Download Network Architectures

Network Problems and Tools
Part 2
ITEC 370
George Vaughan
Franklin University
1
Sources for Slides
• Material in these slides comes primarily
from course text, Guide to Networking
Essentials,Tomsho, Tittel, Johnson (2007).
• Other sources are cited in line and listed in
reference section.
2
TCP/IP and OSI Models
TCP/IP and OSI Models (OSI-Model, n.d.) and (Tomsho, 2007)
TCP/IP
Layers
Application
PDU
Data
OSI Layers
7 Application
6
5
Transport
Segments 4
Network
Packets
3
Link
Frames
2
Function
Network process to application,
Initiates or accepts a request to transfer
data
Presentation Adds formatting, display, and
encryption of information
Session
Adds communication session control
information, Login/Logout
Transport
Adds End-to-end connections and
reliability, re-sequencing, flow control
Network
Path determination and logical
addressing (IP), translates MAC
address to logical address
LLC
Data
Adds error checking and physical
Link
addressing (MAC & LLC)
Devices - Apps
Standards
Browsers,
servers,
Gateways
Gateways
HTTP, SNMP,
FTP, Telnet
DNS,
Gateways
Gateways
NetBIOS
Routers
IP, ICMP,
ARP, NetBEUI
Switches,
Bridges, NICs
802.3, 802.11,
FDDI
ASCII, MPEG
TCP, UDP
MAC
Bits
1 Physical
Media, signal and binary transmission, Hubs,
sends data as a bit stream
Repeaters
10Base-T, T1,
E1
3
Making Use of Problem Solving Tools
•
•
•
•
•
•
Digital Volt Meter (DVM)
Time-Domain Reflectometer (TDR)
Basic Cable Testers
Advanced Cable Testers
Oscilloscopes
Network Monitors
• Protocol Analyzers
4
Digital Voltmeter (DVM)
• Measures a cable’s
resistance
• Can determine if a cable
break occurred
• Can also be used to
identify short circuits
– A short circuit (or short)
prevents network traffic
from traversing the cable
and requires repair or
replacement of that cable
5
Time-Domain Reflectometer (TDR)
• A TDR, like a DVM, can determine
whether there’s a break or short in a
cable
• Measures the time it takes for signal to
return and estimates how far down the
cable the fault is located
– A high-quality TDR can determine the
location of a break within a few inches
• TDRs are available for fiber-optic as well
as electrical cables
• TDR function is standard in most
advanced cable testers
• Use a TDR to document actual lengths of
all cables
6
Basic Cable Testers
• Basic cable testers cost less than $100
• Typically test only the correct termination of a twistedpair cable or continuity of a coaxial cable
• Excellent tools for checking patch cables and testing for
correct termination of a cable at the patch panel and jack
• Can only verify that the cable wires are terminated in
correct order or that there are no breaks in the cable
• Can’t check a cable for attenuation, noise, or other
possible performance problems in your cable run
7
Advanced Cable Testers
• Advanced cable testers not only measure
where a break is located in a cable, but
can also gather other information,
including a cable’s impedance, resistance,
and attenuation characteristics
• Functions at both the Physical and Data
Link layers of the OSI model
– Can measure message frame counts,
collisions, congestion errors, and beaconing
information or broadcast storms
– They combine the characteristics of a DVM, a
TDR, and a Protocol Analyzer
8
Oscilloscopes
• Oscilloscopes are
advanced pieces of
electronic equipment that
measure signal voltage
over time
• When used with a TDR,
an oscilloscope can help
identify shorts, sharp
bends, or crimps in a
cable, cable breaks, and
attenuation problems
9
Network Monitors
• Network monitors are software packages that can track all or part
of the network traffic
– By examining packets sent across the network, they can track
information such as packet type, errors, and traffic
– Can collect this data and generate reports/graphs
– E.g., Windows Server 2000/2003 Network Monitor, WildPacket’s
EtherPeek, Network Instruments Analyst/Probe, and Information
Systems Manager Inc.’s PerfMan
10
Protocol Analyzers
• A protocol analyzer evaluates the network’s overall
health by monitoring all traffic
– Also captures traffic and decodes received packets
– Some combine HW and SW in a self-contained unit
• May include built-in TDR to help determine the
network’s status
– E.g., Network General Sniffer, Ethereal, WildPacket
EtherPeek, Fluke Network Protocol Inspector
• Experienced network administrators rely on protocol
analyzers to establish baselines for network
performance and to troubleshoot their networks
11
TCPDUMP
• Unix/Linux command line protocol analyzer
(packet sniffer) used for:
– Debugging networks
– Debugging applications that depend on networking.
– Monitoring traffic
• Ported to Windows
– Windump
• Supports user defined filters
• Command Line syntax:
tcpdump -v –e
• Check Man page for other options
12
TCPDUMP (Cont.)
• Example: Ping (Internet Control Message Protocol)
– 16:23:57.892354 00:15:f2:4d:52:19 > 00:20:ed:73:b7:1d,
ethertype IPv4 (0x0800), length 74: IP (tos 0x0, ttl 128, id 8475,
offset 0, flags [none], proto 1, length: 60) 192.168.1.101 >
192.168.1.12: icmp 40: echo request seq 11520
–
–
–
–
–
–
Timestamp = 16:23:57.892354
Source (MAC Address) = 00:15:f2:4d:52:19
Destination (MAC Address) = 00:20:ed:73:b7:1d
Source IP = 192.168.1.101
Destination IP = 192.168.1.12
Protocol = icmp
13
TCPDUMP (Cont.)
• Example: arp (Address Resolution Protocol)
– 16:22:37.497442 00:15:f2:4d:52:19 > Broadcast,
ethertype ARP (0x0806), length 60: arp who-has
192.168.1.112 tell 192.168.1.101
–
–
–
–
Timestamp = 16:22:37.497442
Source (MAC Address) = 00:15:f2:4d:52:19
Destination (MAC Address) = Broadcast
Protocol = arp who-has 192.168.1.112 tell
192.168.1.101
14
TCPDUMP (Cont.)
• example: Web Request
– 16:22:43.383893 00:20:ed:73:b7:1d > 00:16:b6:21:71:d1,
ethertype IPv4 (0x0800), length 74: IP (tos 0x0, ttl 64, id 42626,
offset 0, flags [DF], proto 6, length: 60) 192.168.1.12.56478 >
www8.cnn.com.http: S [tcp sum ok] 970586877:970586877(0)
win 5840 <mss 1460,sackOK,timestamp 5790847 0,nop,wscale
2>
–
–
–
–
–
Timestamp = 16:22:43.383893
Source (MAC Address) = 00:20:ed:73:b7:1d
Destination (MAC Address) = 00:16:b6:21:71:d1
Source IP = 192. 92.168.1.12
Destination IP = www8.cnn.com.http
15
Wireshark (Ethereal)
• Name change in 06/2006 due to trademark
issues.
• GUI based protocol analyzer
• Available for Unix, Linux, Windows
• Open Source application
– www.ethereal.com
– Documentation:
http://www.ethereal.com/docs/#userguide
• Can be used to analyze raw data files from
TCPDUMP tool.
• Supports user-defined filters.
16
Ethereal (Cont.)
17
ARP
Broadcast
ARP
Unicast
Response
TCP 3-way
Handshake
ARP
Broadcast
• SYNC
•SYNC-ACK
•ACK
Broadcast
Message
18
Common Troubleshooting
Situations
• This section outlines some common network
problems and possible solutions
19
Cabling and Related Components
• Majority of networking problems occur at the Physical
layer
• First, determine whether the problem lies with the cable
or the computer
– Make sure you use the same type of UTP cable
throughout the network
– Check cable lengths to make sure you don’t exceed
the maximum length limitation
– If you suspect a faulty or misconfigured NIC, check
the back of the card
– If the NIC seems functional and you’re using TCP/IP,
use Ping to check connectivity to other computers
20
Power Fluctuations
• Power fluctuations in a building can adversely affect
computers
• Verify that servers are up and functioning
– Remind users that it takes a few minutes for servers
to come back online after a power outage
• You may eliminate effects of power fluctuations by
connecting devices to UPSs
• Some packages perform shutdowns automatically,
eliminating the need for human intervention when power
failures or severe power fluctuations occur
21
Upgrades
• When you perform network upgrades, remember three
important points
– Ignoring upgrades to new software releases and new
HW can lead to a situation in which a complete
network overhaul is necessary because many
upgrades build on top of others
• Keep current and do one upgrade at a time
– Test any upgrade before deploying it on your
production network
– Don’t forget to tell users about upgrades
22
Poor Network Performance
• When performance problems appear, answering these
questions should help pinpoint the causes
– What has changed since the last time the network
functioned normally?
– Has new equipment been added to the network?
– Have new applications been added to computers?
– Is someone playing electronic games in the network?
– Are there new users on the network? How many?
– Could any other new equipment, such as a
generator, cause interference near the network?
23
References
Tomsho, Tittel, Johnson (2007). Guide to Networking
Essentials. Boston: Thompson Course Technology.
Odom, Knott (2006). Networking Basics: CCNA 1
Companion Guide. Indianapolis: Cisco Press
Wikipedia (n.d.). OSI Model. Retrieved 09/12/2006 from
http://en.wikipedia.org/wiki/OSI_Model
24