RFC 1147
FYI on a Network Management Tool Catalog: Tools for Monitoring and Debugging TCP/IP Internets and Interconnected Devices
SOFTWARE REQUIRED
VAX/VMS version V5.1+.
AVAILABILITY
For executables only, FTP to the ANONYMOUS account
(password GUEST) on CCC.NMFECC.GOV and GET the follow-
ing files:
[ANONYMOUS.PROGRAMS.ENTM]ENTM.DOC (ASCII text)
[ANONYMOUS.PROGRAMS.ENTM]ENTM.EXE (binary)
[ANONYMOUS.PROGRAMS.ENTM]EN_TYPES.DAT (ASCII text)
[ANONYMOUS.PROGRAMS.ENTM]IP_TYPES.DAT (ASCII text)
NAME
etherfind
KEYWORDS
traffic; ethernet, IP, NFS; eavesdrop; UNIX.
ABSTRACT
Etherfind examines the packets that traverse a network
interface, and outputs a text file describing the
traffic. In the file, a single line of text describes
a single packet: it contains values such as protocol
type, length, source, and destination. Etherfind can
print out all packet traffic on the ethernet, or
traffic for the local host. Further packet filtering
can be done on the basis of protocol: IP, ARP, RARP,
ICMP, UDP, ND, TCP, and filtering can also be done
based on the source, destination addresses as well as
TCP and UDP port numbers.
MECHANISM
In usual operations, and by default, etherfind puts the
interface in promiscuous mode. In 4.3BSD UNIX and
related OSs, it uses a Network Interface Tap (NIT) to
obtain a copy of traffic on an ethernet interface.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
Minimal protocol information is printed. Can only be
run by the super user. The syntax is painful.
HARDWARE REQUIRED
Ethernet.
SOFTWARE REQUIRED
SunOS.
AVAILABILITY
Executable included in Sun OS "Networking Tools and
Programs" software installation option.
NAME
etherhostprobe
KEYWORDS
map, routing; ethernet, IP; ping; UNIX; free.
ABSTRACT
Output list of hosts on an ethernet that respond to IP
ARP. Produces a list in the following format:
08:00:20:01:96:62 128.18.4.114 apptek4
08:00:20:00:02:fe 128.18.4.115 apptek5
08:00:20:00:57:6a 128.18.4.116 apptek6
08:00:20:00:65:34 128.18.4.117 apptek7
08:00:20:06:58:6f 128.18.4.118 apptek8
08:00:20:00:03:4f 128.18.4.119 apptek9
The first column is the ethernet address, the second
the IP address, and the third is the hostname (which is
omitted if the name could not be found via gethost-
byaddr). A starting and ending IP address may be
specified on the command line, which will limit the
search.
MECHANISM
Etherhostprobe sends a UDP packet to the ``echo'' port,
then looks in the kernel's ARP cache for the
corresponding address entry. Explicit response (or
lack of same) to the UDP packet is ignored. The cache
will be checked up to four times at one-quarter-second
intervals. Note that this allows the program to be run
by a user with no special privileges.
CAVEATS
Etherhostprobe will fill the kernel's ARP cache with
possibly useless entries, possibly causing delays to
programs foolishly attempting to accomplish real work.
Etherhostprobe causes -lots- of ARPs to be generated,
possibly fooling network monitoring software (or peo-
ple) into concluding that something is horribly broken.
Etherhostprobe spends up to one second looking for each
possible address. Thus, exhaustively searching a
class-C network will take about four minutes, and
exhaustively searching a class-B network will take
about 18 hours. Exhaustively searching a class-A net-
work will take the better part of a year, so don't even
think about it.
Etherhostprobe will be fooled by gateways that imple-
ment proxy ARP; every possible address on the proxy-
ARPed subnet will be listed with the gateway's ethernet
address.
BUGS
None known.
LIMITATIONS
If a given machine is not running IP ARP at the time
that it is probed, it will be considered nonexistent.
In particular, if a given machine is down at the time
that it is probed . . .
All hosts being probed must be on the same (possibly
bridged) ethernet.
HARDWARE REQUIRED
No restrictions, but see below.
SOFTWARE REQUIRED
Runs on SunOS 3.5, and possibly elsewhere. The major
non-standard portion of code is ``tx_arp.c'', which
reads the kernel's ARP cache.
AVAILABILITY
Copyrighted, but freely distributed. Available via
anonymous FTP from spam.itstd.sri.com (128.18.10.1).
From pub directory, file EHP.1 for etherhostprobe, and
files IPF.1 and IPF.2 for ipForwarding.
NAME
EtherMeter (tm), model LANB/150
KEYWORDS
alarm, map, traffic; ethernet; NMS, proprietary; stan-
dalone.
ABSTRACT
The Network Applications Technology (NAT) EtherMeter
product is a dedicated ethernet traffic monitor that
provides statistics on the ethernet segment to which it
is attached. The EtherMeter reports three major kinds
of statistics. For good packets, it reports the total
number of good packets seen on the segment, the number
of multicast and broadcast packets, and the total
number of bytes in all packets seen. For packets with
errors, it reports the number of CRC errors, short
packets, oversize packets, and alignment errors. It
also reports the distribution of packet by type, and
the number of protocols seen on the segment. A count
of transmit collisions is reported. Peak and current
ethernet utilization rates are also reported, etc.
Alarms can be set for utilization rate, packet rate,
total error count, and delta error.
The EtherMeter reports the statistics to a Network
Management Station (NMS), also available from NAT, via
IP/UDP datagrams, so that the meters can be monitored
through routers. The NMS displays graphical and/or
textual information, and EtherMeter icons turn colors
to indicate status. Alarms can be set, and if the lev-
els are exceeded an audible alarm is generated on the
NMS, and the EtherMeter icon changes from green to yel-
low on the network map.
MECHANISM
The EtherMeter is a self-contained board that can
either be plugged into a PC/AT bus for power or
installed in a small stand-alone enclosure. The board
can be obtained with either a 10BASE5 thick ethernet
transceiver cable connector, or a 10BASE2 thin ethernet
BNC connector.
CAVEATS
The EtherMeter is primarily a passive device whose only
impact on the network will come from the monitoring
packets sent to the NMS. The EtherMeter is assigned an
IP address for communication with the NMS.
BUGS
None known.
LIMITATIONS
Proprietary protocol currently in use. The company has
stated its intention to develop SNMP for the EtherMeter
product in the first half of 1990. Currently the NMS
does not keep log files. This limitation is ack-
nowledged, and plans are underway to add ASCII log file
capability to the NMS.
HARDWARE REQUIRED
An EtherMeter board and a PC/AT bus to plug it into, or
a stand-alone enclosure with power supply (available
from NAT). A Network Management Station and its
software is required as well, to fully interact with
the EtherMeter devices.
SOFTWARE REQUIRED
The EtherMeter software is included in ROM on the dev-
ice. The NMS software is bundled in with the NMS
hardware.
AVAILABILITY
The EtherMeter device, stand-alone enclosure, and Net-
work Management Station, are available commercially
from:
Network Application Technology, Inc.
21040 Homestead Road
Cupertino, California 95014
Phone: (408) 733-4530
Fax: (408) 733-6478
NAME
EtherView(tm)
KEYWORDS
traffic; ethernet, IP, NFS; eavesdrop; UNIX.
ABSTRACT
EtherView is a network monitoring tool which runs on
Sun workstations and allows you to monitor your hetero-
geneous internet network. It monitors all systems on
the ethernet. It has three primary functions:
Load Profile: It allows users to monitor the load on
the ethernet over extended periods of time. The net-
work administrator can use it to characterize load gen-
erated by a node on the network, determine which sys-
tems and applications generate how much of the load and
how that load fluctuates over long periods of time.
NFS Profile: It allows the network administrator to
determine the load on NFS servers, the average response
time NFS servers and the mix of NFS load on each of the
servers. Users can use the data to benchmark different
NFS servers, determine which servers are overloaded,
deduce the number of clients that each server can sup-
port and evaluate the effectiveness of NFS accelera-
tors.
Protocol Analyzer: Users can capture packets based on
source, destination, application, protocol, bit pat-
tern, packet size or a boolean filtering expression.
It provides all standard features such as configurable
buffer size, packet slicing and bit pattern based
triggering criterion. It does automatic disassembly of
NFS, TCP, UDP, IP, ICMP, ARP and RARP packets. Packets
can be examined in any combination of summary, hex or
detail format.
MECHANISM
EtherView uses the Sun's NIT interface to turn the eth-
ernet interface into promiscuous mode to capture pack-
ets. A high level process manages the interface and a
low level process does the actual capturing and filter-
ing. Shared memory is used to communicate between the
two processes.
BUGS
None known.
LIMITATIONS
Because of limitations in Sun's NIT interface, Ether-
View will not capture packets originating from the sys-
tem where it is run.
EtherView requires super-user privileges on the system
where it is run.
HARDWARE REQUIRED
EtherView runs on all models of Sun-3, Sun-4 and Sun-
386i.
SOFTWARE REQUIRED
Sun-3 - SunOS 4.0.3. (SunOS 4.0 with NIT fixes).
Sun-4 - SunOS 4.0.
Sun-386i - SunOS 4.0.
Runs under SunView.
Will run under X Windows in future.
AVAILABILITY
EtherView is copyrighted, commercial product of:
Matrix Computer Systems, Inc.
7 1/2 Harris Road
Nashua, NH 03062
Tel: (603) 888-7790
email: ...uunet!matrix!eview
NAME
getone, getmany, getroute, getarp, getaddr, getif,
getid.
KEYWORDS
manager, routing, status; IP; NMS, SNMP; UNIX.
ABSTRACT
These commands retrieve and format for display values
of one or several MIB variables (RFC1066) using the
SNMP (RFC1098). Getone and getmany retrieve arbitrary
MIB variables; getroute, getarp, getaddr, and getif
retrieve and display tabular information (routing
tables, ARP table, interface configuration, etc.), and
getid retrieves and displays system name, identifica-
tion and boot time.
Getone <target> <mibvariable> retrieves and displays
the value of the designated MIB variable from the
specified target system. The SNMP community name to be
used for the retrieval can also be specified. Getmany
works similarly for groups of MIB variables rather than
individual values. The name of each variable, its
value and its data type is displayed. Getroute returns
information from the ipRoutingTable MIB structure,
displaying the retrieved information in an accessible
format. Getarp behaves similarly for the address
translation table; getaddr for the ipAddressTable; and
getif displays information from the interfaces table,
supplemented with information from the ipAddressTable.
Getid displays the system name, identification, ipFor-
warding state, and the boot time and date. All take a
system name or IP address as an argument and can
specify an SNMP community for the retrieval. One SNMP
query is performed for each row of the table.
MECHANISM
Queries SNMP agent(s).
CAVEATS
None.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
Distributed and supported for Sun 3 systems.
SOFTWARE REQUIRED
Distributed and supported for SunOS 3.5 and 4.x.
AVAILABILITY
Commercial product of:
Wellfleet Communications, Inc.
12 DeAngelo Drive
Bedford, MA 01730-2204
(617) 275-2400
NAME
hammer & anvil
KEYWORDS
benchmark, generator; IP; DOS; free.
ABSTRACT
Hammer and anvil are the benchmarking programs for IP
routers. Using these tools, gateways have been tested
for per-packet delay, router-generated traffic over-
head, maximum sustained throughput, etc.
MECHANISM
Tests are performed on a gateway in an isolated
testbed. Hammer generates packets at controlled rates.
It can set the length and interpacket interval of a
packet stream. Anvil counts packet arrivals.
CAVEATS
Hammer should not be run on a live network.
BUGS
None reported.
LIMITATIONS
Early versions of hammer could not produce inter-packet
intervals shorter than 55 usec.
HARDWARE REQUIRED
Hammer runs on a PC/AT or compatible, and anvil
requires a PC or clone. Both use a Micom Interlan
NI5210 for LAN interface.
SOFTWARE REQUIRED
MS-DOS.
AVAILABILITY
Hammer and anvil are copyrighted, though free. Copies
are available from pub/eutil on husc6.harvard.edu.
NAME
hopcheck
KEYWORDS
routing; IP; ping; DOS; free.
ABSTRACT
Hopcheck is a tool that lists the gateways traversed by
packets sent from the hopcheck-resident PC to a desti-
nation. Hopcheck uses the same mechanism as traceroute
but is for use on IBM PC compatibles that have ethernet
connections. Hopcheck is part of a larger TCP/IP pack-
age that is known as ka9q that is for use with packet
radio. Ka9q can coexist on a PC with other TCP/IP
packages such as FTP Inc's PC/TCP, but must be used
independently of other packages. Ka9q was written by
Phil Karn. Hopcheck was added by Katie Stevens,
dkstevens@ucdavis.edu. Unlike traceroute, which
requires a UNIX kernel mod, hopcheck will run on the
standard, unmodified ka9q release.
MECHANISM
See the description in traceroute.
CAVEATS
See the description in traceroute.
BUGS
None known.
LIMITATIONS
Host table required. Does not work with domain name
server or with IP address as the argument. This is
mainly an inconvenience.
HARDWARE REQUIRED
IBM PC compatible with ethernet network interface card,
though does not work with 3Com 505 board.
SOFTWARE REQUIRED
DOS.
AVAILABILITY
Free. On deposit at the National Center for Atmospher-
ic Research. For access from UNIX, available via
anonymous FTP from windom.ucar.edu, in directory "etc,"
as hopcheck.tar.Z. For access directly from a PC,
fetch nethop.exe and readme.hop; nethop.exe is execut-
able. Also available via anonymous FTP at ucdavis.edu,
in the nethopexe or nethopsrc suite of files in direc-
tory "dist."
NAME
HyperMIB
KEYWORDS
reference; Macintosh; free, sourcelib.
ABSTRACT
HyperMIB is a hypertext presentation of the MIB
(RFC1066). The tree structure of the MIB is presented
graphically, and the user traverses the tree by select-
ing branches of the tree. When the MIB variables are
displayed, selecting them causes a text window to
appear and show the definition of that variable (using
the actual text of the MIB document).
MECHANISM
The Apple Macintosh HyperCard utility is used. The
actual text of the MIB document is read into scrollable
text windows, and a string search is done on the vari-
able selected. A person familiar with HyperCard pro-
gramming could modify the program to suit their needs
(such as to add the definitions for their company's
private space).
CAVEATS
None.
BUGS
None known.
LIMITATIONS
This program only gives the definition of the MIB vari-
ables. It cannot poll a node to find the value of the
variables.
HARDWARE REQUIRED
Apple Macintosh computer with at least 1MByte of RAM.
SOFTWARE REQUIRED
Apple Macintosh operating system and HyperCard.
AVAILABILITY
This software may be copied and given away without
charge. The files are available by anonymous FTP on
CCC.NMFECC.GOV. The files are:
[Anonymous.programs.HyperMIB]Hyper_MIB.help (ASCII text)
[Anonymous.programs.HyperMIB]Hyper.MIB (binary)
[Anonymous.programs.HyperMIB]MIB.tree (binary)
The software is also available for a nominal fee from:
National Energy Software Center
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(312) 972-7250
NAME
Internet Rover
KEYWORDS
status; IP, SMTP; curses, ping, spoof; UNIX; free,
sourcelib.
ABSTRACT
Internet Rover is a prototype network monitor that uses
multiple protocol "modules" to test network functional-
ity. This package consists of two primary pieces of
code: the data collector and the problem display.
There is one data collector that performs a series of
network tests, and maintains a list of problems with
the network. There can be many display processes all
displaying the current list of problems which is useful
in a multi-operator NOC.
The display task uses curses, allowing many terminal
types to display the problem file either locally or
from a remote site. Full source is provided. The data
collector is easily configured and extensible. Contri-
butions such as additional protocol modules, and shell
script extensions are welcome.
MECHANISM
A configuration file contains a list of nodes,
addresses, NodeUp? protocol test (ping in most cases),
and a list of further tests to be performed if the node
is in fact up. Modules are included to test TELNET,
FTP, and SMTP. If the configuration contains a test
that isn't recognized, a generic test is assumed, and a
filename is checked for existence. This way users can
create scripts that create a file if there is a prob-
lem, and the data collector simply checks the existence
of that file to determine if there is problem.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
This tools does not yet have the capability to perform
actions based on the result of the test. Rather, it is
intended for a multi-operator environment, and simply
displays a list of what is wrong with the net.
HARDWARE REQUIRED
This software is known to run on Suns and IBM RTs.
SOFTWARE REQUIRED
Curses, 4.xBSD UNIX socket programming libraries, BSD
ping.
AVAILABILITY
Full source available via anonymous FTP from merit.edu
(35.1.1.42) in the ~ftp/pub/inetrover directory.
Source and executables are public domain and can be
freely distributed for non-commercial use. This pack-
age is unsupported, but bug reports and fixes may be
sent to: wbn@merit.edu.
NAME
LAN Patrol
KEYWORDS
security, traffic; ethernet, star; eavesdrop; DOS.
ABSTRACT
LAN Patrol is a full-featured network analyzer that
provides essential information for effective fault and
performance management. It allows network managers to
easily monitor user activity, find traffic overloads,
plan for growth, test cable, uncover intruders, balance
network services, and so on. LAN Patrol uses state of
the art data collection techniques to monitor all
activity on a network, giving an accurate picture of
how it is performing.
LAN Patrol's reports can be saved as ASCII files to
disk, and imported into spreadsheet or database pro-
grams for further analysis.
MECHANISM
The LAN Patrol interface driver programs a standard
interface card to capture all traffic on a network seg-
ment. The driver operates from the background of a
standard PC, maintaining statistics for each station on
the network. The information can be viewed on the PC's
screen, or as a user-defined report output either to
file or printer.
CAVEATS
None. Normal operation is completely passive, making
LAN Patrol transparent to the network.
BUGS
None known.
LIMITATIONS
LAN Patrol can monitor up to 10,000 packets/sec on an
AT class PC, and is limited to monitoring a maximum of
1024 stations for intervals of up to 30 days.
Because LAN Patrol operates at the physical level, it
will only see traffic for the segment on which it is
installed; it cannot see traffic across bridges.
HARDWARE REQUIRED
Computer: IBM PC/XT/AT, PS/2 Model 30, or compatible.
Requires 512K memory and a hard drive or double-sided
disk drive.
Display: Color or monochrome text. Color display
allows color-coding of traffic information.
Ethernet, StarLAN, LattisNet, or StarLAN 10 network
interface card.
SOFTWARE REQUIRED
PC DOS, MS-DOS version 3.1 or greater.
AVAILABILITY
LAN Patrol many be purchased through network dealers,
or directly from:
Legend Software, Inc.
Phone: (201) 227-8771
FAX: (201) 906-1151
NAME
LanProbe -- the HP 4990S LanProbe Distributed Analysis
System.
KEYWORDS
alarm, manager, map, status, traffic; ethernet; eaves-
drop, NMS; proprietary.
ABSTRACT
The LanProbe distributed monitoring system performs
remote and local monitoring of ethernet LANs in a pro-
tocol and vendor independent manner.
LanProbe discovers each active node on a segment and
displays it on a map with its adapter card vendor name,
ethernet address, and IP address. Additional informa-
tion about the nodes, such as equipment type and physi-
cal location can be entered in to the data base by the
user.
When the NodeLocator option is used, data on the actual
location of nodes is automatically entered and the map
becomes an accurate representation of the physical lay-
out of the segment. Thereafter when a new node is
installed and becomes active, or when a node is moved
or becomes inactive, the change is detected and shown
on the map in real time. The system also provides the
network manager with precise cable fault information
displayed on the map.
Traffic statistics are gathered and displayed and can
be exported in (comma delimited) CSV format for further
analysis. Alerts can be set on user defined thres-
holds.
Trace provides a remote protocol analyzer capability
with decodes for common protocols.
Significant events (like power failure, cable breaks,
new node on network, broadcast IP source address seen,
etc.) are tracked in a log that is uploaded to Pro-
beView periodically.
ProbeView generates reports that can be manipulated by
MSDOS based word processors, spreadsheets, and DBMS.
MECHANISM
The system consists of one or more LanProbe segment
monitors and ProbeView software running under Microsoft
Windows. The LanProbe segment monitor attaches to the
end of an ethernet segment and monitors all traffic.
Attachment can be direct to a thin or thick coax cable,
or via an external transceiver to fiber optic or twist-
ed pair cabling. Network data relating to the segment
is transferred to a workstation running ProbeView via
RS-232, ethernet, or a modem connection.
ProbeView software, which runs on a PC/AT class works-
tation, presents network information in graphical
displays.
The HP4992A NodeLocator option attaches to the opposite
end of the cable from the HP4991A LanProbe segment mon-
itor. It automatically locates the position of nodes
on the ethernet networks using coaxial cabling schemes.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
HP 4991A LanProbe segment monitor
HP 4992A NodeLocator (for optional capabilities)
80386 based PC capable of running MS-Windows
SOFTWARE REQUIRED
HP 4990A ProbeView
MSDOS 3.0 or higher and Microsoft Windows/286 2.1.
AVAILABILITY
A commercial product available from:
Hewlett-Packard Company
P.O. Box 10301,
Palo Alto, CA 94303-0890
NAME
LANWatch
KEYWORDS
alarm, analyzer, traffic; CHAOS, DECnet, DNS, ethernet,
IP, OSI, ring, SMTP, star; eavesdrop; DOS; library,
sourcelib.
ABSTRACT
LANWatch 2.0 is an inexpensive, powerful and flexible
network analyzer that runs under DOS on personal com-
puters and requires no hardware modifications to either
the host or the network. LANWatch is an invaluable
tool for installing, troubleshooting, and monitoring
local area networks, and for developing and debugging
new protocols. Network managers using LANWatch can
inspect network traffic patterns and packet errors to
isolate performance problems and bottlenecks. Protocol
developers can use LANWatch to inspect and verify
proper protocol handling. Since LANWatch is a
software-only package which installs easily in existing
PCs, network technicians and field service engineers
can carry LANWatch in their briefcase for convenient
network analysis at remote sites.
LANWatch has two operating modes: Display and Examine.
In Display Mode, LANWatch traces network traffic by
displaying captured packets in real time. Examine Mode
allows you to scroll back through stored packets to
inspect them in detail. To select a subset of packets
for display, storage or retrieval, there is an exten-
sive set of built-in filters. Using filters, LANWatch
collects only packets of interest, saving the user from
having to sort through all network traffic to isolate
specific packets. The built-in filters include alarm,
trigger, capture, load, save and search. They can be
controlled separately to match on source or destination
address, protocol, or packet contents at the hardware
and transport layers. LANWatch also includes suffi-
cient source code so users can modify the existing
filters and parsers or add new ones.
The LANWatch distribution includes executables and
source for several post-processors: a TCP protocol
analyzer, a node-by-node traffic analyzer and a dump
file listing tool.
MECHANISM
Uses many common PC network interfaces by placing them
in promiscuous mode and capturing traffic.
CAVEATS
Most PC network interfaces will not capture 100% of the
traffic on a fully-loaded network (primarily missing
back-to-back packets).
BUGS
None known.
LIMITATIONS
LANWatch can't analyze what it doesn't see (see
Caveats).
HARDWARE REQUIRED
LANWatch requires a PC or PS/2 with a supported network
interface card.
SOFTWARE REQUIRED
LANWatch runs in DOS. Modification of the supplied
source code or creation of additional filters and
parsers requires Microsoft C 5.1
AVAILABILITY
LANWatch is commercially available from FTP Software,
Incorporated, 26 Princess Street, Wakefield, MA, 01880
(617 246-0900).
NAME
map -- Interactive Network Map
KEYWORDS
manager, map; CHAOS, ethernet, IP, ring, star; NMS,
ping, SNMP, X; UNIX; free, sourcelib.
ABSTRACT
Map draws a map of network connectivity and allows
interactive examination of information about various
components including whether hosts can be reached over
the network.
The program is supplied with complete source and is
written in a modular fashion to make addition of dif-
ferent protocols stacks, displays, or hardcopy devices
relatively easy. This is one of the reasons why the
initial version supports at least two of each. Contri-
butions of additional drivers in any of these areas
will be welcome as well as porting to additional plat-
forms.
MECHANISM
Net components are pinged by use of ICMP echo and,
optionally, CHAOS status requests and SNMP "gets." The
program initializes itself from static data stored in
the file system and therefore does not need to access
the network in order to get running (unless the static
files are network mounted).
CAVEATS
As of publication, the tool is in beta release.
BUGS
Several minor nits, documented in distribution files.
Bug discoveries should be reported by email to Bug-
Map@LCS.MIT.Edu.
LIMITATIONS
See distribution file for an indepth discussion of sys-
tem capabilities and potential.
HARDWARE REQUIRED
An X display is needed for interactive display of the
map, non-graphical interaction is available in non-
display mode. For hardcopy output a PostScript or Tek-
tronix 4692 printer is required.
SOFTWARE REQUIRED
BSD UNIX or related OS. IP/ICMP is required;
CHAOS/STATUS and SNMP can be used but are optional.
X-Windows is required for interactive display of the
map.
AVAILABILITY
As of publication, map is in beta release. To be added
to the email forum that discusses the software, or to
obtain individual files or instructions on getting the
full current release, send a request to:
MAP-Request@LCS.MIT.Edu.
The program is Copyright MIT. It is available via
anonymous FTP with a license making it free to use and
distribute for non-commercial purposes.
NAME
mconnect
KEYWORDS
status; SMTP; spoof; UNIX.
ABSTRACT
Mconnect allows an interactive session with a remote
mailer. Mail delivery problems can be diagnosed by
connecting to the remote mailer and issuing SMTP com-
mands directly.
MECHANISM
Opens a TCP connection to remote SMTP on port 25. Pro-
vides local line buffering and editing, which is the
distinction between mconnect and a TELNET to port 25.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
Mconnect is not a large improvement over using a TELNET
connection to port 25.
HARDWARE REQUIRED
No restrictions.
SOFTWARE REQUIRED
BSD UNIX or related OS.
AVAILABILITY
Available with 4.xBSD UNIX and related operating sys-
tems.
NAME
Netlabs CMOT Agent
KEYWORDS
manager, status; IP, OSI; NMS.
ABSTRACT
Netlabs' CMOT code debuted in Interop 89. The CMOT
code comes with an Extensible MIB, which allows users
to add new MIB variables. The code currently supports
all the MIB variables in RFC 1095 via the data types in
RFC 1065, as well as the emerging MIB-II, which is
currently in experimental stage. The CMOT has been
benchmarked at 100 Management Operations per Second
(MOPS) for a 1-MIPS machine.
MECHANISM
The Netlabs CMOT agent supports the control and moni-
toring of network resources by use of CMOT message
exchanges.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
Portable to most hardware.
SOFTWARE REQUIRED
Portable to most operating systems.
AVAILABILITY
Commercially available from:
Netlabs Inc
11693 Chenault Street Ste 348
Los Angeles CA 90049
(213) 476-4070
lam@netlabs.com (Anne Lam)
NAME
Netlabs SNMP Agent.
KEYWORDS
manager, status; IP; NMS, SNMP.
ABSTRACT
Netlabs' SNMP code debuted in Interop 89, where it
showed interoperation of the code with several imple-
mentations on the show floor. The SNMP code comes with
an Extensible MIB, which allows users to add new MIB
variables. The code currently supports all the MIB
variables in RFC 1066 via the data types in RFC 1065,
as well as the emerging MIB-II, which is currently in
experimental stage. The SNMP has been benchmarked at
200 Management Operations per Second (MOPS) for a 1-
MIPS machine.
MECHANISM
The Netlabs SNMP agent supports the control and moni-
toring of network resources by use of SNMP message
exchanges.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
Portable to most hardware.
SOFTWARE REQUIRED
Portable to most operating systems.
AVAILABILITY
Commercially available from:
Netlabs Inc
11693 Chenault Street Ste 348
Los Angeles CA 90049
(213) 476-4070
lam@netlabs.com (Anne Lam)
NAME
netmon
KEYWORDS
status; DNS, IP; ping; DOS; free.
ABSTRACT
Netmon is a DOS-based program that pings hosts on a
monitored list at user-specified intervals. In addi-
tion, a user may optionally ping hosts not on the list.
Netmon also performs domain lookups. Furthermore, a
user may build and send a domain query to any desired
DNS server.
MECHANISM
The tool works by using the echo service feature of
ICMP. It reports if it receives an incorrect response
or no response.
CAVEATS
Depending on the frequency of pinging and the number of
hosts pinged, netmon could create a high volume of
traffic.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
A PC, and a Western Digital WD8003 interface card (or
any other card for which there is a packet driver for
FTP Software Inc.'s PC/TCP kernel). Both monochrome
and color displays are supported, though color is
recommended.
SOFTWARE REQUIRED
DOS operating system, and the PC/TCP Kernel by FTP
Software, Inc.
AVAILABILITY
The BYU modified version is available for anonymous FTP
from Dcsprod.byu.edu, in directory "programs." It can
be freely distributed for non-commercial use.
NAME
NETMON and iptrace
KEYWORDS
traffic; IP; eavesdrop; UNIX; free.
ABSTRACT
NETMON is a facility to enable communication of net-
working events from the BSD UNIX operating system to a
user-level network monitoring or management program.
Iptrace is a program interfacing to NETMON which logs
TCP-IP traffic for performance measurement and gateway
monitoring. It is easy to build other NETMON-based
tools using iptrace as a model.
NETMON resides in the 4.3BSD UNIX kernel. It is
independent of hardware-specific code in UNIX. It is
transparent to protocol and network type, having no
internal assumptions about the network protocols being
recorded. It is installed in BSD-like kernels by
adding a standard function call (probe) to a few points
in the input and output routines of the protocols to be
logged.
NETMON is analogous to Sun Microsystems' NIT, but the
interface tap function is extended by recording more
context information. Aside from the timestamp, the
choice of information recorded is up to the installer
of the probes. The NETMON probes added to the BSD IP
code supplied with the distribution include as context:
input and output queue lengths, identification of the
network interface, and event codes labeling packet dis-
cards. (The NETMON distribution is geared towards
measuring the performance of BSD networking protocols
in an IP gateway).
NETMON is designed so that it can reside within the
monitored system with minimal interference to the net-
work processing. The estimated and measured overhead
is around five percent of packet processing.
The user-level tool "iptrace" is provided with NETMON.
This program logs IP traffic, either at IP-level only,
or as it passes through the network interface drivers
as well. As a separate function, iptrace produces a
host traffic matrix output. Its third type of output
is abbreviated sampling, in which only a pre-set number
of packets from each new host pair is logged. The
three output types are configured dynamically, in any
combination.
OSITRACE, another logging tool with a NETMON interface,
is available separately (and documented in a separate
entry in this catalog).
MECHANISM
Access to the information logged by NETMON is through a
UNIX special file, /dev/netmon. User reads are blocked
until the buffer reaches a configurable level of full-
ness.
Several other parameters of NETMON can be tuned at com-
pile time. A diagnostic program, netmonstat, is
included in the distribution.
CAVEATS
None.
BUGS
Bug reports and questions should be addressed to:
ie-tools@gateway.mitre.org
Requests to join this mailing list:
ie-tools-request@gateway.mitre.org
Questions and suggestions can also be directed to:
Allison Mankin (703)883-7907
mankin@gateway.mitre.org
LIMITATIONS
A NETMON interface for tcpdump and other UNIX protocol
analyzers is not included, but it is simple to write.
NETMON probes for a promiscuous ethernet interface are
similarly not included.
HARDWARE REQUIRED
No restrictions.
SOFTWARE REQUIRED
BSD UNIX-like network protocols or the ability to
install the BSD publicly available network protocols in
the system to be monitored.
AVAILABILITY
The NETMON distribution is available by anonymous FTP
in pub/netmon.tar or pub/netmon.tar.Z from aelred-
3.ie.org. A short user's and installation guide,
NETMON.doc, is available in the same location. The
NETMON distribution is provided "as is" and requires
retention of a copyright text in code derived from it.
It is copyrighted by the MITRE-Washington Networking
Center.
NAME
NETMON -- an SNMP-based network management tool from
SNMP Research.
KEYWORDS
alarm, control, manager, map, routing; DECnet, ether-
net, IP, OSI, ring, star; NMS, SNMP; DOS; sourcelib.
ABSTRACT
The NETMON application implements a network management
station based on a low-cost DOS-based platform. It can
be successfully used with many types of networks,
including both wide area networks and those based on
various LAN media. NETMON has been used with multipro-
tocol devices including those which support TCP/IP,
DECnet, and OSI protocols. The fault management tool
displays the map of the network configuration with
current node and link state indicated in one of several
colors. Alarms may be enabled to alert the operator of
events occurring in the network. Events are logged to
disk. The NETMON application comes complete with
source code including a powerful set of portable
libraries for generating and parsing SNMP messages.
Output data from NETMON may be transferred via flat
files for additional report generation by a variety of
statistical packages.
MECHANISM
The NETMON application is based on the Simple Network
Management Protocol (SNMP). Polling is performed via
the powerful SNMP get-next operator and the SNMP get
operator. Trap directed polling is used to regulate
the focus and intensity of the polling.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
The monitored and managed nodes must implement the SNMP
over UDP per RFC 1098 or must be reachable via a proxy
agent.
HARDWARE REQUIRED
The minimum system is a IBM Personal Computer (4.77
MHz) with DOS 3.0 or later, an Enhanced Graphics
Adapter, Enhanced Graphics Monitor, a single 360 Kbyte
floppy drive, and an ethernet adapter. However, most
users will find a hard disk to be helpful for storing
network history and will be less impatient with a fas-
ter CPU.
SOFTWARE REQUIRED
DOS 3.0 or later and TCP/IP software from one of
several sources.
AVAILABILITY
This is a commercial product available under license
from:
SNMP Research
P.O. Box 8593
Knoxville, TN 37996-4800
(615) 573-1434 (Voice)
(615) 573-9197 (FAX)
Attn: Dr. Jeff Case
NAME
netstat
KEYWORDS
routing; IP; UNIX, VMS; free.
ABSTRACT
Netstat is a program that accesses network related data
structures within the kernel, then provides an ASCII
format at the terminal. Netstat can provide reports on
the routing table, TCP connections, TCP and UDP
"listens", and protocol memory management.
MECHANISM
Netstat accesses operating system memory to read the
kernel routing tables.
CAVEATS
Kernel data structures can change while netstat is run-
ning.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
No restrictions.
SOFTWARE REQUIRED
BSD UNIX or related OS, or VMS.
AVAILABILITY
Available via anonymous FTP from uunet.uu.net, in
directory bsd-sources/src/ucb. Available with 4.xBSD
UNIX and related operating systems. For VMS, available
as part of TGV MultiNet IP software package, as well as
Wollongong's WIN/TCP.
NAME
netwatch
KEYWORDS
traffic; ethernet, IP, ring; eavesdrop; DOS; free.
ABSTRACT
PC/netwatch listens to an attached local broadcast net-
work and displays one line of information for every
packet that goes by. This information consists of the
"to" and "from" local network addresses, the packet
length, the value of the protocol type field, and 8
selected contiguous bytes of the packet contents.
While netwatch is running it will respond to commands
to display collected information, change its operating
mode, or to filter for specific types of packets.
MECHANISM
Puts controller in promiscuous mode.
CAVEATS
None.
BUGS
None known.
LIMITATIONS
The monitor can handle a burst rate of about 200 pack-
ets per second. Packets arriving faster than that are
missed (but counted in the statistics of the network
driver). The display rate is about 25 packets per
second and there is a buffer that can hold 512
undisplayed packets. The monitor discards overflow
packets.
HARDWARE REQUIRED
IBM PC compatible with CGA and network interface (3com
3C501, Interlan NI5010, or proNet p1300).
SOFTWARE REQUIRED
DOS 2.0 or higher, MicroSoft C (to generate custom exe-
cutables)
AVAILABILITY
Available as a utility program in the pcip distribution
from host husc6.harvard.edu, in directory pub/pcip.
Available in a standalone package via anonymous FTP
from windom.ucar.edu, in file pc/network/netwatch.arc;
a binary "dearc" program is also available from
windom.ucar.edu.
NAME
Network Integrator I
KEYWORDS
map, traffic; ethernet; UNIX.
ABSTRACT
This tool monitors traffic on network segments. All
information is dumped to either a log file or, for
real-time viewing, to a command tool window. Data is
time-stamped according to date and time. Logging can
continue for up to 24 hours.
The tool is flexible in data collection and presenta-
tion. Traffic filters can be specified according to
header values of numerous protocols, including those
used by Apple, DEC, Sun, HP, and Apollo. Bandwidth
utilization can be monitored, as well as actual load
and peak throughput. Additionally, the Network
Integrator can analyze a network's topology, and record
the location of all operational nodes on a network.
Data can be displayed in six separate formats of bar
graphs. In addition, there are several routines for
producing statistical summaries of the data collected.
MECHANISM
The tools work through RPC and XDR calls.
CAVEATS
Although the tool adds only little traffic to a net-
work, generation of statistics from captured files
requires a significant portion of a workstation's CPU.
BUGS
None known.
LIMITATIONS
Must be root to run monitor. There does not seem to be
a limit to the number of nodes, since it monitors by
segments. The only major limitation is the amount of
disk space that a user can commit to the log files.
The size of the log files, however, can be controlled
through the tool's parameters.
HARDWARE REQUIRED
Sun3 or Sun4.
SOFTWARE REQUIRED
4.0BSD UNIX or greater, or related OS.
AVAILABILITY
Copyrighted, commercially available from
Network Integrators,
(408) 927-0412.
NAME
net_monitor
KEYWORDS
routing, status; DECnet, IP; curses, ping; UNIX, VMS;
free, sourcelib.
ABSTRACT
Net_monitor uses ICMP echo (and DECnet reachability
information on VAX/VMS) to monitor a network. The mon-
itoring is very simplistic, but has proved useful. It
periodically tests whether hosts are reachable and
reports the results in a full-screen display. It
groups hosts together in common sets. If all hosts in
a set become unreachable, it makes a lot of racket with
bells, since it assumes that this means that some com-
mon piece of hardware that supports that set has
failed. The periodicity of the tests, hosts to test,
and groupings of hosts are controlled with a single
configuration file.
The idea for this program came from the PC/IP monitor
facility, but is an entirely different program with
different functionality.
MECHANISM
Reachability is tested using ICMP echo facilities for
TCP/IP hosts (and DECnet reachability information on
VAX/VMS). A DECnet node is considered reachable if it
appears in the list of hosts in a "show network" com-
mand issued on a routing node.
CAVEATS
This facility has been found to be most useful when run
in a window on a workstation rather than on a terminal
connected to a host. It could be useful if ported to a
PC (looks easy using FTP Software's programming
libraries), but this has not been done. Curses is very
slow and cpu intensive on VMS, but the tool has been
run in a window on a VAXstation 2000. Just don't try
to run it on a terminal connected to a 11/750.
BUGS
None known.
LIMITATIONS
This tool is not meant to be a replacement for a more
comprehensive network management facility such as is
provided with SNMP.
HARDWARE REQUIRED
A host with a network connection.
SOFTWARE REQUIRED
Curses, 4.xBSD UNIX socket programming libraries (lim-
ited set) and some flavor of TCP/IP that supports ICMP
echo request (ping). It has been run on VAX/VMS run-
ning WIN/TCP and several flavors of 4BSD UNIX (includ-
ing SunOS 3.2, 4.0, and 4.3BSD). It could be ported to
any platform that provides a BSD-style programming li-
brary with an ICMP echo request facility and curses.
AVAILABILITY
Requests should be sent to the author:
Dale Smith
Asst Dir of Network Services
University of Oregon
Computing Center
Eugene, OR 97403-1211
Internet: dsmith@oregon.uoregon.edu.
BITNET: dsmith@oregon.bitnet
UUCP: ...hp-pcd!uoregon!dsmith
Voice: (503)686-4394
With the source code, a makefile is provided for most
any UNIX box and a VMS makefile compatible with the
make distributed with PMDF. A VMS DCL command file is
also provided, for use by those VMS sites without
"make."
The author will attempt to fix bugs, but no support is
promised. The tool is copyrighted, but free (for now).
NAME
nfswatch
KEYWORDS
traffic; ethernet, IP, NFS; curses, eavesdrop; UNIX;
free.
ABSTRACT
Nfswatch monitors all incoming ethernet traffic to an
NFS file server and divides it into several categories.
The number and percentage of packets received in each
category is displayed on the screen in a continuously
updated display.
All exported file systems are monitored by default.
Other files may optionally be monitored. Options also
allow monitoring of traffic destined for a remote host
instead of the local host, or monitoring traffic sent
by a single host. Items such as the sample interval
length can be adjusted either on the command line or
interactively. Facilities for taking screen
"snapshots," saving all data to a log file, and summar-
izing the log file are included. Nfslogsum, a program
that summarizes the log file, is included in the dis-
tribution.
MECHANISM
Nfswatch uses the Network Interface Tap in promiscuous
mode to monitor the ethernet. It filters out NFS pack-
ets destined for the local (or remote) host, and then
decodes the file handles in order to determine which
file or file system a request pertains to.
CAVEATS
Because the NFS file handle is a non-standard (server
private) piece of data, the file system monitoring part
of the program will break whenever the format of a file
handle is not what it expects to see. This is easily
fixed in the code, however. The code presently under-
stands SunOS 4.0 file handles.
BUGS
None known.
LIMITATIONS
Up to 256 exported file systems and 256 individual
files can be monitored, but only (2 * (DisplayLines -
16)) will be displayed on the screen (all data will be
written to the log file).
Only NFS requests made by client machines are counted;
the NFS traffic generated by the server in response to
these requests is not counted.
HARDWARE REQUIRED
Has been tested on Sun-3 and Sun-4 systems. No
hardware dependencies, but see below.
SOFTWARE REQUIRED
SunOS 4.0 or higher. The STREAMS NIT device is used.
Fairly easy code modifications should be able to make
it run under older SunOS releases, or other versions of
BSD UNIX with a NIT-like device.
AVAILABILITY
Copyrighted, but freely distributable. Available via
anonymous FTP from hosts icarus.riacs.edu and
spam.itstd.sri.com in pub/nfswatch.tar.Z. There should
also be a copy on the 1989 Sun User's Group tape.
NAME
nhfsstone
KEYWORDS
benchmark, generator; NFS; spoof; UNIX; free.
ABSTRACT
Nhfsstone (pronounced n-f-s-stone, the "h" is silent)
is an NFS benchmarking program. It is used on an NFS
client to generate an artificial load with a particular
mix of NFS operations. It reports the average response
time of the server in milliseconds per call and the
load in calls per second. The nhfsstone distribution
includes a script, "nhfsnums" that converts test
results into plot(5) format so that they can be graphed
using graph(1) and other tools.
MECHANISM
Nhfsstone is an NFS traffic generator. It adjusts its
calling patterns based on the client's kernel NFS
statistics and the elapsed time. Load can be generated
over a given time or number of NFS calls.
CAVEATS
Nhfsstone will compete for system resources with other
applications.
BUGS
None known.
LIMITATIONS
None reported.
HARDWARE REQUIRED
No restrictions.
SOFTWARE REQUIRED
4.xBSD-based UNIX
AVAILABILITY
Available via anonymous FTP from bugs.cs.wisc.edu.
Alternatively, Legato Systems will provide the program
free of charge, if certain conditions are met. Send
name and both email and U.S. mail addresses to:
Legato Systems, Inc.
Nhfsstone
260 Sheridan Avenue
Palo Alto, California 94306
A mailing list is maintained for regular information
and bug fixes: nhfsstone@legato.com or
uunet!legato.com!nhfsstone. To join the list:
nhfsstone-request@legato.com or
uunet!legato.com!nhfsstone-request.
(next page on part 3)
