems.
Transmission Control Protocol/Internet Unshielded Twisted Pair (UTP)—Four-pair wire
Protocol (TCP/IP)—(1) The common name for the medium used in the transmission of many different
suite of protocols developed by the U.S. Department of protocols such as Ethernet, 10BaseT, and CDDI.
Defense in the 1970s to support the construction of
User—A person who has access to the Staffware
world-wide internetworks. TCP and IP are the two
system via a computer workstation.
best-known protocols in the suite. TCP corresponds to
Layer 4 (the transport layer) of the OSI reference User Datagram Protocol (UDP)—A connection-
model. It provides reliable transmission of data. IP less transport-layer protocol belonging to the Internet
corresponds to layer 3 (the network layer) of the OSI protocol family.
reference model and provides connectionless datagram Virtual Channel Connection (VCC)—Virtual
service. (2) The collection of transport and application channels in two or more sequential physical circuits can
protocols used to communicate on the Internet and be concatenated to create an end-to-end connection,
other networks called a VCC. A VCC is a specific instance of a SVC
Tunneling Router—A router or system capable of or PVC. A VCC may traverse one end-to-end VPC or
routing traffic by encrypting it and encapsulating it for several sequential VPCs.
transmission across an untrusted network, for eventual Virtual Channel Identifier (VCI)—The 16-bit
de-encapsulation and decryption. number in an ATM cell header identifying the specific
U Interface (ISDN BRI)—The two-wire interface virtual channel on which the cell is traversing on the
that connects to the NT1 on a user’s premises. In North current physical circuit.
America it can be integrated into the customer premises Virtual Circuit (VC)—(1) A portion of a virtual path
equipment. In other countries, it is typically supplied by or a virtual channel used to establish a virtual connec-
the local carrier. tion between two end nodes. (2) Logical channels estab-
Undefined Bit Rate (UBR)—Traffic class defined by lished as a result of the call initiation procedure to a
the ATM Forum. network address that exists for a period of time.
Universal Test & Operation Physical Interface Virtual LAN—Membership to a Virtual LAN is
for ATM (UTOPIA)—A physical layer specification defined administratively independent of the physical
for local connectivity between ATM devices. network topology. A virtual LAN segment is a unique
broadcast domain.
UNIX—An operating system developed by AT&T that
is widely used by universities. UNIX uses TCP/IP as its Virtual Path—A group of virtual channels, which can
standard communications protocol, which makes support multiple virtual circuits.
UNIX a natural operating system for accessing the
Internet.

50 • The New Generation of Network Analysis and Monitoring Systems Glossary • 51

Virtual Path Connection (VPC)—Virtual paths in NOTES
two or more sequential physical circuits can be concate-
nated to create a logical connection, called a VPC.
VPCs must be pre-configured. All cells traversing VCs
in a VPC are routed the same way.
Web—Web, used as a noun, is shorthand for the World
Wide Web.
Wireless—Communication technology that does not
use wire.
Workgroup—A group of workstations and servers
that commonly exchange data. This term is also used to
describe a group of people who work together.
X.21—Recommendations developed by CCITT that
define a protocol for communication between user
devices and a circuit switched network.
X.25 Packet Mode Protocol—An international
standard developed by Consultative Committee for
International Telephone and Telegraph that provides
the foundation for public switched networks.
X.75 Packet Mode Protocol—An international
standard developed by Consultative Committee for
International Telephone and Telegraph that provides
the foundation for interconnection of individual Packet
Switched Networks.

52 • The New Generation of Network Analysis and Monitoring Systems Notes • 53

 NOTES NOTES

54 • The New Generation of Network Analysis and Monitoring Systems Notes • 55

 Visit ATG’s Web Site
to read, download, and print
all the Technology Guides
in this series.

http://www.techguide.com

“The significant problems we face cannot be solved

by the same level of thinking that created them.”

Albert Einstein
 This Technology Guide is one
of a series of guides, published
by ATG, designed to put complex
communications and networking
technology concepts into practical
and understandable terms.
Each guide provides objective,
non-biased information to assist in
the internal education, evaluation
and decision making process.
This Technology Guide, as well
as the other communications and
networking technology guides
in the series, are available
on ATG‘s Web Site.

http://www.techguide.com

Produced and Published by

0497.5000

One Apple Hill, Suite 216, Natick, MA 01760

Tel: (508) 651-1155 Fax: (508) 651-1171 E-mail: [email protected]