HP Transcend Traffix Manager - Manual

C A GGREGATING D EVICES Overview 129 Default Aggregation 129 Specifying an Aggregation Policy 130 D U SING THE S UBNETS DB F ILE Using the SubnetsDB File 133 How Subnet Grouping Works 135 E A UTOMATIC A TTRIBUTE A SSIGNMENT Overview 137 Contents of the User-defined Attributes Configuration File 138 ...

A BOUT T HIS G UIDE This guide describes Transcend ® Traffix ™ Manager version 3.0 for Windows NT. This application gathers, displays and analyzes enterprise-wide network traffic. Procedural information on how to perform all tasks using Traffix Manager, as well as context-sensitive information about...

12 A BOUT T HIS G UIDE An overview of the RMON-1 and RMON-2 standards, and an introduction to how Traffix Manager uses RMON-2 agents to collect data from your network. Chapter 3 Information on grouping devices to create views of your network in the Map. Chapter 4 Procedures for launching Traffix Man...

Conventions 13 Conventions Table 2 and Table 3 list conventions that are used throughout this guide. Information about what’s new in this release of Traffix Manager. Release Notes A list of known problems in this release of Traffix Manager. Release Notes Table 1 Where to find specific information (c...

14 A BOUT T HIS G UIDE Terminology Used in this Guide Refer to the Glossary at the end of this User Guide for definitions of terms. Terms which are defined in the Glossary are italicized at their first use in the User Guide. Related Documentation The following documents and Web sites contain useful ...

Documentation Comments 15 RMON-2 Protocol Identifiers: http://www.it.kth.se/docs/rfc/rfcs/rfc2074.txt Miscellaneous List of third-party agents which are supported by Traffix Manager: http://www.3com.com/network_management/probe_interop Links to network management information: http://snmp.cs.utwente....

I G ETTING S TARTED WITH T RAFFIX M ANAGER Chapter 1 Traffix Manager Overview Chapter 2 Launching Traffix Manager for the First Time

1 T RAFFIX M ANAGER O VERVIEW This chapter introduces you to Traffix ™ Manager. It contains the following sections: ■ What to Read First ■ Features of Traffix Manager ■ How Does Traffix Manager Work? ■ Strategy for New Users What to Read First Chapters 1–5 contain a conceptual overview of the proces...

20 C HAPTER 1: T RAFFIX M ANAGER O VERVIEW The Traffix Manager online help contains detailed procedural information on how to perform all tasks, and information about each application dialog box. The Traffix Manager Release Notes contain installation information, and a list of known problems with th...

How Does Traffix Manager Work? 21 ■ Industry standards — Traffix Manager supports the IETF RMON-2 standard, which enables information about network and application layer protocol communication patterns to be collected. See “RMON Overview” on page 37 for more information. ■ Open Database for Storage ...

22 C HAPTER 1: T RAFFIX M ANAGER O VERVIEW Figure 1 Traffix Manager Gathers Data from the Network The collected data is stored in the database, and checked against configured event rules to see whether a traffic event should be generated. See Chapter 9 , “Using Event Rules” , for more information. T...

Strategy for New Users 23 Strategy for New Users If you have just begun using Traffix Manager to monitor your network, you should do the following: ■ Set up a limited number of agents from which to collect data until you become familiar with the data collection process. Then you can configure other ...

Launching the Traffix Manager Client 27 configuration of data sources, and take you to the point where traffic data is displayed in the main window. The startup wizard first prompts you for the DNS domain(s) of those devices which you want to monitor in detail. Traffix Manager considers this specifi...

28 C HAPTER 2: L AUNCHING T RAFFIX M ANAGER FOR THE F IRST T IME Figure 2 Traffix Manager Main Window Stopping Traffix Manager To stop a Traffix Manager client, click Exit on the File menu in the main window. To stop the Traffix Manager server, click Stop Server in the Traffix Control Panel. Stoppin...

Main Window Reference 29 ■ Map — Contains a graphical representation of the network, showing the hierarchy of objects and the traffic flowing between them. ■ Graph Panel — Shows the most significant network activity of the currently selected objects in graphical form. See Chapter 8 , “Displaying Tra...

32 C HAPTER 2: L AUNCHING T RAFFIX M ANAGER FOR THE F IRST T IME See Chapter 7 , “Displaying Network Traffic in the Main Window” for detailed information on working with objects in the main window. Index Launches online help with the Index tab selected. About Launches the About Traffix Manager scree...

II H OW T RAFFIX M ANAGER W ORKS Chapter 3 Collecting Data Chapter 4 Grouping Network Devices in the Map

3 C OLLECTING D ATA This chapter describes how Traffix ™ Manager collects data from your network. It contains the following sections: ■ How Traffix Manager Processes Collected Data ■ RMON Overview ■ How Traffix Manager Discovers Network Devices Using RMON-2 How Traffix Manager Processes Collected Da...

36 C HAPTER 3: C OLLECTING D ATA Figure 3 Collected Data is added to a Relational Database From the collected data, you can build up a picture of normal levels of network traffic and typical network usage. You can then configure event rules which provide you with information about the traffic on you...

RMON Overview 37 RMON Overview Traffix Manager supports all agents that are compliant with the Internet Engineering Task Force (IETF) Remote MONitoring Management Information Base Version 1 (RMON-1 MIB), defined in RFC 1757, and Version 2 (RMON-2 MIB), defined in RFCs 2021 and 2074. The RMON standar...

38 C HAPTER 3: C OLLECTING D ATA single segment. Traffix Manager uses RMON-2 functionality to build up a picture of communicating devices on the network and the traffic flowing between them, including network layer addresses and protocols seen. For further information on RMON-1 and RMON-2, refer to ...

4 G ROUPING N ETWORK D EVICES IN THE M AP This chapter contains the following sections: ■ Overview ■ Attributes ■ Groupings Overview With Traffix ™ Manager, you can group devices in the Map according to your own criteria. You can view the use of your network by, for example, cost center, business un...

40 C HAPTER 4: G ROUPING N ETWORK D EVICES IN THE M AP Attributes To understand how Traffix Manager groups devices in the Map, it helps to be familiar with the concepts of attributes and groupings . An attribute is a label for a piece of information about a device: for example, location or IP addres...

Attributes 41 MAC Addr Only devices which are in the same broadcast domain as the interface on an RMON-2 agent will have the MAC address attribute assigned to them. See “Assigning MAC Addresses” on page 42 for an example of this. Vendor The Vendor attribute is only assigned if the following criteria...

42 C HAPTER 4: G ROUPING N ETWORK D EVICES IN THE M AP Assigning MAC Addresses When the client is first started, it tries to locate the Traffix Manager server through the use of a broadcast message. If the system on which the client is running is not in the same broadcast domain as the server, this ...

Groupings 43 The Map shows a hierarchical view of the devices in your network according to the selected grouping. By selecting a Geographical grouping for example, devices will be grouped according to which country they are in. Within each country, devices may be grouped according to which city they...

44 C HAPTER 4: G ROUPING N ETWORK D EVICES IN THE M AP a Add appropriate entries to the SubnetsDB configuration file. See Appendix D , “Using the SubnetsDB File” , for details. b Either start a new database or use Reload Attributes... with Subnets checked to update the attributes of existing devices...

Groupings 45 Figure 5 Attributes dialog box The Attributes dialog box displays, in rows, a list of selected devices on your network, and in columns, a list of available attributes. By default, devices currently selected in the Map are listed, with values for the attributes that apply to the selected...

46 C HAPTER 4: G ROUPING N ETWORK D EVICES IN THE M AP Figure 6 Groupings dialog box

III R UNNING T RAFFIX M ANAGER Chapter 5 Launching Traffix Manager After the First Time Chapter 6 Configuring Agents for Data Collection Chapter 7 Displaying Network Traffic in the Main Window Chapter 8 Displaying Traffic in Graphs Chapter 9 Using Event Rules Chapter 10 Viewing Events Chapter 11 Ove...

5 L AUNCHING T RAFFIX M ANAGER A FTER THE F IRST T IME This chapter provides information on how to launch Traffix ™ Manager, after the first time. It contains the following sections: ■ Launching the Traffix Manager Server ■ Launching a Traffix Manager Client ■ Client Access Levels Launching the Traf...

50 C HAPTER 5: L AUNCHING T RAFFIX M ANAGER A FTER THE F IRST T IME To use a remote server, you must add the IP address of the machine running the server to the shortcut in the Start menu. To do so, follow these steps: 1 Select Settings from the Start menu, and then Taskbar ... 2 In the Taskbar Prop...

6 C ONFIGURING A GENTS FOR D ATA C OLLECTION This chapter describes how to use Traffix ™ Manager to identify and enable RMON agents on your network for data collection. It contains the following sections: ■ Supported RMON Agents and Interfaces ■ Finding Agents for Data Collection See “RMON Overview”...

52 C HAPTER 6: C ONFIGURING A GENTS FOR D ATA C OLLECTION Finding Agents for Data Collection The agents used may be devices with RMON-1 or RMON-2 embedded within them, such as switches or hubs, or they may be dedicated stand-alone RMON probes. You can search for compatible agents from the startup wi...

Finding Agents for Data Collection 53 To enable you to manage large numbers of collection agents, agent folders can be created in the tree and the agents dragged and dropped into them. Adding and Editing Agents From the Configure Agents dialog box you can use Traffix Manager to automatically find ag...

Finding Agents for Data Collection 55 Traffix Manager. See Appendix G for more information about setting the mode on 3Com standalone RMON-2 agents.

7 D ISPLAYING N ETWORK T RAFFIC IN THE M AIN W INDOW This chapter contains the following sections: ■ Loading Network Traffic Data ■ Working with Objects in the Main Window ■ Displaying Network Traffic Data ■ Protocols, Applications and Favorites ■ Device Aggregation Before you can display traffic da...

58 C HAPTER 7: D ISPLAYING N ETWORK T RAFFIC IN THE M AIN W INDOW Figure 7 Load Traffic dialog box Working with Objects in the Main Window Once you have loaded network traffic data, you can display information about objects on your network, search for and select objects, and locate objects in the Ma...

Displaying Network Traffic Data 59 ■ Grey — Inactive ■ Green — Transmitting traffic only ■ Yellow — Receiving traffic only ■ Orange — Transmitting and receiving traffic A selected object is colored blue. The shade of grey used to color the inside of a group is only used to make it more visible in th...

Protocols, Applications and Favorites 61 Combining To and From and Between You can use the To and From and Between options in combination to turn off a subset of the traffic connections. Removing and Hiding Traffic To remove all traffic from selected objects in the Map, select Remove All Connections...

62 C HAPTER 7: D ISPLAYING N ETWORK T RAFFIC IN THE M AIN W INDOW If you want to change the protocols in an application, create a new favorite rather than edit a predefined application grouping. The concept of having applications and favorites (collections of related protocols) also applies also to ...

Protocols, Applications and Favorites 63 You might then create a favorite called Server , containing both user-defined protocols. You could display this favorite in the Map as a single color, to show the overall use of both protocols on your network. To set up a user-defined protocol, you need: ■ Th...

64 C HAPTER 7: D ISPLAYING N ETWORK T RAFFIC IN THE M AIN W INDOW ■ You can only create child protocols if the protocol you are extending supports the addition of child protocols. Many current implementations of RMON-2 agents do not support user-defined protocols. If in doubt, check with your agent ...

8 D ISPLAYING T RAFFIC IN G RAPHS This chapter contains the following sections: ■ Overview ■ Using the Graph Panel ■ Using the Launch Graph Dialog Box Overview You can use the graph tools in Traffix ™ Manager to analyze mapped traffic. The graph panel of the main window shows summary information abo...

66 C HAPTER 8: D ISPLAYING T RAFFIC IN G RAPHS Using the Graph Panel The Graph Panel of the main window shows basic information about the network activity of selected items in the Map as a number of graphs. Figure 8 Graph Panel The following graphs of objects selected in the Map are displayed in the...

Using the Launch Graph Dialog Box 67 Use the Graph Panel Settings dialog box to configure the display of the Graph Panel. Figure 9 Graph Panel Settings dialog box The options for display are: ■ Units — The unit of measurement used when calculating the charts: ■ Media Types — Only active if bits per ...

68 C HAPTER 8: D ISPLAYING T RAFFIC IN G RAPHS Figure 10 Launch Graph dialog box The settings used to create the launched graph are those used in the Map at the time you launch the dialog box. If the data is filtered in some way, for example by protocol, that filtering is used when producing the gra...

Using the Launch Graph Dialog Box 69 ■ Top Objects — Show the busiest objects. Which objects are considered depends on the level set in the Graph Settings dialog box. ■ Top Connections — Shows the busiest connections. Which connections are considered depends on the Level and Unit Total set in the Gr...

72 C HAPTER 9: U SING E VENT R ULES The event rules in Traffix Manager fall into two broad categories: ■ Security — An event is generated when some aspect of network security may have been compromised. ■ Traffic — An event is generated when a significant change in traffic patterns is detected. The v...

Examples of Event Rules 73 Examples of Event Rules There are a total of eight types of event rule, the possible uses of which are discussed below. Security Event Rules These types of event rule help you to protect your network from unauthorized access or improper use. Detect Unauthorized Machine Acc...

74 C HAPTER 9: U SING E VENT R ULES Traffic Event Rules These types of event rule help you to detect significant changes in the behavior of a machine or connection. Such changes are often causes or indicators of problems on the network. They may also indicate that some part of the network is overloa...

Configuring Event Rules 75 By applying the protocol filter to an event rule of this type, you can use it to monitor the usage of specific network services on the devices. For example, you can use this event rule to: ■ Monitor the activity of your e-mail servers. ■ Monitor the activity of your router...

76 C HAPTER 9: U SING E VENT R ULES Figure 11 Event Rules dialog box Traffix Manager provides wizards to help you add and edit event rules. Refining Event Rules When you add or edit an event rule, you can modify it to monitor the traffic on your network and your network security, according to your o...

Using Event Rules 77 Specifying the Time Filter With certain types of event rule, you can specify the times at which rules apply. For example, you could choose to restrict unauthorized traffic at all times, or only during certain periods. Specifying Sensitivity For most event rule types, you can spe...

78 C HAPTER 9: U SING E VENT R ULES Maintaining Network Security You can configure Detect Network Sweep Attack and Detect New Devices event rules to generate security events. There are event rules of both types already preconfigured. However, your firewall may be a more appropriate source of informa...

Using Event Rules 79 The Map can provide you with immediate information about which devices have been using particular servers. Detecting Unauthorized Servers You can use the Detect Network Sweep Attack rule to spot users creating unauthorized servers on the network. For example, you can detect unau...

80 C HAPTER 9: U SING E VENT R ULES Implementing Business Policies Some organizations and network administrators have specific policies about how the network can be used, in general or at different times of day. Detect Network Misuse and Detect Unauthorized Machine Access event rules are powerful to...

10 V IEWING E VENTS This chapter describes use of the Event List. It contains the following sections: ■ Overview ■ Viewing Events ■ Viewing and Managing Selected Events ■ Forwarding Events as SNMP Traps Overview Traffix ™ Manager enables you to create event rules about the traffic on your network an...

82 C HAPTER 10: V IEWING E VENTS Viewing Events You use the Event List to display information about events. Figure 12 Event List The Event List provides the following information about each event: ■ Acknowledged — whether the event has been acknowledged. By default only unacknowledged events are dis...

Viewing Events 83 ■ The severity of the event. ■ The rule that generated the event. ■ A detailed explanation of the reason for the event. ■ The activity of the device before and after the change that caused the event. You can sort, filter, and summarize the display of events. These last two operatio...

84 C HAPTER 10: V IEWING E VENTS ■ By event rule. ■ By device / group — You can select a grouping and a group or device. When launched for a particular group or device from the Map, the Event List shows all events in the event log which relate to the selected device or group. Only events generated b...

Viewing and Managing Selected Events 85 Viewing and Managing Selected Events By selecting an event in the Event List, you can carry out the following actions. These actions do not apply to events generated by the Collector or the Reporter. ■ Show detailed information about the event. ■ Acknowledge t...

86 C HAPTER 10: V IEWING E VENTS Forwarding Events as SNMP Traps By selecting an event in the Event Generation dialog box, you can choose to forward the event as an SNMP trap to your own Open Management Platform (for example, HP OpenView or SunNet Manager). The Event Generation dialog box allows you...

Forwarding Events as SNMP Traps 87 2 The MIB files that define events are supplied by a number of enterprises. Select 3Com in the Enterprises field of the Event Configuration dialog box. The system object ID corresponds to the value supplied with the SNMP Trap. 3 The list in the bottom half of the E...

11 O VERVIEW OF R EPORTING This chapter contains the following sections: ■ Overview ■ Managing Reports ■ Strategy for Reporting ■ Effects of Grouping on Reports Overview You use the reporting tools in Traffix ™ Manager to produce professional, multi-page reports from collected data about the traffic...

90 C HAPTER 11: O VERVIEW OF R EPORTING ■ Use top N reports to determine and report on the most active objects on your network. Here, N is a number between 1 and 50 that you can choose for each report. The different types of report are detailed in Chapter 12 . Report Instances You can set up reports...

Overview 91 Weekly Reports These reports use all data collected on the day specified and the following 6 days. The report is generated in the early hours of the day after the last day covered by the report. For example, if you select from Friday through to the following Thursday ( Figure 15 ), data ...

92 C HAPTER 11: O VERVIEW OF R EPORTING Managing Reports You use the Report Manager to add, schedule, edit and delete reports. Figure 17 Report Manager The Report Manager has three main areas: ■ Reports — Displays a tree of report types, instances, raw data, and output. You can add, edit and delete ...

Managing Reports 93 The reporting features available depend on the client access level. A read-only user can browse existing reports, view report details, and view reports in the output queue. An administrator can also add, edit and delete reports, change report scheduling and output options, and ru...

94 C HAPTER 11: O VERVIEW OF R EPORTING You can choose to delete raw data to reclaim disk space if required. See “Setting Global Report Options” on page 96 for more information about deleting raw report data. ■ Report output — If you have scheduled the output of a report instance as HTML, the genera...

Managing Reports 95 ■ Period — The time range covered by the selected raw data or output. ■ Keep Report — The date the report is to be deleted, or Keep Forever , if the report is to be kept indefinitely. ■ Status — Whether raw data or output was generated successfully. To display the generation hist...

96 C HAPTER 11: O VERVIEW OF R EPORTING Monitoring Report Generation and Output Use the Output Queue to view output requests that are due to be run, that are complete, or have failed. (Report output could fail if, for example, a file cannot be written to, or a printer is off line. See “Troubleshooti...

Strategy for Reporting 97 Strategy for Reporting This section contains a strategy to help new users begin reporting with Traffix Manager. Getting Started One of the most beneficial features of the Report Manager is that you can use it to obtain a picture of your network’s usual behavior. The quickes...

98 C HAPTER 11: O VERVIEW OF R EPORTING groups, rather than for your entire network. See “Creating and Assigning Attributes” on page 44 for more information. Generate a top N Summary Report to Determine Objects for an Activity Report You can run top N reports in two modes: ■ Summary mode just identi...

12 R EPORT T YPES This chapter describes in detail each type of report in Traffix ™ Manager. Report Templates For each kind of object — connections, devices, groups of devices, and segment — there are two types of report template, activity and top N. Activity Reports Each activity report consists of...

100 C HAPTER 12: R EPORT T YPES ■ The last section contains information about the report itself such as its title, whether it was scheduled or run ad hoc , and when it was created. The different types of report are described in turn in the remainder of this chapter. Connection Activity Report This r...

Device Activity Report 101 Device Activity Report This report contains detailed information on each specified device. 2 Report Information Information about the report itself. Table 8 Connection Activity Report Charts (continued) Report Section Chart Title Description Table 9 Device Activity Report ...

102 C HAPTER 12: R EPORT T YPES Group Activity Report This report contains detailed information on each specified group. There are three ways you can report on groups: ■ External — Traffic flowing into or out of the group only ■ Internal — Traffic flowing within the group only ■ Overall — Both exter...

Segment Activity Report 103 Segment Activity Report This report contains detailed information on each specified segment. For the purposes of reporting, it is assumed that each separate segment of your network is monitored by an agent interface. Many sites (particularly in a switched environment) hav...

104 C HAPTER 12: R EPORT T YPES Error History With Baseline A baseline chart showing the actual total number of error packets over the report period as a line. This is overlaid on bands representing normal, borderline and unusual error totals. These baselines are calculated using a statistical analy...

Top N Connections Report 105 Top N Connections Report This report calculates the top N connections by total octets sent and received over the report period. A connection can be one of the following: ■ A single conversation between two devices ■ The total of multiple conversations between a device an...

106 C HAPTER 12: R EPORT T YPES ■ “From US at Country level to UK at City level” tells you which cities in the U.K. communicated most with the U.S. ■ “From US at Device level to UK at Device level” tells you the busiest connections between individual devices in the U.S. and U.K., such as server1 to ...

Top N Devices Report 107 Top N Devices Report This report calculates the top N devices by total octets sent and received, and by the number of “hits” over the report period. You can limit the report to consider only devices within a specified group. For example: ■ Select the Traffix root group and t...

Top N Groups Report 109 Top N Groups Report This report calculates the top N groups by total octets sent and received over the report period. You can limit the report to consider only groups at a specified level in the grouping scheme within a parent group. Some examples of group reports are: ■ Geog...

110 C HAPTER 12: R EPORT T YPES Top N Segments Report This report calculates the top N segments by utilization, and by percentage of errors. For most networks it is sufficient to allow Traffix Manager to select automatically the top N segments by selecting All Segments for the top N segments report....

IV A PPENDICES AND I NDEX Appendix A Troubleshooting Traffix Manager Appendix B Database Management Using Traffix Control Panel Appendix C Aggregating Devices Appendix D Using the SubnetsDB File Appendix E Automatic Attribute Assignment Appendix F Supported RMON-2 Devices Appendix G Configuring 3Com...

A T ROUBLESHOOTING T RAFFIX M ANAGER This appendix is divided into two sections: ■ Troubleshooting Traffix Manager ■ Troubleshooting Reports For information on reporting problems to 3Com, see Appendix K , “Technical Support” . Troubleshooting Traffix Manager Table 16 contains descriptions of problem...

116 A PPENDIX A: T ROUBLESHOOTING T RAFFIX M ANAGER Troubleshooting Reports See Chapter 11 , “Overview of Reporting” for information on the reporting features of Traffix Manager. Diagnosing Reporting Problems Table 17 contains descriptions of problems you might encounter when using the reporting too...

Troubleshooting Reports 117 Table 17 Diagnosing Reporting Problems Problem Cause Solution Raw report fails when running ad hoc or scheduled reports. Database directory is full (raw report data is stored in the database). ■ Increase the disk space available to the database. ■ Delete unused raw report...

122 A PPENDIX B: D ATABASE M ANAGEMENT U SING T RAFFIX C ONTROL P ANEL Figure 18 Traffix Control Panel These applications help you to manage and organize a number of databases, for example, if you want to keep extra databases for backup purposes or to provide snap shots of your network or portions o...

Overview of Database Applications 123 ■ The amount of free disk space remaining on your PC for data collection to the database. ■ The location of HTML reports. From this dialog box, you can launch the following operations: ■ Create a new database to write data from the network to. Unless you want to...

124 A PPENDIX B: D ATABASE M ANAGEMENT U SING T RAFFIX C ONTROL P ANEL ■ The amount of hourly and daily data which has already been collected. In this dialog box, you can specify the maximum amount of data that you want the Traffix Manager databases to hold altogether. You can carry out the followin...

Overview of Database Applications 125 3Com recommends that you back up your database regularly, the frequency depending on how important your trend data is to the way you monitor your network. If you want to view and report on your weekly data, you should back up your database once a week. If viewin...

126 A PPENDIX B: D ATABASE M ANAGEMENT U SING T RAFFIX C ONTROL P ANEL This dialog box also allows you to select whether Traffix Manager starts automatically every time you log on to your machine. Default DNS Domain Allows you to set a default DNS domain, if you wish to change the previously configu...

Upgrading Traffix Manager 2.0 127 Deinstalling Traffix Manager 2.0 To deinstall Traffix Manager 2.0 for NT: 1 Close Traffix Manager and all related processes. To check which processes are running, right-click the Windows NT Taskbar and select Task Manager . The Applications and Processes tabs contai...

C A GGREGATING D EVICES This appendix describes: ■ Overview ■ Default Aggregation Overview Aggregation reduces the amount of memory and disk resources required by Traffix ™ Manager by collating the data collected for many devices into a single device. For example, in sites where there is a lot of In...

130 A PPENDIX C: A GGREGATING D EVICES Specifying an Aggregation Policy To aggregate devices on a particular network, it is necessary for the aggregator to be configured for that network. This is done by specifying an aggregation policy. Once an aggregation policy has been configured, it only affect...

Default Aggregation 131 Selecting the Default Aggregation Action The default aggregation action is the method of aggregation applied to network devices which have a DNS name, but which are not contained within one of the local DNS domains. There are three default aggregation actions, from which you ...

132 A PPENDIX C: A GGREGATING D EVICES If layer 2 above the name is selected, the device office.acme.com is aggregated into the device representing .com . If a network device does not have the selected layer above the name, then the device is aggregated into a device representing the highest DNS lay...

D U SING THE S UBNETS DB F ILE Using the SubnetsDB File This facility allows you to group the devices on your network by subnet. Click Subnets Editor in the Traffix ™ Control Panel to edit the subnet definition file, which contains information about subnet groupings. This file can be edited and reap...

134 A PPENDIX D: U SING THE S UBNETS DB F ILE Subnet masks must comply with the primary internet network class types by covering at a minimum the part of the address that represents the network bits. In Table 18 , * is any number between 0 and 255. Table 18 Subnet Masks If a subnet mask spans more t...

Using the SubnetsDB File 135 4 If you already have devices showing in the Map, reload the subnets attributes using the Reload Attributes dialog box, which you access from the Edit menu in the main window. 5 Create a subnets grouping. See “Predefined Groupings” on page 43 for information on how to cr...

136 A PPENDIX D: U SING THE S UBNETS DB F ILE For example, if the SubnetsDB file was to contain the following entries with the same subnet address: Any device matching both of these subnets would be placed in Group 2, as this has 16 set bits in its subnet mask, whereas Group 1 has only 8 set bits. ■...

138 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT By editing the user-defined attributes configuration file, you select which programs are used to determine attributes for objects. You can use the standard programs supplied, or you can create your own custom programs. There are two standard program...

Contents of the User-defined Attributes Configuration File 139 File Format Lines beginning with # are comments and are ignored. All other lines take the form: <Name> <label> <filename> <arguments> <flag> ■ <label> is used in the collector event logs to refer your ...

140 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT Performing Attribute Assignment Attribute assignment is carried out on any newly discovered devices. In addition, you can force a refresh at any time by using the Reload Attributes dialog box. Refer to the online help for the Reload Attributes dialo...

Using the fileattrs Program 141 Configuration File Example 2 To assign user and operating system information to devices based upon their address: *KEY:2 *ATT:NL Type, NL Address, User, O/S IP, 104.240.20.10, Joe Bloggs, Solaris 2.5 IP, 104.240.20.8, Joe Bloggs, Windows 95 IP, 104.240.20.13, John Smi...

142 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT The KEY attribute(s) for that device can be any of the attributes which are assigned automatically by Traffix Manager, for example, NL Address and NL Type. See “Predefined Attributes” on page 40 for a list of attributes which are automatically assig...

Using the dblookup Program 143 network-type lookup tables: for example, a database containing only IP_1 and other_2 lookup-tables is valid. For specific information about Access or Excel lookup-tables, see below. Default Values Devices may be assigned default values. If no full match was found for t...

144 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT Excel Worksheet The lookup-tables are stored in Excel named-ranges. Lookup named-ranges can be stored on separate worksheets or in the same worksheet. To create a named-range, simply select the cells containing your data, select Insert/Name/Define f...

Writing your own program 145 Then, when a device is discovered, dblookup does the following: 1 dblookup builds a SQL string with the device’s key attributes values and runs a query against the database to find a match. 2 If no match is found, it waits for the next device. 3 Otherwise it takes the be...

146 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT (there is one version in Visual Basic and one in C): Figure 19 Simple attribute lookup process in C while ( GetNextLookup() ) { if ( strcmp( GetAttribute( "NL Type" ), "IP" ) == 0 ) SetAttribute( "New Device", "TRUE" ...

Writing your own program 147 an attribute New Device to the value TRUE. NL Type is a built-in attribute which is always set to the network type of a device. This means that every IP device is assigned the attribute New Device with a value of TRUE. ■ Because of the while loop in the program, the prog...

148 A PPENDIX E: A UTOMATIC A TTRIBUTE A SSIGNMENT The C examples are located in C:\Transcend Traffix Manager\TraffixServer\examples\c and the Visual Basic examples are in C:\Transcend Traffix Manager\TraffixServer\examples\vb . You should copy one of these samples to your own directory before modif...

Writing your own program 149 Other points to note about user-defined attribute lookup programs: ■ If your program exits prematurely, for example, it crashes, then the Traffix Service stops. Therefore you must ensure that your program is reliable. ■ Your program must startup within 30 seconds. This m...

F S UPPORTED RMON-2 D EVICES 3Com Agents The current list of 3Com agents is available from the 3Com web site: http://www.3com.com/network_management/probe_interop Using Firmware version 4.17, the agents support all RMON-1 and RMON-2 groups. Version 4.10 or later is needed on the single port and dual...

G C ONFIGURING 3C OM S TANDALONE RMON-2 A GENTS This appendix contains the following sections: ■ Downloading Firmware to 3Com Standalone Agents ■ Setting the Operational Mode on 3Com Standalone RMON-2 Agents Downloading Firmware to 3Com Standalone Agents You should always run the latest version of m...

154 A PPENDIX G: C ONFIGURING 3C OM S TANDALONE RMON-2 A GENTS CAUTION: Downloading firmware to an agent causes the agent to cold restart. Refer to the Firmware Upgrade documentation or your agent documentation for a description of the data lost when an agent is cold restarted. The latest version of...

Setting the Operational Mode on 3Com Standalone RMON-2 Agents 155 ■ Traffix Mode Sets appropriate table sizes on the device for use with Traffix Manager. ■ Off Disables RMON-2. With RMON-2 disabled you can download SmartAgent ® software to the device. If you disable RMON-2 on an agent which supports...

H DHCP This appendix contains the following sections: ■ How Traffix Manager Monitors DHCP Devices ■ What Effect Do DHCP Devices Have On The Map? How Traffix Manager Monitors DHCP Devices Traffix ™ Manager normally uses the Network Layer Address (for example, IP address, IPX address) as the unique wa...

158 C HAPTER H: DHCP (with the old MAC address) will also remain on the Map. There will therefore be two devices on the Map with the same IP address, although with different MAC addresses. Any conversation data retrieved for this IP address is subsequently assigned to the new device. This continues ...

J RMON AND SNMP T ABLES R ETRIEVAL This appendix lists the SNMP tables retrieved by Traffix ™ Manager. Refer to the following URLs for descriptions of RMON tables: ■ RMON-1 Request for Comment: http://www.it.kth.se/docs/rfc/rfcs/rfc1757.txt ■ RMON-2 Request for Comment: http://www.it.kth.se/docs/rfc...

162 A PPENDIX J: RMON AND SNMP T ABLES R ETRIEVAL RMON-2 protoDist no For protocol distribution (reports only) RMON-2 addressMap no Network Layer to MAC address mapping RMON-2 alMatrixTopN / alMatrix / nlMatrixTopN / nlMatrix At least one must be supported for RMON-2 data RMON-2 conversation traffic...

K T ECHNICAL S UPPORT 3Com ® provides easy access to technical support information through a variety of services. This appendix describes these services. Information contained in this appendix is correct at time of publication. For the most recent information, 3Com recommends that you access the 3Co...

164 A PPENDIX K: T ECHNICAL S UPPORT 3Com FTP Site Download drivers, patches, software, and MIBs across the Internet from the 3Com public FTP site. This service is available 24 hours a day, 7 days a week. To connect to the 3Com FTP site, enter the following information into your FTP client: ■ Hostna...

Support from Your Network Supplier 165 Access by Digital Modem ISDN users can dial in to the 3Com BBS using a digital modem for fast access up to 64 Kbps. To access the 3Com BBS using ISDN, call the following number: 1 847 262 6000 3Com Facts Automated Fax Service The 3Com Facts automated fax servic...

166 A PPENDIX K: T ECHNICAL S UPPORT When you contact 3Com for assistance, have the following information ready: ■ Product model name, part number, and serial number ■ A list of system hardware and software, including revision levels ■ Diagnostic error messages ■ Details about recent configuration c...

Returning Products for Repair 167 Returning Products for Repair Before you send a product directly to 3Com for repair, you must first obtain an authorization number. Products sent to 3Com without authorization numbers will be returned to the sender unopened, at the sender’s expense. To obtain an aut...

G LOSSARY agent A standalone or embedded source of RMON-1 or RMON-2 data. aggregation The process of adding the data from multiple devices in the same domain, and representing those devices as a simple “aggregated” device. Used to limit database growth. application As used in Traffix ™ Manager, this...

170 G LOSSARY bit Either of the digits 0 or 1 when used in the binary numeration system. Eight bits equals a single byte. broadcast All good frames destined for the broadcast address, in other words sent out to all stations on the network. Some broadcasts are limited to the local network, and some b...

G LOSSARY 171 of the destination IP address, the station sends the message to the destination station. Due to the static nature of DNS, it can only be used when network stations have static IP addresses obtained through manual configuration, BOOTP or DHCP in static mode. domain Part of the naming hi...

172 G LOSSARY IP (network) address Internet Protocol address. A unique identifier for a device attached to a network using TCP/IP. The address is written as four octets separated with full-stops (periods), and is made up of a network part, identifying which network the device resides on, and a host ...

G LOSSARY 173 OSI Open Systems Interconnection, a body of standards set by the International Standards Organization to define the activities that must occur when computers communicate. The OSI Reference Model is a 7-layer framework within which communications protocols and standards have been define...

174 G LOSSARY separated by periods. Devices and routers use the mask to identify the subnet on which a device resides. switch A device which filters, forwards and floods packets based on the packet’s destination address. The switch learns the addresses associated with each switch port and builds tab...

I NDEX Numbers 3Com Bulletin Board Service (3Com BBS) 1643Com Knowledgebase Web Services 1633Com URL 1633ComFacts 165 A Access tables dblookup program 143 acknowledging events 85activity reports 89, 99ad hoc reports 90, 94Add Agents dialog box 53adding agents 53connections between objects 60connecti...

3Com Corporation L IMITED W ARRANTY Transcend ® Traffix ™ Manager 3.0 for Windows NT ® S OFTWARE 3Com warrants that each software program licensed from it will perform in substantial conformance to its program specifications, for a period of ninety (90) days from the date of purchase from 3Com or it...