How can I check for high network utilization on my switched network?

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Network Monitoring University tackles large-scale 802.11n wireless network management Meru reinvents wireless LAN troubleshooting and management Green enterprise: Three networking investments that make a difference Network device management overload: Engineers managing too many boxes What preventative maintenance procedures for network devices exist? WLAN QoS and SLA monitoring with 7/24 Wireless Quality Assurance costs How important are network infrastructure maps for engineers or admins? Understand Windows tracert output to troubleshoot network connectivity Network management and monitoring market remains crowded, fragmented When do applications suffer from poor network performance? Network Monitoring Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary 10-high-day busy period  (SearchNetworking.com) ACK  (SearchNetworking.com) baseboard management controller  (SearchNetworking.com) call failure rate  (SearchNetworking.com) jam  (SearchNetworking.com) Jini  (SearchNetworking.com) maximum segment size  (SearchNetworking.com) maximum transmission unit  (SearchNetworking.com) netstat  (SearchNetworking.com) network tracking tool  (SearchNetworking.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

There are several means depending on the resources and tools you have on hand. I'll point at the general approaches and give an example of each.

1. Device-based - review the packet traffic registered at the critical ports of a suspected switch or router, either manually or using a network management system. Determine over the periods of concern the coarse-grained flows and compare against the rated capacities. Depending on the technology used, it may also be able to calculate utilization levels based the packet counts at each devices and even project end-to-end utilization on certain paths.

   HP's OpenView would be a high-end example and What's Up Gold would be a cheaper but effective alternative.

2. Passive - "sniff" packets at a point on a critical path such as a firewall, router or switch. Determine over the periods of concern the coarse-grained flows and compare against the rated capacities. If the sniffing technology provides performance analysis capabilities, it may also be able to calculate projected utilization levels based on the behaviors of certain flows that it has detected. Certain passive approach technologies can be very effective at defining utilization relative a particular point on the network.

   Sniffer would be an example of a point traffic measurement technology. It also supports a distributed view that is more end-to-end when multiple sniffer units are implemented.

3. Flooding - using a flooding type technology, determine how heavy a flow (i.e. the available bandwidth) can be applied before saturation (loss) takes place. The available bandwidth, compared with the rated bandwidth, indicates the overall utilization.

   This has several drawbacks though – it typically "clobbers" the existing traffic. And as a consequence it may give measures that are unrealistic. So it can't be used in most active networks. It really is better at stressing networks to identify weaknesses.

   SmartBits or AdTech hardware units represent such a technology. There are also software versions, including the open source iPerf application. A unit is required at both ends of the path to be measured.

4. Active probing - use a performance analysis technology that sends non-intrusive sampling probes across critical paths. It measures the effective utilization as perceived by an application based on how the probes are affected by the traffic that is present. Some systems are two-ended (meaning agents are deployed at both ends) and measures one-way; other approaches assume that you don't have access to the far end and/or you can't support the overhead of instrumenting your entire network with agents and do two-way measures that do not require agents.

   This approach measures anything that is congestion-like. That is, other effects than cross-traffic are included in the measure. To the application, this is the effective utilization level but it