LoveMyTool - Open Community for Network Management and Monitoring

How many errors are acceptable on switch and router ports? (by Chris Greer)

Quick answer? Nada, Zero, Zilch! (Sure there are exceptions – but you wanted a quick answer, right?)

I recall reading a whitepaper one time which gave target average utilization and error levels for Ethernet ports. In the report, it mentioned that a target level for traffic should be 40% on average. I was ok with that number, seemed normal to me. The next figure given was for errors (like packet drops, FCS Errors, late collisions, etc…) and the acceptable figure for a healthy network was 1% of port utilization. So according to the whitepaper, if the utilization rate was at 40%, then .4 percent of that traffic could be errors, and all would be ok.

HUH?

So to put some real numbers to that, a 1Gbps network interface with 40% utilization would be 400Mbps. If the average packet size was around 350 bytes, this would mean that for any given second, there would be just over 142,000 packets flying by. So if 1% of these had errors, that would be 1,420 packets per second. As we have discussed on Love My Tool in the past, when a packet has an error, it is dropped by the next switch or router port it crosses. Since Ethernet is not responsible for retransmission (that’s TCP’s job), the switch or router does nothing to report this issue, other than add a counter to its error log. This means that for every packet drop, discard, FCS error, late collision, or long/short frame, we have to wait for TCP to timeout and retransmit, which takes time. These errors have a huge impact on network and application performance, and can really undermine the business.

How can we find them?

To put it simply, look at our routers and switch ports for errors. Does this mean that we have to comb through every router and switch, doing a “show interface” on all ports? If we don’t have a tool to do it for us – yes, we do. That can get a bit tedious, so some tool manufacturers have an SNMP based interface scanner that can comb your whole enterprise for errors, presenting them front and center so you can resolve them. The Fluke Networks OptiView XG is one such tool. It scans all known switches and routers, and if it finds Ethernet Errors, packet discards, or discovers excessive utilization, it will alert the front page, displaying the switch and port number.

Cool huh?
Don’t let errors get you down. Find the little buggers and resolve them, before they impact critical business applications.

Author Profile - Chris Greer is a Network Analyst for Packet Pioneer. Chris has many years of experience in analyzing and troubleshooting networks. He regularly assists companies in tracking down the source of network and application performance problems using a variety of protocol analysis and monitoring tools including Wireshark. When he isn’t hunting down problems at the packet level, he can be found teaching various analysis workshops at Interop and other industry trade shows. Chris also delivers training and develops technical content for several analysis vendors. He can be contacted at chris (at) packetpioneer (dot) com.

Key Questions a Cyber Security Solution Must Answer (by Jay Botelho)

Do you feel prepared for a cyber-related attack? Although most IDS/IPS systems do a very good job with the “D” (detection) and “P” (prevention), hackers still make their way in. High profile cases are all over the news, and those are just the ones we hear about.

Once an intrusion does occur, IDS/IPS and other security solutions fail to provide network engineers with the details they need to determine the magnitude of the intrusion and assess the impacts, key steps in reassuring yourself, management, and customers that you know exactly what happened, what was compromised and how it will be prevented in the future. In addition to perimeter-based network security, like IDS/IPS and firewall solutions, network recorders with network forensics capabilities are required. Without them, you are potentially exposing your network, and your company’s reputation, to a great deal of damage.

5 Ways to Improve Web Security (by Emmanuel Carabott)

Web security is a vast subject spanning many different levels. Most people start implementing web security using the basic tools, such as a firewall, installing antivirus on the internet gateway or possibly a solution to manage patches on the internet gateway server. This is all well and good, but is it enough? 

Can our web security be improved further? The answer to such a question is yes; it most certainly can be further improved. There are several things that an administrator can do to improve the organization’s web security, so let’s go through the five most important ways in which this can be done.

1. User access control

Malware can infiltrate your organization via the internet in one of two ways. You can either be hit by an automated worm that autonomously searches the internet for victims, or one of your users accesses an infected site thus infecting his machine and possibly spread to other machine or across the whole network. Controlling access rights can greatly reduce the risk of one of your users visiting an infected site thereby starting this undesired chain of events.


Five Challenges of Firewall Management Every Company Must Address (by Nimrod Reichenberg)

Improperly managed firewalls are the source of some of the greatest business risks in an organization, yet they often go unnoticed until it is too late. Gaps in compliance, breaking application functionality and unauthorized network access are all the result of poorly managed firewalls.

There are five significant challenges of firewall management that every company must address, but more importantly, they must first be aware of them.

Assessing the risk of the firewall policy

Just because traffic is flowing and applications are working, doesn’t mean the network is secure. Our research has uncovered many firewall misconfigurations that may leave networks vulnerable to attacks.

Managing firewall changes

In IT, the only constant is change. Managing change is a problem without the right tools and processes, especially when it comes to firewalls. A lack of formal policies, loose processes, poor communication, not understanding business risks, network complexity and not understanding the impact of changes can all lead to compromising network security and business continuity.

Three Cool Things You Can Do with Compass Live (by Chris Bloom)

As network traffic continues to increase, it is even more important to have a tool that helps network engineers pinpoint where issues are occurring on their network, in both real time and post capture, for deeper network analysis. For this reason, WildPackets created Compass Live, a real-time interactive dashboard for analyzing wired and wireless networks. Compass Live has a series of interactive graphs that provide visualization into everything from overall utilization of the network to top protocols and nodes with both .pkt (from WildPackets) and .pcp (from Wireshark) trace files.

We launched a Beta version of our project during the summer, and received a lot of great user feedback. Below are a few of the key features that beta users found of particular interest.

Wireless Signal Strength

For wireless networks, Compass Live offers a unique signal strength graph. To do this, simply change the graph to “Signal” and you will see the average signal strength of your network over time. Like all the graphs provided in this dashboard, you have the ability to dissect signal strength, and view it from a protocol or particular node viewpoint, making it easy to troubleshoot signal strength problems for specific users or access points.

Looking at Cisco's EIGRP (by Tony Fortunato)

As part of my 'Network Janitor' series, I whipped up this quick video discussing EIGRP, where it should be, configuration changes, etc.. 

EIGRP is one of those essential protocols that often goes unchecked, so check it out!

Enjoy

 

Continue reading other LoveMyTool posts by Tony Fortunato »

 

A Quick Look At Spanning Tree (by Tony Fortunato)

I was asked to share some of the info I cover when teaching my Switching and Bridging class

I like using Spanning Tree as a stability indicator because it is transmitted in clear text, at a set interval (hello timer value) and is typically enabled as a default.

I also like the fact that I  do not need a mirror or span port to capture these packets.

 

Enjoy

 

Continue reading other LoveMyTool posts by Tony Fortunato »

 

Application vs. Network – The Fight is On! (by Jay Botelho)

Users are experiencing slow Application Response Time (ART) and the blame goes first to the network, so the network engineer - you - must once again climb into the ring for the classic match between network and application performance. The best outcome is a knock out in the first round, allowing you to address the frustrated user as quickly as possible. So, what can you do to help guarantee that the fight will be quick?

The Weigh In: Create Your Baselines

In order to determine if users are experiencing unusual latencies, you of course have to know what is usual on your network. Part of your preparation for the fight is to be sure to baseline your network, with a focus on both network and application latencies, before entering the ring. Be sure to assess latencies across a wide range of users (especially those in different physical locations) and your full range of applications. When possible, collect network traffic at multiple locations, with one being as close to the users as possible and the other as close to the application and data servers as possible. The value of a baseline is in performing trend analysis, so run baselines at regular intervals to possibly even see issues before users report them. It’s impossible to predict the winner if you don’t know your network’s and applications’ normal behavior, as well as how new applications may affect your network.

Investigating Network Outages With My XG (by Tony Fortunato)

One of the first things I do after a reported network outage is to check the uptime of the network equipment. 

Many times a device reboot could explain what happened.  WHY it rebooted is a whole other article.

I've been using Fluke Network's Optiview XG lately and like its feature to report if I device rebooted in the past 5 days.  I can also change the number of days for different scenarios.

In this video, I investigate a Cisco switch and why it rebooted using my XG, but the methodology is still relevant and can be performed manually.

Enjoy

Continue reading other LoveMyTool posts by Tony Fortunato »

 

What port am I on, I use my Etherscope (by Tony Fortunato)

Many times I need to know what switch and port a device is connected to. 

In some cases this involves setting up a small expedition to trace cables and validate old documentation or maps. 

If the customer has a manageable switch or one that transmits CDP or LLDP, I can usually figure this out a lot quicker without leaving the customers desk with my Etherscope.

At the end of the excercise, I always validate that the reported switch and port info is correct...  You never know when things are a bit off.

Check it out.

Enjoy

Continue reading other LoveMyTool posts by Tony Fortunato »