Lab 7.6.4 Protocol Inspector Frame Stats

Estimated time: 35 min.

Objectives:

- Use Protocol Inspector (or equivalent) software to examine some simple network utilization and frame statistics, in order to make more real the concept of frame flow as the heartbeat of the LAN

Background:

Protocol analysis software, often called protocol "sniffers", allow an in depth view of the amazing diversity of network processes. Protocol analysis software often lets you study protocols at various layers of the OSI model, especially layers 2, 3, 4, 5, and 7. In this lab you will focus on Layer 2 information. You have been studying about frames, the Layer 2 protocol data unit (PDU). Frames may seem like an abstract thing, hard to imagine, but they are constantly being sent and received by your PC on a network. One feature of protocol analysis software is the ability to gather statistics about frames on the "wire" in real-time, so you can see some of the frame processes occurring. This is one indication of the health of a network, and helps in troubleshooting network problems. Most protocol analyzers can capture frames to and from a host based on MAC address, IP address and the type of traffic to be monitored. Be warned that this is an amazingly powerful piece of software with many features, so you will learn them in small labs.

Tools / Preparation:

> Each PC must be running Windows 95, 98, or NT, Microsoft TCP/IP stack, and Winsock 2.0. Fluke Protocol Inspector 3.0 (or equivalent) must be installed on each PC. During the installation of the software you must specify which network adapter (NIC, dial-up, etc.) you wish to monitor – specify the NIC which attaches the PCs to an Ethernet. The PCs should be on either a 10BASE-T or 100BASE-TX Ethernet network which preferably includes servers, switches, routers, and printers and a connection to a web server, or preferably the Internet. (this will make the protocol analysis more interesting). The following resources will be required:

> - PC with Windows 95, 98, or NT, Microsoft TCP/IP stack, and Winsock 2.0.
> - Fluke Protocol Inspector 3.0 Software

Worksheet

> 1. Make sure the PC is connected to your LAN (local area network) which preferably is connected to the Internet. What are some ways to determine if your PC is connected to the LAN?
> 2. Install the protocol analysis software onto your computer (unless you have already done so). For Protocol Inspector, you must be sure that you have installed the correct NDIS 802.3 module as a Resource in Protocol Inspector. You will probably need to see several NDIS 802.3 modules as resources, corresponding to different installed adapters on your PC. The Protocol Inspector can only look at one of these adapters at a time, which you must choose. Open the Protocol Inspector program. Do you see multiple adapters in the resource window? (Your instructor may need to specify which one. Note that if you are doing captures and you see no traffic whatsoever, you are probably looking at the wrong resource).
> 3. Choose the correct module with a double click. Describe the 2 graphs and the 6 tabs that appear. Write down and explain everything that appears in the "Description" tab.
> 4. Click the start button (1st line of icons, 3rd icon from the left) and see if the utilization graph increases above zero (displayed as blue sections on the graph). This indicates network traffic (perhaps switch or router or DNS updates). If after about twenty seconds, you don't see anything, that's OK, click the stop button. You are about to start our own traffic.
> 5. In another window, open your email program and prepare a to send a simple email to yourself. But don't send it yet!
> 6. Click the start button in Protocol Inspector. Now send the email message and watch the utilization graph as your email is transmitted and then received. Check your email until you get the second blue "bump" indicating receipt of the email, then click the stop icon. If your network is such that the delay for receipt of emails is too long for class time, just watching the transmitted email is fine.
> 7. Check the RX tab. Look at the MAC counters column. What types of frames were received? What does each type mean? Look at the errors column (7 are listed). Imagine what the different types of frame errors are, and put, in your own words, what you think they mean. Frame types include broadcast (to all MAC addresses), multicast (to a group of MAC addresses), or unicast (to one MAC address).
> 8. At the top left of the window there should be two lines of icons. On the second line of icons, 6th from the left, is the "Detail View" Icon. Click on it and describe what happens.
> 9. From detail view, stop the capture. On the first line of icons, select the yellow "file cabinet" 8th from the left "Capture View". What happens?
> 10. Take a view, scrolling down looking at all the frames and all of the protocols involved in a simple email.
> 11. Now try out the other views: MAC statistics, Frame Size Distribution Monitor, Protocol statistics, Network Layer Host Table, Application Layer Host Table, Host Matrix, Network Layer Matrix. Comment on each.

Reflection:

> 1. Imagine you have earned your CCNA and are working in a medium-size company. Write in your journal what value you see in using Protocol analyzer software.
> 2. Does the number of protocol frames for even a simple email request surprise you? Why or why not?
> 3. Did this lab change the way you view the functioning of computer networks? Explain.