Reccomend a Switch for Network troubleshooting?

I'm looking for a switch I can use for helping with network troubleshooting.
One that has one port on it that will see all of the Packets on the switch
regardless of the port the packet is destined for. I think its called a
Mirror or RMON port?? I would need at least 16 ports.

Any recommendations?

Thanks,
Scott<-

Hello,

mirroring port or monitor port (the same) copy packet from/to a port to
another. While that sound great in debugging, that overload the switch. I
already saw Cisco 3550 starting to loose packet when activating the
mirroring, just for a port with 10Mb/s.

For 16 ports, your may just use a hub

How much traffic in total through all these 16 ports do you expect ?

TAP are great for this activity, but i think it's limited to one cable at a
time

--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


"Scott Townsend" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I'm looking for a switch I can use for helping with network
> troubleshooting. One that has one port on it that will see all of the
> Packets on the switch regardless of the port the packet is destined for. I
> think its called a Mirror or RMON port?? I would need at least 16 ports.
>
> Any recommendations?
>
> Thanks,
> Scott<-
>

Hello Scott,

Thank you for using newsgroup!

As far as I know, Portmon is a utility that monitors and displays all
serial and parallel port activity on a system. It has advanced filtering
and search capabilities that make it a powerful tool for exploring the way
Windows works, seeing how applications use ports, or tracking down problems
in system or application configurations.

Portmon for Windows v3.02
http://www.microsoft.com/technet/sys...s/portmon.mspx

Thanks & Regards,

Ken Zhao

Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security <http://www.microsoft.com/security>
================================================== ==
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ==
This posting is provided "AS IS" with no warranties, and confers no rights.





--------------------
| From: "Scott Townsend" <(E-Mail Removed)>
| Subject: Reccomend a Switch for Network troubleshooting?
| Date: Thu, 4 Oct 2007 09:41:36 -0700
| Lines: 11
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.3790.3959
| X-RFC2646: Format=Flowed; Original
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4073
| Message-ID: <(E-Mail Removed)>
| Newsgroups: microsoft.public.windows.server.networking
| NNTP-Posting-Host: 204-145-245-241.enm.com 204.145.245.241
| Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSF TNGP05.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.server.networking:7869
| X-Tomcat-NG: microsoft.public.windows.server.networking
|
| I'm looking for a switch I can use for helping with network
troubleshooting.
| One that has one port on it that will see all of the Packets on the
switch
| regardless of the port the packet is destined for. I think its called a
| Mirror or RMON port?? I would need at least 16 ports.
|
| Any recommendations?
|
| Thanks,
| Scott<-
|
|
|

Hello,

he wants to sniff other server network communication, port on switch not
socket's port

good tool anyway

--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


""Ken Zhao [MSFT]"" <v-(E-Mail Removed)> wrote in message
news(E-Mail Removed)...
> Hello Scott,
>
> Thank you for using newsgroup!
>
> As far as I know, Portmon is a utility that monitors and displays all
> serial and parallel port activity on a system. It has advanced filtering
> and search capabilities that make it a powerful tool for exploring the way
> Windows works, seeing how applications use ports, or tracking down
> problems
> in system or application configurations.
>
> Portmon for Windows v3.02
> http://www.microsoft.com/technet/sys...s/portmon.mspx
>
> Thanks & Regards,
>
> Ken Zhao
>
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> <http://www.microsoft.com/security>
> ================================================== ==
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ==
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
>
>
>
> --------------------
> | From: "Scott Townsend" <(E-Mail Removed)>
> | Subject: Reccomend a Switch for Network troubleshooting?
> | Date: Thu, 4 Oct 2007 09:41:36 -0700
> | Lines: 11
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | X-Newsreader: Microsoft Outlook Express 6.00.3790.3959
> | X-RFC2646: Format=Flowed; Original
> | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4073
> | Message-ID: <(E-Mail Removed)>
> | Newsgroups: microsoft.public.windows.server.networking
> | NNTP-Posting-Host: 204-145-245-241.enm.com 204.145.245.241
> | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSF TNGP05.phx.gbl
> | Xref: TK2MSFTNGHUB02.phx.gbl
> microsoft.public.windows.server.networking:7869
> | X-Tomcat-NG: microsoft.public.windows.server.networking
> |
> | I'm looking for a switch I can use for helping with network
> troubleshooting.
> | One that has one port on it that will see all of the Packets on the
> switch
> | regardless of the port the packet is destined for. I think its called a
> | Mirror or RMON port?? I would need at least 16 ports.
> |
> | Any recommendations?
> |
> | Thanks,
> | Scott<-
> |
> |
> |
>

I'm not sure how much traffic is on the Switch. (-; That's why I'd like to
take a peak inside and see what's flying around in there. I have some
10Meg Hubs, though Thought it should not be to much overhead to copy the
packet to a 2nd port if Hubs can do it to all Ports. I know its not built
the same, though ....

What I usually end up doing is Putting the Hub at the Uplink port on the
Switch where it goes to the next mainstream switch, or router. SO in the
case of finding out who is hogging our internet connection I put the Hub
between the firewall and the Core LAN Switch. So I get any packets in and
out of the firewall to the local LAN. We looking for a more 'efficient'
solution.

So no Low end switches that can do this?

Thanks,
Scott<-


"Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hello,
>
> mirroring port or monitor port (the same) copy packet from/to a port to
> another. While that sound great in debugging, that overload the switch. I
> already saw Cisco 3550 starting to loose packet when activating the
> mirroring, just for a port with 10Mb/s.
>
> For 16 ports, your may just use a hub
>
> How much traffic in total through all these 16 ports do you expect ?
>
> TAP are great for this activity, but i think it's limited to one cable at
> a time
>
> --
> Cordialement,
> Mathieu CHATEAU
> English blog: http://lordoftheping.blogspot.com
> French blog: http://www.lotp.fr
>
>
> "Scott Townsend" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> I'm looking for a switch I can use for helping with network
>> troubleshooting. One that has one port on it that will see all of the
>> Packets on the switch regardless of the port the packet is destined for.
>> I think its called a Mirror or RMON port?? I would need at least 16
>> ports.
>>
>> Any recommendations?
>>
>> Thanks,
>> Scott<-
>>
>

You would get the feature on the first HP managed switch, but you may expect
packet loss quickly.

If you can plug between the core switch and the other, then you could buy a
TAP.

What sort of troubleshooting are you looking for ?

--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


"Scott Townsend" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> I'm not sure how much traffic is on the Switch. (-; That's why I'd like
> to take a peak inside and see what's flying around in there. I have some
> 10Meg Hubs, though Thought it should not be to much overhead to copy the
> packet to a 2nd port if Hubs can do it to all Ports. I know its not
> built the same, though ....
>
> What I usually end up doing is Putting the Hub at the Uplink port on the
> Switch where it goes to the next mainstream switch, or router. SO in the
> case of finding out who is hogging our internet connection I put the Hub
> between the firewall and the Core LAN Switch. So I get any packets in and
> out of the firewall to the local LAN. We looking for a more 'efficient'
> solution.
>
> So no Low end switches that can do this?
>
> Thanks,
> Scott<-
>
>
> "Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Hello,
>>
>> mirroring port or monitor port (the same) copy packet from/to a port to
>> another. While that sound great in debugging, that overload the switch. I
>> already saw Cisco 3550 starting to loose packet when activating the
>> mirroring, just for a port with 10Mb/s.
>>
>> For 16 ports, your may just use a hub
>>
>> How much traffic in total through all these 16 ports do you expect ?
>>
>> TAP are great for this activity, but i think it's limited to one cable at
>> a time
>>
>> --
>> Cordialement,
>> Mathieu CHATEAU
>> English blog: http://lordoftheping.blogspot.com
>> French blog: http://www.lotp.fr
>>
>>
>> "Scott Townsend" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> I'm looking for a switch I can use for helping with network
>>> troubleshooting. One that has one port on it that will see all of the
>>> Packets on the switch regardless of the port the packet is destined for.
>>> I think its called a Mirror or RMON port?? I would need at least 16
>>> ports.
>>>
>>> Any recommendations?
>>>
>>> Thanks,
>>> Scott<-
>>>
>>
>

General Traffic Stats mostly, Who's talking to who.

Though I have a customer that has several nodes talking to a server querying
it For Data. Sometimes the Clients are displaying Stale Data. The Integrator
that installed the system things its a network issue. Customer provided
small 8 & 16 port Netgear Switches for a industrial environment with quite a
bit of traffic. So the Integrator thinks that the Netgear stuff needs to be
replaces with something a bit more robust. I would Agree. We have not seen
too many Netgear switches on the Plant floor in a Production environment.

So I wanted to see how much Data is really there.

Scott<-


"Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> You would get the feature on the first HP managed switch, but you may
> expect packet loss quickly.
>
> If you can plug between the core switch and the other, then you could buy
> a TAP.
>
> What sort of troubleshooting are you looking for ?
>
> --
> Cordialement,
> Mathieu CHATEAU
> English blog: http://lordoftheping.blogspot.com
> French blog: http://www.lotp.fr
>
>
> "Scott Townsend" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> I'm not sure how much traffic is on the Switch. (-; That's why I'd like
>> to take a peak inside and see what's flying around in there. I have
>> some 10Meg Hubs, though Thought it should not be to much overhead to copy
>> the packet to a 2nd port if Hubs can do it to all Ports. I know its not
>> built the same, though ....
>>
>> What I usually end up doing is Putting the Hub at the Uplink port on the
>> Switch where it goes to the next mainstream switch, or router. SO in the
>> case of finding out who is hogging our internet connection I put the Hub
>> between the firewall and the Core LAN Switch. So I get any packets in and
>> out of the firewall to the local LAN. We looking for a more 'efficient'
>> solution.
>>
>> So no Low end switches that can do this?
>>
>> Thanks,
>> Scott<-
>>
>>
>> "Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> Hello,
>>>
>>> mirroring port or monitor port (the same) copy packet from/to a port to
>>> another. While that sound great in debugging, that overload the switch.
>>> I already saw Cisco 3550 starting to loose packet when activating the
>>> mirroring, just for a port with 10Mb/s.
>>>
>>> For 16 ports, your may just use a hub
>>>
>>> How much traffic in total through all these 16 ports do you expect ?
>>>
>>> TAP are great for this activity, but i think it's limited to one cable
>>> at a time
>>>
>>> --
>>> Cordialement,
>>> Mathieu CHATEAU
>>> English blog: http://lordoftheping.blogspot.com
>>> French blog: http://www.lotp.fr
>>>
>>>
>>> "Scott Townsend" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>> I'm looking for a switch I can use for helping with network
>>>> troubleshooting. One that has one port on it that will see all of the
>>>> Packets on the switch regardless of the port the packet is destined
>>>> for. I think its called a Mirror or RMON port?? I would need at least
>>>> 16 ports.
>>>>
>>>> Any recommendations?
>>>>
>>>> Thanks,
>>>> Scott<-
>>>>
>>>
>>
>

"Scott Townsend" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Though I have a customer that has several nodes talking to a server
> querying it For Data. Sometimes the Clients are displaying Stale Data. The
> Integrator that installed the system things its a network issue.

Not likely. It is impossible to have stale data on a "live" and "statefull"
connection,...and by the same token a lost connection would crash or error
out the Application if it no longer sees the connection. The only kind of
Application that survives a lost connection and continues to show the "last
data" it received would be a "stateless" Application like a Web Application
(a web site). There may be some slight variations and exceptions to that
idea but is it pretty much accurate.

So just because you see old data does not mean you have a slow or down
connection and in fact your connection could be fine but there are flaws in
the Application's design itself. You would be amazed at how much data you
can feed to /from an Application with even a 9600baud modem,...you're not
transfering binary files and video in most cases,..it is usually just a
bunch of numbers, often as ASCII Text,...particularly on a factory
production floor.

We are a TV Station and have a Transmitter at a separate location. Now the
broadcast feed (1 Analog and 2 HDTV) is sent 14 miles to the Transmitter
over a 7gig Microwave but that isn't really relevant and doesn't compare to
what you have,..you have much less data than that,...but all the Transmitter
Building's "specs" and monitoring "data", which would compare to what you
have, are monitored with an Application on a PC using a simple dialup modem.

I guess my main point here is to not get tunnel vision and get locked into
one idea of what might be wrong with it just because the Integrator "says
so". If the Integrator is associated with the company that the equipment
comes from,..or particularly if a flaw in the equipment or Application would
make him "look bad" he would be less likely to blame any of that and it
would be very very convienent for him to just blame "your network". I face
that tendency all the time around here with vendors that we get some of our
stuff from. Sometimes they may be right, but sometimes they aren't.

We had a similar situation as yours with some weather equipment where the
radar sweeps were jumping all over the place. It builds and displays the
sweeps based on a flow of numerical data (ASCII Text) that is fed to it over
the Internet. They claimed it was acting like that because our link was too
slow and it was falling behind and hence the sweep was "skipping". The
truth was that a new feed was deployed for this new system and they never
stopped the old feed. So it was getting two feeds at once with conflicting
data. So the sweep was jumping because it was getting conflicting,
non-consistant, non-sequential data. Not only was our link fast enough,..it
was fast enough to give it two feeds at the same time :-).

Just something to think about...

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

You may just graph interface traffic through SNMP or performance monitor.

This way you don't need the switch.

Check for error on interfaces : netstat -e
Also check drivers to be up-to-date and duplex.

--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


"Scott Townsend" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> General Traffic Stats mostly, Who's talking to who.
>
> Though I have a customer that has several nodes talking to a server
> querying it For Data. Sometimes the Clients are displaying Stale Data. The
> Integrator that installed the system things its a network issue. Customer
> provided small 8 & 16 port Netgear Switches for a industrial environment
> with quite a bit of traffic. So the Integrator thinks that the Netgear
> stuff needs to be replaces with something a bit more robust. I would
> Agree. We have not seen too many Netgear switches on the Plant floor in a
> Production environment.
>
> So I wanted to see how much Data is really there.
>
> Scott<-
>
>
> "Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> You would get the feature on the first HP managed switch, but you may
>> expect packet loss quickly.
>>
>> If you can plug between the core switch and the other, then you could buy
>> a TAP.
>>
>> What sort of troubleshooting are you looking for ?
>>
>> --
>> Cordialement,
>> Mathieu CHATEAU
>> English blog: http://lordoftheping.blogspot.com
>> French blog: http://www.lotp.fr
>>
>>
>> "Scott Townsend" <(E-Mail Removed)> wrote in message
>> news:%(E-Mail Removed)...
>>> I'm not sure how much traffic is on the Switch. (-; That's why I'd like
>>> to take a peak inside and see what's flying around in there. I have
>>> some 10Meg Hubs, though Thought it should not be to much overhead to
>>> copy the packet to a 2nd port if Hubs can do it to all Ports. I know
>>> its not built the same, though ....
>>>
>>> What I usually end up doing is Putting the Hub at the Uplink port on the
>>> Switch where it goes to the next mainstream switch, or router. SO in
>>> the case of finding out who is hogging our internet connection I put the
>>> Hub between the firewall and the Core LAN Switch. So I get any packets
>>> in and out of the firewall to the local LAN. We looking for a more
>>> 'efficient' solution.
>>>
>>> So no Low end switches that can do this?
>>>
>>> Thanks,
>>> Scott<-
>>>
>>>
>>> "Mathieu CHATEAU" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>> Hello,
>>>>
>>>> mirroring port or monitor port (the same) copy packet from/to a port to
>>>> another. While that sound great in debugging, that overload the switch.
>>>> I already saw Cisco 3550 starting to loose packet when activating the
>>>> mirroring, just for a port with 10Mb/s.
>>>>
>>>> For 16 ports, your may just use a hub
>>>>
>>>> How much traffic in total through all these 16 ports do you expect ?
>>>>
>>>> TAP are great for this activity, but i think it's limited to one cable
>>>> at a time
>>>>
>>>> --
>>>> Cordialement,
>>>> Mathieu CHATEAU
>>>> English blog: http://lordoftheping.blogspot.com
>>>> French blog: http://www.lotp.fr
>>>>
>>>>
>>>> "Scott Townsend" <(E-Mail Removed)> wrote in message
>>>> news:(E-Mail Removed)...
>>>>> I'm looking for a switch I can use for helping with network
>>>>> troubleshooting. One that has one port on it that will see all of the
>>>>> Packets on the switch regardless of the port the packet is destined
>>>>> for. I think its called a Mirror or RMON port?? I would need at least
>>>>> 16 ports.
>>>>>
>>>>> Any recommendations?
>>>>>
>>>>> Thanks,
>>>>> Scott<-
>>>>>
>>>>
>>>
>>
>

Hey Phillip,

Thank you for your reply.

The Application I'm dealing with is an Application called InTouch from
Wonderware. Its a Human Machine Interface Package (HMI). It talks to a I/O
server with then Talks to Programmable Logic Controllers (PLCs, ) on the
plant floor. So if there is an issue with the communications between the
I/O Server and the PLC, (which can be UDP, RS-232, RS-485,
ProfiBus/ProfiNet, etc) the I/O wont get any updates and when the InTouch
Application talks to the IO Server it wont get the Current Data.

There are many things about the System I don't know yet, so I can only
speculate different things. There are 8 machines running the InTouch App
and the I/O Server could be installed on the same machine talking to many
PLCs, Or all the PLCs could be talking to one I/O Server that is talking to
many PLCs or the PLCs could talk amongst themselves and the I/O Server just
talks to one PLC. So Until I find out some Specifics I cant be too sure of
some things.

Basically we were hired as a third Party to either confirm or debunk the
'Network Related' issue allegations. So It May not be the cause of the
stale data, but it does need be be looked at to eliminate it or confirm it.
If I can prove its not a network issue then the SI needs to be more
involved. SI is in Europe, we are in California.

So I'll be looking at many things while there, I just wanted to be prepared
with something that will let me see what's on the network.

Thanks,
Scott<-



"Phillip Windell" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "Scott Townsend" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Though I have a customer that has several nodes talking to a server
>> querying it For Data. Sometimes the Clients are displaying Stale Data.
>> The Integrator that installed the system things its a network issue.
>
> Not likely. It is impossible to have stale data on a "live" and
> "statefull" connection,...and by the same token a lost connection would
> crash or error out the Application if it no longer sees the connection.
> The only kind of Application that survives a lost connection and continues
> to show the "last data" it received would be a "stateless" Application
> like a Web Application (a web site). There may be some slight variations
> and exceptions to that idea but is it pretty much accurate.
>
> So just because you see old data does not mean you have a slow or down
> connection and in fact your connection could be fine but there are flaws
> in the Application's design itself. You would be amazed at how much data
> you can feed to /from an Application with even a 9600baud modem,...you're
> not transfering binary files and video in most cases,..it is usually just
> a bunch of numbers, often as ASCII Text,...particularly on a factory
> production floor.
>
> We are a TV Station and have a Transmitter at a separate location. Now the
> broadcast feed (1 Analog and 2 HDTV) is sent 14 miles to the Transmitter
> over a 7gig Microwave but that isn't really relevant and doesn't compare
> to what you have,..you have much less data than that,...but all the
> Transmitter Building's "specs" and monitoring "data", which would compare
> to what you have, are monitored with an Application on a PC using a simple
> dialup modem.
>
> I guess my main point here is to not get tunnel vision and get locked into
> one idea of what might be wrong with it just because the Integrator "says
> so". If the Integrator is associated with the company that the equipment
> comes from,..or particularly if a flaw in the equipment or Application
> would make him "look bad" he would be less likely to blame any of that and
> it would be very very convienent for him to just blame "your network". I
> face that tendency all the time around here with vendors that we get some
> of our stuff from. Sometimes they may be right, but sometimes they aren't.
>
> We had a similar situation as yours with some weather equipment where the
> radar sweeps were jumping all over the place. It builds and displays the
> sweeps based on a flow of numerical data (ASCII Text) that is fed to it
> over the Internet. They claimed it was acting like that because our link
> was too slow and it was falling behind and hence the sweep was "skipping".
> The truth was that a new feed was deployed for this new system and they
> never stopped the old feed. So it was getting two feeds at once with
> conflicting data. So the sweep was jumping because it was getting
> conflicting, non-consistant, non-sequential data. Not only was our link
> fast enough,..it was fast enough to give it two feeds at the same time
> :-).
>
> Just something to think about...
>
> --
> Phillip Windell
> www.wandtv.com
>
> The views expressed, are my own and not those of my employer, or
> Microsoft, or anyone else associated with me, including my cats.
> -----------------------------------------------------
>
>