It is important for companies to determine the way network latency will fluctuate at different times to prevent possible problems. Network latency testing is therefore important whenever any project is still undergoing testing.

Causes of Network Latency

Propagation Delays: These are the delays caused by the physical distance between the source of data and its destination. A greater distance between the start and end points leads to higher latency although the delay does not necessarily have to be significant. It is relatively difficult to control propagation and this is why satellite communications tends to suffer from higher latency.

Transmission Delays: The delays result from the medium used in transmitting data, such as a wireless connection, fiber optic line or telephone line.

Computer Hardware and Router Delays: Latency problems caused by hardware and routers can be changed with relative ease. All it takes to speed up the process is to upgrade relevant hardware. However, upgrading may be fairly costly.

Testing Network Latency

A variety of tools may be used to test network latency. Some methods only work on particular operating systems. Here are the common tools used.

Ping Test:

Ping is an acronym for Packet InterNet Groper, a utility that is often used for checking network errors. Basically, this is how ping works:

• The user “pings” the required IP address with the ping command by typing “ping” followed by the desired IP address.
• The request is sent to the given IP address over the router and network hub.
• The computer with the relevant IP address uses a “pong” response to reply to the ping.

The time that elapses between issuing of the ping and receiving of the pong response is calculated to get network latency.

Communication delays are measured in milliseconds. A two-figure measurement is good and broadband connections usually measure below 30 ms. On a LAN connection if you are getting higher than 30 ms than you could be experiencing some latency on your network. However, it is not unusual for remote connections to provide a higher response time. Depending on the speed of the remote connection response times above 100 ms are acceptable.

Windows operating system sends four test messages by default and their average time determines the latency. On the other hand, Linux operating systems keep running the ping command until you stop it. To achieve this on a Windows system, type “ping -t” followed by the required IP address.

Traceroute:

This utility monitors the network route that test data takes to reach its destination. It sends several test messages to every intermediate router until the last message reaches its destination. It then displays a list of the routers in their proper order to represent the path from the origin to the destination.

In Windows, these programs can be accessed from the DOS command. They are both used in measuring round-trip time.

Measuring the round-trip time provides a better way of monitoring the overall network performance since computers communicate with each other constantly when they send and receive bytes of information.

There is also a built in windows command line tool called pathping that combines both ping and traceroute features.

Protocol analyzers are used to provide analyses of link, driver, protocol and application layers. They are normally installed between hosts and devices. They can be used to capture part of or all network traffic depending on how the network is structured.

Uses of Protocol Analyzers

The protocol analyzers help in figuring out what is right or wrong with communications being examined. They are very helpful in isolating sources of intermittent problems that may otherwise be difficult to trace.

These tools are versatile and can be used in a variety of applications, including:

• Analyzing network problems
• Gathering relevant details to effect a network intrusion
• Detecting attempts at network intrusion
• Gathering and reporting network statistics
• Monitoring network usage
• Debugging network protocol implementation
• Debugging server/client communications
• Filtering suspicious data from network traffic

The analyzers may also be used to spy on network users and even collect such sensitive data as passwords.

The Importance of Protocol Analyzers

A protocol analyzer captures and decodes data, allowing users to view the information in human readable language. In many cases, this is the only tool that will help you determine what is really happening with the network traffic on a LAN. If TCP/IP sessions start hanging, for instance, a protocol analyzer will pinpoint the system that sent the last data packet and the one that did not respond as expected. The analyzer can also show you the system that is waiting for data and the one that takes too long to respond to help you determine what causes slow screen updates.

This handy tool can show you runaway traffic and where it originates from among many other system errors. It provides you with information that you would not otherwise get to help you troubleshoot LAN problems even better.

There are five core components to a Network Protocol Analyzer

1. Front-end
2. Analyzer Software
3. Hardware trigger/filter
4. On board memory
5. Upload interface

What type of information will a protocol analyzer provide?

The analyzers provide three major sources of information on switch or LAN traffic.

1.  Network Statistics about network line errors, station health and traffic flow. This analysis shows general conditions and trends that may be used to prevent possible problems. The information may also show the best way of implementing a new switch.
2.  Packet Capture & Decode that displays decoded information from specific packet conversations to help in analyzing what happens during system-to-system communications. This is useful whether things are functioning well or not.
3. Trending Information that displays historical usage information over specific periods, which may range from a few days to several years. The trends help in determining potential problems and fix them in good time. The historical perspective may also help in solving new problems.

Protocol analyzers are not just for Network Administrators

It is not only protocol experts who can use the protocol analyzers. Network developers may also use the tools to see contents of network conversations. The graphical displays provide a lot of information besides the actual protocols. They will save many hours by determining troublesome systems quickly. The management can also benefit from the statistics provided to help in making wise decisions about the purchase of new hardware.

Bits versus Bytes in Network Speed Measurement

A “bit” is the smallest unit of information a computer can process. This is quite literally the “on” or “off” state of a transistor. This is commonly referred to as a one or zero, composing the binary numbering system. Multiple connections in a computer system are often wired in parallel groupings. For example, eight lines, which could be in an “on” or “off” state, would collectively form one byte.

If this is the most common terminology, why are bits used to measure network bandwidth and utilization? This is mostly out of tradition. In the earlier days of computer technology, a byte was not always comprised of eight bits. In some applications, it would be six bits. In applications where a technology called “parity” was used for error correction, a ninth bit might be added, where each of its two possible values could represent an odd or an even number stored in the other eight. This ninth bit could be used to determine if the previous 8 bits were transmitted correctly, or if an error occurred somewhere during transit.

Another reason for measuring network data transfer in bits is as follows. Since data travels across an electrical medium like a copper wire, fiber optic lead, or radio wave in individual pulses rather than grouped together as bytes, the individual pulses, or bits, are the logical units to measure as they are sent or arrive at their destination. Because individual bits are counted in this manner, network standards are typically displayed to the user with the terms Megabits per second or Gigabits per second. Network traffic can be measured either in the number of Kilobits, Megabits, Gigabits, or Packets that have been transferred in total.

Is your ISP telling the truth About Your Bandwidth Usage?

One theory is that broadband internet providers list their advertised speeds in megabits in order to trick gullible customers who do not know the difference. Such customers might order, for example, 15-megabit service and be upset when their maximum download speed is 1,920 kilobytes per second. However, it is clear that this is not a form of deception. 15 multiplied by 1024, which is the number of kilobytes per second in a megabit, divided by 8 to convert from bits to bytes, yields 1,920. A consumer must do a little math to know exactly what speed they will be getting. One of the fastest internet providers currently on the market in the United States offers up to 30 megabits of download speed. This equates to 3,840 kilobytes per second, or 3.84 megabytes per second. At this point in time, 30 megaBYTES per second would not be achievable on existing networks given how many customers are simultaneously utilizing the network.

Hopefully, this information has helped to clarify the differences between these measuring techniques, as well as the reasoning for their utilization.

Monitoring Server Bandwidth Ensures maximum data flow

When bottlenecks in traffic occur, users experience delays in communicating with a server, as they are waiting in a virtual line for their turn to send or receive information. It is akin to a sporting event in which only one door to the arena is open, but thousands of spectators are lining up at that one door waiting to get inside. When all of the doors are monitored and kept open, though, everyone can come and go quickly and easily. Bandwidth monitoring strategies keep the virtual doors open for server traffic.

Whether 500 as Fortune Company or a small business enterprise, all IT-reliant businesses, need networks to run their daily business operations. They need to process, store and disseminate essential operational data. In this case, these businesses operate databases, servers, routers and other network equipment that need proper monitoring. This makes it vital that every business, both large and small, who operate big or small network, must equip itself with the right network monitor. This implies that a network monitor is needed even in small networks.

As a small business relying on small networks, when there is a failure in your network, customers and employees cannot communicate, neither can they gain access to vital information for business operations. It also implies that basic services like email services and basic prints will not be available. The result is a great loss in productivity and revenue. The role of a network monitor in this case is to reduce network outages and help such a small network to operate efficiently.

Why a Small Network Needs network monitoring

Every network comprises of four critical elements that require constant monitoring by network monitoring software. These four critical elements include:

1. WAN LINKS: The WAN Links need to be optimized in a way that it is neither oversubscribed nor undersubscribed. In this case, the CIR, the burst rate and the throughput must be balanced with the response time, congestion, and discards. The router must also be monitored, as its failure will halt network.

2. Email Services: The email server is responsible for distributing emails to each LAN user. Once the email server fails, all communication with the external world halts, and business operations are hard hit.

3. LAN Infrastructures: LAN infrastructures include vital hardware like wireless devices, switches, and printers. Since these infrastructures are essential to daily business operations, their failure could mean total halt of all business operations that depend on them.

4. Businesses Applications like servers, network services, server logs, websites, and databases form the hub on which small networks run. Failure of these applications will mean complete failure for small businesses that depend on them.

A network monitor is needed in a small network, to ensure that network’s critical elements are closely monitored and secured. However, small networks have a slightly different network management requirement due to limited resources in terms of the fund and staff. In this case, it is advisable that the network monitors for small networks should be affordable, feature rich and easy to use/install. A network monitoring software helps networks to be secured and properly maintained, to prevent major errors or total network failures. Network monitoring software exhibits three main capabilities when protecting small networks:

1. Activity monitoring

2. Availability monitoring and

3. Usage monitoring capability

The small network monitor detects router slowdown and failures, including routine checks on the server and website availability, and informs the network administrator through emails, text log, SMS or network broadcast. It also monitors and analyses the network for uptimes and downtimes. Small businesses with low budgets for small network monitors can rely on open source tools for bandwidth monitoring, network discovery and network monitoring. Some Open Source tools include Kismet, Nagios and MRTG.

There is no denying logs can be effective in troubleshooting, but the point is that regular analysis of logs can actually prevent problems from occurring. Logs can uncover unreported errors, performance issues and growing problems so IT staff can take action right away. Logging also lets IT administrators to fine tune their servers, network devices and more for better performance to truly meet real world demand. Here is a look at several key areas of a network’s infrastructure and how logging and analysis can help.

Server Event Logs

Windows server event logs represent the most typical form of logging. All IT administrators know about Windows’ built in System, Application and Security logs. Instead of waiting for a server catastrophe, administrators should check these logs regularly to quell server issues.

System Log: Hardware and OS-level problems will be discovered here long before they become disastrous. Driver issues, service crashes, Group Policy problems and much more are all recorded in the System log.

Application Log: Issues specific to programs installed on a server, including application hangs and crashes, can be found here.

Security Log: The security log is especially important on Active Directory servers, where login issues are recorded. Too many failed login attempts, for example, can indicate hacking. Things like this are important to know right away.

Network Traffic

Network devices, including switches and routers, have their own logging ability. These features can be extended and made more user friendly with of third party network monitoring software. By logging network traffic, administrators can gain insight into network performance issues, high traffic periods, top traffic generators and more.

Admins can use network traffic data to evaluate the need for network improvements. It can also help narrow trouble spots like rogue DHCP servers, network attacks or just end users doing things they shouldn’t be.

Web Proxy Servers

A web proxy server or dedicated proxy device can be used to throttle traffic for high-bandwidth applications, cache pages for fast retrieval and control access to harmful or offensive sites. Proxies have the ability to log the traffic going through them, including the ability to log protective actions they have taken. Analysis of web proxy logs can help IT administrators in a number of ways, including:

*Identification of employees and sites that are consuming too much bandwidth.
*Evaluate the need for more resources if high-bandwidth online services are necessary.
*Reduce bandwidth costs by identifying and blocking resource-intensive sites.

Email Servers

Email platforms like Microsoft Exchange log all messaging activities, including the sender, recipient, message tracking information, attachment data and more. With the volume of messages that pass through a corporate email server daily, monitoring these logs can be off-putting. Considering how important email has become to the enterprise, though, it’s clear that log analysis is vital to server health.

Administrators can use email logging to monitor for suspicious activity like spam and mail-based virus attacks. It can also be used to identify senders of large attachments to reduce a company’s bandwidth costs. In addition, logging can be used to analyze mail server performance and evaluate the need for improvements, such as more storage or better mail database organization.

Web Servers

If a business hosts its own web site, their web server logs can tell them a great deal about their visitors, including:

*Where traffic is coming from
*What pages visitors view
*Time spent on site
*The search terms used to find the site
*Download information
*Site navigation statistics

This data is highly valuable to web server administrators, who can use it to optimize the site for better performance, tweak the site layout, evaluate content for SEO purposes and more.

File Servers

Most companies store important documents on centralized file servers for easy access and to allow administrators to control who can and can’t read and edit their data. Expert administrators can evaluate the server’s logs with a focus specifically on the functions of the file server role. Some things to look out for:

*File access issues, including access failures, in the Security log
*Server performance and application response time indicated in the application log and in performance monitoring
*Drive space monitoring and usage

By keeping an eye on the file server’s logs, administrators can spot unauthorized access attempts, evaluate the need for a finer degree of file control, gauge space issues and much more.

Backup Servers

A business’ disaster recovery plan is an essential piece of its information technology processes. Backup applications such as Symantec Backup Exec fill the need for a strong D.R. solution and these apps have their own characteristic log files. It’s crucial for administrators to analyze backup logs daily in order to find things like backup job failures and missed files. Examining backup logs must be done in order to assure that all important data is being backed up consistently and successfully.

These are just the general pieces of most companies’ infrastructure that need to be monitored, logged and analyzed. There are many other business-specific applications and services that also have their own logging methodologies. Only through careful, thorough and proactive log analysis can IT administrators truly be on top of their enterprises and provide the very best service to their customers.

This online IP subnetting calculator lets you enter in an IP address and subnet mask to determine the number of hosts, start host IP, end host IP, network and broadcast IP addresses.

Directions:

1. Select which network class you want to use
2. Enter in an IP address and select a subnet mask. (example, IP 192.168.16.0, Subnet Mask 255.255.255.0)
3. The results will automatically be calculated in the results section.
4.  If you want to change the number of subnets or hosts per subnets, simply select the desired selection from the input section. All IP information will be automatically calculated for you.

A network bottleneck is a delay in data transmission or data transfer through a computer network. Delays occur when a system’s power is overloaded by the amount of information and/or data that it is required to process. Bottlenecks slow the flow of data across the network. Since the first computer networks were designed to transmit text files, the TCP/IP protocol that computers use to communicate with one another over a network is designed for smaller files. High density graphics files and other rich media transferred over the web can severely tax the bandwidth capabilities of networking protocols and computer systems that utilize them, which can lead to slowdowns or crashes.

Network bottlenecks slow communications and can lead to serious crashes and downtime. Although some systems today are designed to continue to function even after maximum capacity has been reached, the bottleneck is still in effect since not all the data the system is attempting to transfer or process is being handled.

Bottlenecks can be subdivided into two categories:

• Short-term bottlenecks – Short-term bottlenecks are caused by temporary problems such as hardware failures or software glitches than can be easily corrected or repaired. Short-term bottlenecks can be identified and rectified without further consideration, because once the problem is repaired and the bottleneck is remedied it will no longer exist.

• Long-term bottlenecks – These are reoccurring bottlenecks that can primarily be blamed on a lack of resources or proper equipment. Examples of long-term bottlenecks would be a preponderance of inefficient or slow hardware, or an archaic network or broadband connection that prevents traffic from being consistently routed through the network.

How to identify a network bottleneck:

Bottlenecks can occur due to some of the following causes. Please note that this is not a complete list of possible bottleneck areas, just some suggestions:

• Cable – Bad cables can destroy a network. Most modern networks run at 100Mpbs or 1000Mpbs, so it’s extremely important to ensure that all cables are working effectively. If a cable is crossed with a high-voltage power line, the power line can actually degrade the signal of the cable and cause a network outage or bandwidth bottleneck. Also, since many network cable installs are done with self-made cables (cut and crimped by networking professionals) it’s common for these connections to fray and falter.
• Network interface – One PC with a bad network adapter can degrade the signal of the entire network.

• Defective RAM – Since networking occurs in real-time, systems that handle networks are often RAM-intensive devices. Defective or improperly installed RAM memory can lead to networking bottlenecks when the system in question can’t handle the entire throughput of the network due to low memory accessibility.

• Software issues – Sometimes server software has glitches or defective code. Other times, exploits can be found by hackers which provide access into systems that can heavily utilize network resources. A good example of this is when a compromised system is used for DDoS (Distributed Denial of Service) attacks. A DDoS attack is when many systems are used to simultaneously send commands to a remote server. If a compromised system is used for a DDoS attack, much or all of its bandwidth might be utilized by the attackers, creating a catastrophic bottleneck.
• The other side of the coin is that a a DDoS attack can be used to create a bottleneck when targeted at a specific system. When commands from many thousands or hundreds of thousands of systems are sent to the same address, it can cause a catastrophic network overload which destroys the utility of the system. Even a small DDoS attack can cripple medium-sized networks, especially without firewalls or other tools.

Now that we understand what bottlenecks are, what kind of bottlenecks exist, and how they can affect system performance, we’ll try to understand how to combat them and remedy the bottleneck issue. In order to remedy the bottleneck issue, we’ll first have to identify it. Many network tools exist which can help identify bottlenecks. These tools can help determine exactly what device or process is causing the bottleneck.

How to troubleshoot these bottlenecks:

There are many software tools that allow systems administrators to identify network bottlenecks. Once the bottleneck is identified, it can be repaired. Most major systems distributors have network bottleneck diagnostic tools built in, but there are also proprietary systems by third-party publishers specifically designed to diagnose network bottlenecks, create workarounds, and create repairs.

It is important to constantly monitor networks for bottlenecks, especially work-critical networks. Diagnostic tools can constantly run tests and identify where networks are running at less-than-peak efficiency.

Network Bottlenecks Concluded

Although network bottlenecks can cause catastrophic general network failure, it is important to remember that monitoring tools and proactive preventative maintenance can prevent these issues. Wiring should be periodically checked, computers taken off-line and tested, and diagnostic tools run on networks, especially sensitive networks that see heavy use. With the right combination of preventative maintenance and diagnostics, as well as proactive detection, most network bottlenecks can be addressed before they cause major systems failure or collapse.

Hi, this is Matt with NetworkMonitorSoftware.net and in this video I’m going to show you how to configure Netflow on a Cisco Router. Netflow is a technology developed by Cisco to help Network Administrators collect IP traffic information. Netflow has become popular for monitoring network traffic on various devices. The Netflow data can be sent to a network management system to analyze the network traffic.

Netflow will need to be enabled on each interface you want to monitor. You probably only need NetFlow enabled on your upstream interface(s), not on the local Ethernet interface. In this example, I will activate NetFlow on the serial interface and send its Netflow flow data to 192.168.15.150 5678

The first thing you need to do is to connect into your Cisco Router to access the console. This can be done by a serial, telnet or an SSH connection. Once I’ve made a connection into the router I’m going to go into privilege mode or often called enable mode, this is done with the command :

Router> en

From privilege mode I want to get into the global configuration mode by typing

Router# config t

I now want to get into the serial interface so I can enable netflow on that interface, to do this I type in the command

Router(config)#int se0

Now to enable netflow on this interface I issue the command

Router(config-if)#ip route-cache flow

Router(config-if)#exit

Repeat these steps on all interfaces you want to monitor network traffic on. The next step is to tell the router which version of Netflow to use. Cisco routers and Netflow analyzers support multiple versions of Netflow, version 5 and 9 are the most popular. Typically version 5 is used to get started and that’s what version I use on my Cisco routers.

To tell the router which version of Netflow to use you will need to be in global configuration mode and issue the command:

Router(config)#ip flow-export version 5

The last step is to tell your router where to send its Netflow data. To do this you will need to be in global configuration mode and issue the command:

Router(config)#ip flow-export destination 192.168.15.150 5678

Replace the IP address and port number with the device you will be using to collect Netflow data. Now save this configuration by issuing the write memory command.

Router# wr

That’s all there is to it you should start seeing data in your NetFlow analyzer program. If you want to verify Netflow is working from the router side you can use the command:

Router# show ip cache flow

This will show you Netflow statics on the interfaces you enabled Netflow on.

Some Cisco models use slightly different syntax for configuring Netflow. If you have trouble, check the Cisco’s website for the syntax on your router model.  Here is a nice PDF I found on Cisco’s website that lists and explains all the Netflow commands Cisco IOS Netflow Commands Reference

I hope this guide to configure Netflow on a Cisco router was useful. For more Network Monitoring tips, free tools and articles visit my site http://networkmonitorsoftware.net

Almost all Cisco devices support NetFlow since its introduction in the 11.1 train of Cisco IOS Software and because of this, NetFlow is most likely available in any devices in the network. If you know of a device that supports NetFlow and is not listed below please send me an email so the list will stay current.

To learn more about Netflow see this Cisco article –  Introduction to Cisco IOS Netflow – A Technical Overview