| Title: | DEChub/HUBwatch/PROBEwatch CONFERENCE |
| Notice: | Firmware -2, Doc -3, Power -4, HW kits -5, firm load -6&7 |
| Moderator: | NETCAD::COLELLA DT |
| Created: | Wed Nov 13 1991 |
| Last Modified: | Fri Jun 06 1997 |
| Last Successful Update: | Fri Jun 06 1997 |
| Number of topics: | 4455 |
| Total number of notes: | 16761 |
Is there a problem with the Probewatch IPX packet decode? I'm currently doing a LAN analysis at a customer and have both a packetprobe and NG Sniffer installed. When I view the top hosts list on both devices, the sniffer shows me the 3COM MAC address of the Novell 4.1 servers. Probewatch show node 00-00-00-00-00-01, which when I capture the packets and decode, is the destination or source node number in the IPX part of the frame. As I do not know Novell very well, I could have all this info wrong. But I would expect to see the MAC addresses vs. the network node #, because if you have multilple IPX networks, as I do in this case, you can have multiple Netware nodes with an ID of 1. If the top host stats counts all packets from/to the same IPX node id, it is counting wrong and the statics reports will be incorrect. The LAN I'm analyzing has 3 Netware servers. I have to confirm with the customer tomorrow, but I believe the're on different network #s although on the same ethernet segment. Can someone verify this with Frontier. I have saved all the data from yesterdays collection and the data capture I took this morning. I also have the Sniffer reports to compare it too, although the counts will differ as they were recorded a week ago on the same LAN. Let me know if you require them. -Larry
| T.R | Title | User | Personal Name | Date | Lines |
|---|---|---|---|---|---|
| 3197.1 | Probewatch vs Sniffer reports | TROFS::WEBSTER | NIS, London, Canada | Wed Jan 24 1996 02:39 | 76 |
Here is the top 10 list from Probewatch (note. IP 89.2.40.253 is the
probe and .252 is the probewatch host).
Page 1
Conversation Report
Sorted by: Utilization (Top 10)
Agent: probe90 From: Mon Jan 22, 1996 10:15
Domain: ALL To: Tue Jan 23, 1996 08:15
Util % Pkts/sec Avg Size Pkts Bytes Errors
------- -------- -------- ---- ----- ------
00-00-00-00-00-01 0.71% 12.32 701.21 1.0M 684M 0
00-80-5f-90-70-0d 0.20% 8.81 270.39 698K 189M 0
Total 0.92% 21.13 521.56 1.7M 873M 0
00-00-00-00-00-01 0.21% 3.02 852.72 239K 204M 0
00-80-5f-90-4a-3c 0.01% 1.56 92.31 124K 11M 0
Total 0.22% 4.58 593.47 363K 215M 0
00-00-00-00-00-01 0.11% 2.08 636.90 165K 105M 0
DEC -3c-d8-4b 0.10% 2.15 585.19 170K 100M 0
Total 0.21% 4.23 610.66 335K 205M 0
89.2.40.252 0.10% 3.80 295.23 301K 89M 0
89.2.40.253 0.11% 3.86 321.90 306K 98M 0
Total 0.20% 7.66 308.68 606K 187M 0
00-00-00-00-00-01 0.12% 1.71 853.05 135K 115M 0
00-80-5f-90-1d-69 0.01% 0.89 98.86 71K 7.0M 0
Total 0.13% 2.60 594.28 206K 122M 0
00-00-00-00-00-01 0.12% 1.71 847.49 135K 114M 0
00-80-5f-90-b3-3e 0.01% 0.89 93.26 70K 6.6M 0
Total 0.13% 2.59 589.43 205K 121M 0
00-00-00-00-00-01 0.11% 1.44 914.30 114K 104M 0
00-80-5f-90-00-e0 0.01% 0.74 92.70 59K 5.4M 0
Total 0.11% 2.18 635.44 173K 110M 0
2.11 0.03% 1.84 194.80 146K 28M 0
2.13 0.08% 2.71 354.39 214K 76M 0
Total 0.11% 4.55 289.78 360K 104M 0
00-00-00-00-00-01 0.07% 2.01 425.94 159K 68M 0
DEC -3c-bf-7b 0.03% 1.99 145.25 157K 23M 0
Total 0.10% 3.99 286.32 316K 91M 0
00-00-00-00-00-01 0.09% 1.32 842.89 104K 88M 0
DEC -3c-e5-f2 0.01% 0.69 86.43 55K 4.7M 0
Total 0.10% 2.01 582.09 159K 93M 0
Here's a sniffer report for the same LAN segment (do not have a
conversation report).
Monitoring Started 1/1/15 11:16
Monitoring Stopped 1/1/16 13:17
Elapsed Time 1 day(s) 02:01:22
Node Name Bytes Errors Size % Rel
1 Compaq6802CE "6,046,451,439" 0 638 56.46
2 DECnet000B08 "583,476,491" 0 143 6.13
3 Compaq702208 "314,486,794" 0 663 2.93
4 Compaq54512E "291,402,602" 0 1036 2.68
5 00A0D10013F7 "279,412,283" 0 1156 2.56
6 Compaq90700D "185,957,570" 0 319 1.79
7 DECnet000D08 "150,295,949" 0 171 1.54
8 DECnet0001A0 "130,161,806" 0 411 1.23
9 CompaqF84B1D "127,760,622" 0 1353 1.17
10 DECnet000F08 "114,097,538" 0 105 1.26
The last message said 3COM MAC address... should have said Compaq.
The top 3 Compaq addresses are the Netware servers.
-Larry
| |||||
| 3197.2 | Probewatch top 20 list | TROFS::WEBSTER | NIS, London, Canada | Wed Jan 24 1996 02:45 | 39 |
Actually, here's the top 20 report (transfered wrong file).
Page 1
Host Report
Sorted by: Outbound Utilization (Top 20)
Agent: probe90 From: Mon Jan 22, 1996 10:14
Domain: ALL To: Tue Jan 23, 1996 08:14
--------------OUTBOUND------------- ----INBOUND---
Host Util% Pkt/sec Error% Mcast% Bcast% Util% Pkt/sec
--------------------------- ------ ------- ------ ------ ------ ------ -------
00-00-00-00-00-01 5.52% 109.24 0.00% 0.0% 0.0% 1.25% 81.45
00-80-5f-90-70-0d * 0.17% 6.01 0.00% 0.0% 0.0% 0.52% 8.44
2.11 0.15% 6.86 0.00% 2.1% 0.0% 0.31% 8.23
DEC -3c-d8-4b * 0.10% 2.12 0.00% 0.0% 0.0% 0.11% 2.05
2.13 0.10% 3.85 0.00% 2.0% 0.0% 0.05% 2.80
89.2.1.11 0.09% 5.98 0.00% 0.0% 0.0% 0.12% 7.56
40.1 0.09% 2.94 0.00% 6.6% 0.0% 0.02% 1.93
89.2.40.253 * 0.08% 3.03 0.00% 0.0% 0.0% 0.08% 3.01
89.2.40.252 * 0.08% 3.01 0.00% 0.0% 0.0% 0.08% 3.03
2.10 0.05% 0.65 0.00% 15.7% 0.0% 0.00% 0.23
2.12 0.04% 2.06 0.00% 3.7% 0.0% 0.02% 2.19
2.16 0.04% 1.02 0.00% 6.4% 0.0% 0.02% 1.02
00-80-5f-90-1d-87 * 0.04% 5.09 0.00% 0.0% 0.0% 0.04% 5.09
2.15 0.03% 0.81 0.00% 8.0% 0.0% 0.02% 0.75
Intel -52-9b-cb 0.02% 2.96 0.00% 0.0% 0.6% 0.03% 2.94
DEC -3c-bf-7b * 0.02% 1.16 0.00% 0.0% 0.5% 0.04% 1.16
89.2.1.12 * 0.01% 1.29 0.00% 0.0% 0.0% 0.01% 1.72
2.18 * 0.01% 0.15 0.00% 17.6% 0.0% 0.00% 0.01
00-80-5f-90-ab-f5 * 0.01% 1.31 0.00% 0.0% 0.0% 0.07% 1.39
00-80-5f-90-b3-20 * 0.01% 0.89 0.00% 0.0% 0.0% 0.05% 1.03
'*' indicates that host is new this period.
| |||||
| 3197.3 | Bug in firmware/Probewatch combo | NYOSS1::PASAGE::PLUNKETT | Wed Jan 24 1996 13:14 | 5 | |
The 00-00-00-00-01 address is bogus. There is a bug in the V2.?
firmware/Probewatch 3.2 combo. I got rid of the bug by upgrading to
the V2.6 firmware.
-Craig
| |||||
| 3197.4 | Firmware/Software at latest rev. | TROFS::WEBSTER | NIS, London, Canada | Fri Jan 26 1996 10:58 | 3 |
I just upgraded the probe to V2.6 firmware and the software is at 3.3. -Larry | |||||
| 3197.5 | Anyone listening? | TROOA::LWEBSTER | NIS, London, Canada | Mon Apr 22 1996 16:59 | 6 |
Has anyone else seen this problem? The problem still exists with V2.6 firmware and V3.3 Probewatch. Any comments???? -Larry | |||||