Observer 5.1

A tool that monitors, analyzes, and troubleshoots your network

The multiple protocols and daemons that accumulate on my system make sortingthrough my network painful. To make this task more pleasant, I used NetworkInstruments' Observer 5.1, a helpful network-analysis tool. I expected Observerto be as underpowered as the network troubleshooting programs I've used in thepast. Much to my surprise, Observer delivered on all its promises and helped mesort through my systems.

Clearing the Clutter
Before reviewing the software, I'll give you background about the server Iran Observer on. My main server houses two NICs: a 3Com EtherLink III PCI cardand a 3Com EtherLink III ISA card. I use the EtherLink III PCI card as anadapter for my LAN; I use the
ISA card for connecting to my WAN, which, inturn, connects me to a 2.5Mbps asymmetric digital subscriber line (ADSL) to theInternet.

The LAN setup is simple: I hooked up a few Windows NT Workstation and Linuxboxes to a Pentium II processor running NT Server. The ADSL link is morecomplex. Rather than directly connecting to the Internet, the ADSL routerconnects me to another network, which then translates my internal IP address to a live IP. This setup puts my machines behind a firewall and adds a layer to my Internet connection.Although this setup sounds convoluted, it's seamless in execution.

This setup complicates Observer's job. Instead of just watching my internalnetwork activity, the program must monitor all TCP traffic going to and from my machine. As a demanding reviewer, I expected Observer to sort thisdata into easy-to-read columns (so many different types of TCP packets existthat I cringe at the thought of sorting through them manually). Observerlived up to my expectations.

Uncovering the Mystery
Installing Observer was easy: I just dropped the CD-ROM into my drive andclicked Setup. In 5 minutes, the software was ready to go. As I began workingwith Observer, the only problem I encountered was the learning curve associatedwith using the program. I found Observer's user interface (UI) to be confusing.

After I figured out the subtle nuances of the UI, I put Observer to work.Using 10Base-T NICs, I ran Observer against a five-station workgroup. Observerrevealed that one of my workstations was causing network collisions. By usingthe Station view (an overview of all the systems on the network), I identifiedthe machine with the faulty hardware. Then I easily solved the problem byreplacing the NIC in that machine.

For Internet monitoring, Observer differentiates between different types ofTCP packets, as Screen 1 shows. Because my server runs a variety of daemons, theability to sort through FTP, HTTP, Simple Mail Transfer Protocol (SMTP), andPost Office Protocol (POP) traffic is a godsend.

Observer's weakness lies in its packet-sniffing mode, which lackstroubleshooting features (competing packages offer a mode for identifyingpotential network problems). However, Observer efficiently displayed the typesof packets my system captures and the number of packets the system drops.

Observer Cleaned House
Observer is a keeper. I can let the program run for a month and then dumpthe output into a trend analysis filter to see what's taking place on mynetwork. Observer includes the useful Ethernet Vital Signs utility (the utilityalso works on Token-Ring networks), which reports any errors on the network,such as cyclical redundancy check (CRC) errors and abnormal-sized packets. AndObserver supports the major network protocols (i.e., IPX, TCP/IP, NetBIOS,NetBEUI, and AppleTalk), so you can be confident Observer will work on yourexisting network.