Network Monitoring of WAN

[maometh]

I recently 'grew into' (read: it fell in my lap) a Network Admin role with my company. I'm pretty new to all this and I was wondering if I can get some advice on monitoring the traffic across the company's WAN.
We have a frame relay managed by our ISP and my manager wants to increase the size of the pipe to our other locations because he's been getting complaints about poor performance. But right now, we don't even know if were utilizing the bandwidth we have, so I can't tell whether or not increasing the bandwidth is going to do any good. What can I do to gather statistics on the data that passes though the WAN? I'd like to know things like: where the traffic is going, what time of day is it most congested, and so on. We're running an NT Network, so is there something that I can install between the switch and the router that will let me know these kinds of things without affecting speed?
I'm very excited about this new role so I welcome any comments, let me know if more info is necessary,
Thanks
Maometh

 

[spidey07]

If the frame-relay is managed by your ISP, then get them to provide usage reports for you.

Most Frame-relay providers will give you reports. If you want to monitor it your self then you'll need some kind of RMON probe or SNMP poller. Try downloading What's Up Gold from www.ipswitch.com

You can then poll each of the interface IDs on the router(s) and read ifInOctets and ifOutOctets.

If you want a simple test of reponse time then ping the far end router LAN ip address during peak hours. Anything under over 500ms is considered slow. 200-500 ms is OK. under 200 is good

cheers,
spidey

 

[puritan]

There are many different things that you need to be able to look at to see where your traffic is going and how much is there. First, what kind of routers do you have. Second, what size frame circuits do you have and are they point to point, or ponit to multipoint? One PVC is point to point, aka circuit only goes to one place. Point to multipoint means that you have several possible PVC's to travel to. The most important thing is routers. Most vendors will let you have a copy of their viewing tools. Or you should be able to get an eval version of their monitoring software. IE: CiscoView for Cisco equipment or Transcend for 3COM gear etc. You can use something like What's up Gold to get generic stats, but all you'll get is how many octets in and out of the routers and other generic info.

Good luck!

 

[pcmark]

Spidey is right. Any good ISP has bandwidth monitoring available for it's customers. We use a system called Concord at my work to provide reports for our customers.

 

[goldboyd]

you're isp should definately be able to give you some usage info. also you might want to look at mrtg

 

[LadyDi]

Hey, I'm really glad for you. I have taken on a net. admin. position as well and am also very new to the feild.

We use What's Up Gold, which was mentioned above and I have also set up MRTG (that took a little patience) to monitor bandwidth utilization. MRTG is nice as the output is all graphical.

Good luck with your new challenge.

Diana

 

[spidey07]

To anybody trying to monitor their WAN links or anything else (servers, switches, RMON probes)

Use Concord's Network Health. It is godlike.

Otherwise let your provider do all the hard work for you. That's why you pay them so much money!!!

spidey

 

[maometh]

Thanks for the help everyone. I requested some usage stats from the ISP on Friday, they said they'd send a report so hopefully that will answer all my questions. In the meantime I've been experimenting with What Up Gold.
To Puritan, my WAN router is an old IBM 2210 and I'm not sure if the circut is point to multipoint or point to point. It seems point to multipoint because connection coming off the CSU goes to a single circut installed by the telco on the wall (I assumed that if it were point to point there would be a seperate circut for each office we are connecting to, please correct me if I'm wrong). The pipes to each of the differnt offices can be sized differently according to the destination. My link to the UK is 256K, to Australia its also 256K and to Toronto its 128K.
I'm going to go check out Concord's Network Health and MRTG now,
Maometh

 

[puritan]

Actually, all the point to multipoint is done inside the telco. You have a certain sized connection to your local telco. At the telco's CO, Central Office, you connect from the DACS switch to a carriers frame switch. This is where all of the magic happens. Your other 3 locations all have similar connections. The Frame carrier decides who can talk to whom. The frame carrier builds PVC, permanent virtual circuits, to your other sites. So, everything is virtual once you enter the carrier's network. You router recieves packets of info from the carrier about these PVCs. These packets of info are called LMI's. (I forget what they stand for) The LMI's basically tell your router what pvc's are available and the IP address of the router servicing that PVC. You'll see a PVC number for each circuit. This is like a MAC address in the ethernet world. When you send something to a next hop out of the router, it actually uses the information from the LMI packets to know where to send it to. It looks up the next hop's IP address in your list of PVC's in the router and sends that data to the PVC number. This is a port on a frame switch at the other end of your carriers network that connects to another local telco's DACS switch, back through another dedicated circuit and into your other router.

Hope this helps some more! And see if IBM has something to montor those routers with. If you only have 3 or 4 routers, you may want to look at something like Openview that you can customize pretty heavily to suit your needs.

Thanks!

 

[spidey07]

one last bit of info 128k and 256k frame relay links are pretty slow.

Then again depends on your applications and number of people per site.