Listing Statistics for Segments

The List Segments view displays a list of segments and statistical information for each segment on your network. Statistics are displayed in columns of the table in the view. The view displays a list of segments associated with the object or node you selected in Novell ConsoleOne.

See Analyzing Traffic on Nodes Connected to a Segment for details about how to use Novell ZENworks Server Management to get information about nodes on individual segments.

To view statistical information of all segments:

1. In Novell ConsoleOne, select an Area or a node.

2. Click View > List Segments.

   If you select an Area, the List Segments view displays statistics for all segments found within that Area. If you select a node, statistics for all segments connected to that node will be displayed.

The following table describes the statistics displayed for each segment. The sampling interval for updating statistics on segments is 15 seconds.

HINT:  Statistics of segments are displayed in the List Segments view only if the segments are monitored by a Traffic Analysis Agent for NetWare or Traffic Analysis Agent for Windows.

Statistic	Explanation
Segment Name	Segment name or address.
Type	Physical segment type: Ethernet, FDDI, token ring, PPP, and unknown. Unknown indicates the segment whose physical segment type is other than the one listed.
Speed (Mbps)	The speed of the segment, as determined by the speed of the network board that attaches the RMON agent to the segment and factors such as the cable type of the segment. The value in this column appears only if you have at least one RMON agent connected to at least one server on your network.
Utilization%	Average percentage of the bandwidth currently used by all traffic on the segment.
Packets/s	Average number of packets per second currently transmitted on the segment.
KBytes/s	Average number of kilobytes per second currently transmitted on the segment.
Errors/s	Average number of errors per second currently appearing on the segment.
Message	Status of the RMON Agent on the segment. For details, see Selecting the Preferred RMON Agent.

As Novell ZENworks Server Management polls segments, messages in the Messages column vary. These messages display the status of the preferred RMON agent on the segment.

The preferred RMON agent is the node you selected to send information about the segment to Novell ConsoleOne. You can make this selection from the RMON Agent property page. For details, see Selecting the Preferred RMON Agent.

You can modify the view to show fields; format columns; sort and group items; change the font of text fields; or display grid lines in the table view by selecting the required option from View > Settings. For details, see Understanding Network Discovery and Atlas Management.

Determining the Performance of Individual Segments

Novell ZENworks Server Management provides real-time statistical information about the monitored segment on your network. This information is displayed in the Segment Dashboard view. The information displayed in this view is useful if you want to troubleshoot a segment.

The Segment Dashboard view displays four gauges that display the real-time statistics for a monitored segment. The lower portion of the view displays a bar graph of the top eight nodes, based on the value selected from the drop-down list. By default, it is based on packets out per second. See Viewing Statistics of the Top 20 Nodes for details about how to display a list of the most active nodes on a monitored segment.

You can configure the Segment Dashboard view to display the top eight nodes based on a different statistic. You can also choose to display or disable the top nodes graph. For details, see Choosing Options to Display Stations on a Segment.

You can set alarm threshold values on segment alarms for packets per second, broadcasts per second, and utilization percentage statistics displayed in the Segment Dashboard view. For details, see Defining Alarm Thresholds for Statistics Displayed in the Segment Dashboard View.

To view statistical information of an individual segment:

1. In Novell ConsoleOne, select a segment.

2. Click View > Segment Dashboard.

The Segment Dashboard view displays four gauges that display real-time statistics for a monitored segment. The peak value is indicated by a line on each bar in the graph. The following table describes the statistics displayed in the Segment Dashboard view.

Statistic	Explanation
Packets/s	Number of packets per second currently transmitted on the segment
Utilization%	Percentage of maximum network capacity currently consumed by packet traffic on the segment
Error/s	Number of error packets per second currently transmitted on the segment
Broadcasts/s	Number of broadcast packets per second currently transmitted on the segment (a broadcast packet is sent to all addresses on the segment)

Statistics are updated every five seconds. The numeric value of each statistic is displayed in the gauge.

Analyzing Trend Data for a Segment

Novell ZENworks Server Management allows you to determine trends of traffic patterns on the monitored segment. You can view the trend of segment performance from the Segment Trends view. You can use trend information to create a baseline of typical activity on segments. Having a baseline helps you set appropriate thresholds for segment alarms and plan maintenance activities and backups. Additionally, if problems occur on the segment, you can compare the typical traffic level against the atypical traffic level to help you discover the cause of the problem. For details, see Creating a Baseline of Typical Segment Activity.

The following topics will help you analyze trend data:

• Understanding the Trend Display
• Viewing Trend Statistics

Viewing Alarm Statistics for a Segment

Novell ZENworks Server Management tracks alarm statistics for segments. Alarms are generated when threshold values for statistics on a segment are exceeded. You can view a list of all the alarms for the monitored segment in the Segment Alarms property page.

To view alarm statistics for a segment:

1. In Novell ConsoleOne, select a segment.

2. Click File > Properties > Segment Alarms tab.

Novell ZENworks Server Management provides default threshold values for various segment alarms. You can enable or disable the default values for a monitored segment. If you choose not to use the default values, you can set the threshold value using the Set Alarm dialog box. See Configuring Alarm Options from the Set Alarm Dialog Box for details about how to set segment alarms.

If a segment does not have an RMON agent connected to it, an error message is displayed.

Viewing the Summarized Segment Information

The Segment Summary view provides brief information about a monitored segment in your network. It displays static information about the monitored segment, whether the segment is monitored or not, and information about the alarms generated on the segment. At a glance, you can determine the utilization of network capacity by nodes on the monitored segment, view a trend based on packets transmitted by nodes on the segment, and see the distribution of protocols on the segment.

To view the summarized segment information:

1. In Novell ConsoleOne, select a segment.

2. Click View > Segment Summary.

The following table describes the static information displayed in the Segment Summary view.

Statistic	Explanation
Name	Name of the segment
Type	Media type of the segment: Ethernet, FDDI, or token ring
IP Address	IP addresses of the segment
IPX Address	IPX address of the segment
Primary Agent	Name of the preferred agent monitoring the nodes and traffic on the segment
Agent Status	Status of the preferred agent monitoring the nodes and traffic on the segment
Nodes	Number of nodes on the segment
IP Nodes	Number of nodes on the segment that have an IP address
IPX Nodes	Number of nodes on the segment that have an IPX address
Servers	Number of NetWare servers on the segments
Workstations/Others	Number of nodes on the selected segment that are not NetWare servers
Network Probes	Number of monitoring agents on the selected segment
Switches	Number of switches on the segment
Routers	Number of routers used to connect nodes and devices on the segment
Hubs	Number of hubs on the segment

The Segment Summary view displays information about alarms generated on a monitored segment, as described in the following table.

Statistic	Explanation
Severity	Severity level attributed to the trap.
From	Network address of the device that sent the alarm to the alarm management system.
Summary	Summary of the event, often including the name or address of the object affected by the alarm.
Owner	Segment or device affected by the alarm.
Received Time	Date and time when the alarm management system received the alarm.
Type	Generic description of the alarm, for example, Volume out of disk space.
Category	Displays the category of the alarm based on the MIB that defines the trap-type objects. The category is directly related to the MIBs included in the management server MIB pool. For example, the category for NetWare servers is based on the NetWare Server Alarm MIB.

The Segment Summary view displays dynamic information about a monitored segment, as described in the following table.

Statistic	Explanation
Utilization%	Displays a dial representing the real-time values of the network capacity consumed by packet traffic on the segment.
Packets	Displays the trend based on packets transmitted on the segment. Displays real-time trends for segments monitored by RMON agents and daily trends for segments monitored by RMON Plus agents.
Protocol Distribution	Displays a pie chart representing the distribution of application layer protocols for which the agent monitoring the segment can collect data. Each slice represents a protocol suite. Click a slice to view the names of protocols. Enabled if the agent monitoring the selected segment is an RMON2 agent.

Viewing Statistics of the Top 20 Nodes

You can use Novell ZENworks Server Management to determine the statistics of the most active nodes on a segment for a wide range of performance statistics. This is useful if you want to discover which node is generating the most traffic based on a particular statistic. For example, you can find the heaviest source of broadcast traffic.

The Stations view displays a list of all nodes on a monitored segment. You can use this view to determine the top 20 nodes on a monitored segment. The view lists the top 20 stations sorted by packets out per second. You can choose a different statistic based on which you want the top 20 nodes to display. For details, see Choosing a Statistic Based on Which Top 20 Nodes Are Displayed. If there are fewer than 20 top nodes, only the available number of top nodes are listed.

To view the statistics of the top 20 nodes on a segment:

1. In Novell ConsoleOne, select a segment.

2. Click View > Stations.

3. From the Stations view, click View > Show Top N Stations.

The Stations view displays columns that provide statistical information for each station. The following table describes the statistics displayed in the Stations view.

Statistic	Explanation
MAC Address	Physical Media Access Control (MAC) address of a node
Node	Name of the node (or address, if the name is not in the database)
Util.%	Percentage of maximum network capacity consumed by packets sent by a node
Packets/s In	Packets per second received by a node
Packets/s Out	Packets per second transmitted by a node
Bytes/s In	Bytes per second received by a node
Bytes/s Out	Bytes per second transmitted by a node
Errors/s	Errors per second transmitted by a node
Broadcasts/s	Broadcast packets per second transmitted by a node
Multicasts/s	Multicast packets per second transmitted by a node (packets transmitted to a specific group of nodes)
Protocols	Types of protocols used by a node
First Transmit	Date and time a node first transmitted since the traffic analysis agent was started
Last Transmit	Date and time a node last transmitted since the traffic analysis agent was started

Stations statistics are updated periodically. Every 60 seconds, the table is resorted and new top nodes are displayed. At this point, new nodes might be added and existing nodes might be discarded from the list.

Viewing Statistics of Nodes on an FDDI Segment

Novell ZENworks Server Management lets you display data for nodes on monitored FDDI ring segments to help troubleshoot problems.

The FDDI Ring Stations view displays statistics for individual nodes on the monitored FDDI ring segment. The view lists the nodes on the segment and shows the order of each node on the ring and which node is the active monitor.

To view the statistics of nodes on an FDDI ring segment:

1. In Novell ConsoleOne, select an FDDI ring segment.

2. Click View > FDDI Stations.

The statistics shown for each node are cumulative since the Traffic Analysis Agent for NetWare was last started and are updated every ten seconds as described in the following table:

Statistic	Explanation
Order	Relative position of the node on the FDDI ring from the traffic analysis agent.
Name	Name of the node or, if the name is not in the database, the physical (MAC) address of the node.
MAC Address	Physical (MAC) address of the node.
Status	Status of the node: On---The node is actively participating in a ring poll. Off---The node is not participating in a ring poll.
Duration	Time elapsed since the node was On or Off.
UpStream Neighbor	MAC address of the node upstream to this station on the logical ring.
DownStream Neighbor	MAC address of the node downstream to this station on the logical ring.
Last Entered Time	Date and time the node last entered the ring.
Last Exit Time	Date and time the node last exited the ring.
SMT Request Type	The SMT request to which the node is responding. Indicates if the node was able to successfully respond to the request. In case of a failure, the response code indicates the reason.
SMT Response Type	The SMT response generated by the node on receiving an SMT request. If the node was unable to respond, the response code indicates the reason.
Request Denied	The cumulative total of request denied responses generated by the node. A request denied frame is generated when the responding node does not support the SMT version number of the requesting node, when a set fails, or when a request for synchronous bandwidth allocation by a node cannot be honored.
In CRC Error	Total number of cyclic redundancy check (CRC) line errors reported by this node.
Out CRC Error	Total number of CRC errors reported by the nearest active downstream neighbor of this station and detected by the probe.
Lost Frames	Total number of lost frame errors received on the network. A lost frame error indicates that the end delimiter of a frame was lost in the network.
In Beacons	Total number of beacon frames detected by the probe that named this station as its upstream neighbor.
Out Beacons	Total number of beacon frames sent by this station and detected by the probe.
Insertions	Number of times the probe detected this station inserting onto the ring.

Viewing Statistics of Nodes on a Token Ring Segment

The Token Ring Stations view displays statistics for individual nodes on the monitored token ring segment. The view lists the nodes on the segment and shows the order of each node on the ring and which node is the active monitor.

To view the statistics of nodes on a token ring segment:

1. In Novell ConsoleOne, select a token ring segment.

2. Click View > Token Ring Stations.

The view displays statistical information as described in the following table. Statistics are cumulative since the RMON agent was started and are updated every ten seconds.

Statistic	Explanation
Order	Relative position of the node on the token ring from the RMON agent.
Name	Name of the node or, if the name is not in the database, the physical (MAC) address of the node.
MAC Address	Physical (MAC) address of the node.
Status	Status of the node: On---The node is on the ring. Off---The node is off the ring. On (Monitor)---The node is on the ring and is the active monitor.
Duration	How long this node has been on or off.
Last Entered Time	Date and time the node last entered the ring.
Last Exit Time	Date and time the node last exited the ring.
Duplicate Address	Total number of duplicate address errors reported, generated when this node detects other nodes using its own address.
Soft Errors	Number of soft errors in packets transmitted by this node.
Inline Errors	The total number of line errors reported by this station in error reporting packets to the ring error monitor and detected by the probe.
Outline Errors	The total number of line errors reported in error reporting packets sent by the nearest active downstream neighbor of this station and detected by the probe.
Internal Errors	Number of internal errors this node has reported. Internal errors generally indicate a recoverable failure of a network adapter board.
In Burst Errors	The total number of burst errors reported to the Ring error monitor and detected by the probe.
Out Burst Errors	The total number of burst errors reported in error reporting packets sent by the nearest active downstream neighbor of this station and detected by the probe.
AC Errors	Number of times this node could not interpret the Address Recognized Indicator (ARI) and the Frame Copied Indicator (FCI) during the ring process.
Abort Errors	Number of times a node transmitted an abort sequence. Abort sequences are usually transmitted when a node detects an error in frames it is currently transmitting.
Lost Frame Errors	Number of times a node transmitted a frame but failed to receive it back in its entirety.
Congestion Errors	Number of times the node detected a frame addressed to its specific address but could not copy it (generally due to insufficient buffers).
Frame Copied Errors	Number of times a node detected a frame addressed to its specific address with either or both the ARI and FCI bits set to 1. (Indicates that another node is using its address.)
Frequency Errors	Number of times a node's internal clock differed from the ring clock.
Token Errors	Number of token errors. These occur when the token gets corrupted or when the Active Monitor does not see a new frame transmitted in the required amount of time. Only the Active Monitor can report this error.
In Beacon Errors	The total number of beacon frames sent by this station and detected by the probe.
Out Beacon Errors	Total number of beacon frames sent by this station and detected by the probe.
Insertions	Number of times the probe detected this station inserting onto the ring.
Last NAUN	The station that was last named by the probe as the next active upstream neighbor (NAUN).

Viewing Conversations (Traffic) Between Nodes

Novell ZENworks Server Management provides real-time data about all the network traffic between a selected node and one or more other nodes on a segment. This data can be viewed from the Conversations view. You can use the data displayed in this view to determine specific information about node communication. For example, it can show which nodes communicate with a router or server, determine the load on a server, or examine the traffic flowing to or from a node that is reporting difficulties.

To view conversations between nodes:

1. In Novell ConsoleOne, select a node.

2. Click View > Conversations.

   If the selected node is connected to more than one segment, the Select Segment dialog box displays.

   1. Select the segment where the node you want to examine traffic is connected then click View, and then click Conversations.

The Conversations view lists the percentage of traffic that each destination node contributes to the load on the source node. However, due to sample skewing (samples not taking place at the same time) and rounding up of statistics, the numbers in the columns do not always add up to 100%.

The statistics displayed in the Conversations view are updated every 5 seconds. The following table describes the statistics displayed in the Conversations view.

Statistic	Explanation
Node	Name of the destination nodes with which the source node is communicating
% Pkt Load	Percentage of the packet load between a destination node and the source node
% Byte Load	Percentage of the byte load between a destination node and the source node
Pkts/s In	Packets per second received by a destination node from the source node
Pkts/s Out	Packets per second transmitted by a destination node to the source node
Bytes/s In	Bytes per second received by a destination node from the source node
Bytes/s Out	Bytes per second transmitted by a destination node to the source node
Pkts In	Number of packets received by a destination node from the source node since the view was opened
Pkts Out	Number of packets transmitted by a destination node to the source node since the view was opened
KBytes In	Total kilobytes received by a destination node from the source node since the view was opened
KBytes Out	Total kilobytes transmitted by a destination node to the source node since the view was opened
Protocols	Protocol packet types used by the destination node in this conversation
First Transmit	Date and time that the destination node first transmitted on the network since the traffic analysis agent was loaded
Last Transmit	Date and time that the destination node last transmitted since the traffic analysis agent was loaded
MAC Address	Physical (MAC) address of the destination node

Monitoring Nodes for Inactivity

For segments on which at least one Traffic Analysis Agent for NetWare version 1.0 or later is installed, you can specify the nodes on the segment you want to monitor so that you are alerted if they become inactive. You can do this using the Monitor Nodes for Inactivity view.

Monitoring nodes for inactivity has the following advantages:

• You can monitor any node on the segment, regardless of the protocol the node uses.
• This feature does not impact network traffic because the traffic analysis agent does not poll the nodes to obtain their status.

To view a list of nodes monitored for inactivity:

1. In ConsoleOne, select a segment.

2. Click View > Monitor Nodes for Inactivity.

Another way to monitor connectivity is to specify the target in the Ping window and test the status of the specified node. The Connectivity Test window displays statistics that enable you to determine the status of the specified target. For details, see Monitoring Services.

By default, the poll interval for refreshing the Monitor Nodes for Inactivity view is zero seconds. You can configure the poll interval based on how often you want the view to be refreshed. For details, see Specifying the Poll Interval for Refreshing the Monitor Nodes for Inactivity View. You can also change the duration for the agent to verify the node before declaring it inactive. For details, see Specifying the Duration for the Agent to Determine if a Node Is Inactive.

IMPORTANT:  You do not need to keep the Monitor Nodes for Inactivity view open or Novell ConsoleOne for the nodes to be monitored because the RMON agent is doing the monitoring, not Novell ConsoleOne. The Alarm Manager must be running to record an inactive node in the Alarm Report. If Novell ConsoleOne is not running, check for alarms after you restart it.

To monitor a node for inactivity:

1. In ConsoleOne, right-click a node or from any view that displays a list of nodes, then click Monitor Nodes for Inactivity > Add.

To disable a node from being monitored for inactivity:

1. In ConsoleOne, right-click the node that is monitored for inactivity then click Monitor Nodes for Inactivity, and then click Delete.

IMPORTANT:  After the addition of any inactive node, if the NIC card of the node is changed, you will be able to see the node in the Monitor Node for Inactivity view but will not be able to delete it because of the change of MAC address.

Statistics displayed in the Monitor Nodes for Inactivity view are described in the following table.

Statistic	Explanation
Name	Displays a list of nodes that are being monitored for inactivity
MAC Address	Displays the MAC address of the network interface
Status	Displays the status of a node as active or inactive

You can open the Monitor Nodes for Inactivity view to check the Status column any time Novell ConsoleOne is running. To do this, complete the following steps:

1. In ConsoleOne, select a segment.

2. Click View > Monitor Nodes for Inactivity.

   The Status column displays if the selected node is active or inactive.

This Monitoring Nodes for Inactivity feature also allows you to add and monitor the nodes from the segments. To do this, follow these steps:

1. In ConsoleOne, right-click the segment, and select Monitor Nodes For Inactivity view.

2. Click or select File > Actions > Add Node(s).

3. In the Monitor Nodes for Inactivity - Add Node dialog box, select the nodes you want to add.

   The nodes you add will be displayed in the view.

The Monitor Nodes for Inactivity module now sends alarms if the node you are monitoring is in the Off state or Timeout state. You can also change the timeout value from the Monitor Nodes for Inactivity view.

1. Click or select File > Actions > Edit Timeout.

   
   

2. Specify the timeout period.

3. Click OK.

Defining a Capture Filter

Novell ZENworks Server Management provides a capture filter with default values you can use to capture packets using any Traffic Analysis agent. You can modify the values by defining a filter. For example, if you want to capture only NetWare packets sent by a certain node, you can define a filter to capture only those packets. As a result, the buffer has more space to store your selected packets. Once you define a filter setting it shall be saved for future uses.

When you specify a capture filter, you are specifying the packets to capture (include) in the buffer on the RMON agent, not the packets to exclude. When you specify both a node and a protocol, packets must meet both criteria to be captured. If you select more than one protocol family, packets can meet either protocol criteria to be captured.

To define a capture filter:

1. Click File > Actions > Capture Packets.

2. In the Capture Name text box, enter a name if you do not want to use the default name.

   The capture name helps you keep track of multiple captures on the same segment.

3. In the Capture Using drop-down list, select the Traffic Analysis Agent that will be used to capture packets. Click Find In Atlas to select any Traffic Analysis Agent on the site. The Traffic Analysis Agent you have selected will be saved and used the next time.

4. Enter or select the source and destination nodes from the Stations box. You can also click the Find Node icon to select the node from the Find dialog box, an atlas component.

   The Stations box displays a list of nodes on the segment from which the user can capture packets. You can select from Hardware, IP, or IPX stations.

   If you choose ANY in both the source and destination node list, all packets sent by or received from any node are captured.

5. Select the direction of traffic flow between the nodes.

   Click an arrow option from the drop-down list to specify the direction of the traffic flow. The available node and traffic flow directions are shown in the following table.

   Node	Arrow	Node	Effect
   node1	<==>	node2	Capture packets that node1 sends to node2 and packets that node2 sends to node1.
   node1	<==>	ANY	Capture packets that node1 sends to any node and packets that node1 receives from any node. This is equivalent to ANY <==> node1.
   ANY	<==>	ANY	Capture all packets sent by or received from any node.
   node1	==>	node2	Capture packets that node1 sends to node2. This is equivalent to node2 <== node1.
   node1	==>	ANY	Capture packets that node1 sends to any other node. This is equivalent to ANY <== node1.
   node1	<==	node2	Capture packets that node2 sends to node1. This is equivalent to node2 ==> node1.
   node1	<==	ANY	Capture packets that any node sends to node1. This is equivalent to ANY<== node1.

6. If you want to filter on protocols used, add the protocol suites you want to the Selected list box.

   To add a protocol to the Selected list box, select it from the Available list box > click Add.

   or

   To delete a protocol from the Selected list box, select it then click Remove.

   All protocols are selected by default when you first use Novell ZENworks Server Management. If no protocols are listed in the Selected list box, all protocols are captured.

   See Protocol Decodes Suite Supported by Novell ZENworks Server Management for details about the protocol decoding support that Novell ZENworks Server Management provides.

7. Specify what kind of packets to capture on Ethernet, FDDI, or token ring segments.

   The default statistics for the segments are listed in the following table.

   Segment Type	Available Statistics	Default Statistics
   Ethernet	Only good packets, only error packets, or both good and error packets.	Good packets and error packets
   FDDI ring	All packets, LLC packets, MAC packets, or SMT packets.	All packets
   Token ring	All packets, non-MAC packets, or MAC packets. MAC packets are used to manage the operation of the token ring.	All packets

8. Specify whether to stop packet capture or to overwrite the oldest packets in the buffer with newer ones when the buffer is full.

   Continuing packet capture means that a stop criteria does not exist and new packets will overwrite those already captured. You will need to manually stop packet capture if you select to overwrite the oldest packets.

9. Specify a buffer size.

   Select a buffer size from the drop-down list or specify the size you want. The default buffer size is 128 KB.

   The RMON agent will attempt to provide the buffer size requested. If not enough space is available in server memory for a large buffer, the RMON agent cannot create the requested size.

10. Select a slice size.

    A slice specifies the maximum number of bytes of each packet, counting from the packet header, to keep in the buffer. This helps maximize the number of packets you can store in your buffer space, as well as reduce the load on the RMON agent to process captured packets. If you want to decode protocol header information, you need only 100 to 150 bytes. The rest is typically data that you need only if you suspect a data corruption problem. However, on certain very large packets, slicing can cause incorrect decodes by truncating information.

Your capture filter is now set up. If you decide not to capture packets, click the Cancel button.

Starting Packet Capture

To start packet capture:

1. Define a capture filter. See Defining a Capture Filter for the procedure.

2. Click OK to apply the filter settings on the preferred RMON agent of the segment.

3. Click Start in the Capture Status dialog box.

When you start packet capture, the Start button in the Capture Status dialog box toggles to read Stop and the activity indicator reflects the capture buffer storage as it progresses. As packets that meet the filter criteria are captured, the capture buffer will begin to store the packet data, and a box below it will display the number of packets captured. The needle stops turning when the capture buffer is full.

Creating Simultaneous Packet Capture

You can create simultaneous packet captures by repeating the procedure you followed to start the first capture. This lets you set up and run captures with different capture criteria.

You can run a maximum of 20 packet captures with different capture criteria.

Stopping Packet Capture

When you set up a capture filter, you choose whether to stop packet capture when the capture buffer is full or to continue to capture packets but overwrite the oldest packets in the buffer.

By default, the packet capture will stop when the capture buffer is full. If you select to overwrite when the buffer is full, you must stop packet capture manually.

To stop packet capture manually, click the Close button in the Capture Status dialog box.

IMPORTANT:  If you restart packet capture from the Packet Capture Setup window, the existing buffer is deleted and refreshed.

Restarting a Stopped Packet Capture

When the Packet Capture Setup window is open, you can start and stop capturing packets using the Start/Stop toggle button in the Capture Status dialog box. If Novell ZENworks Server Management is capturing packets, the button is labeled Stop; if it is not capturing packets, the button is labeled Restart. The RMON agent buffer is cleared when you restart.

Saving and Viewing the Captured Packets

You can save captured packets to a file and view as many files as you want, either while you are viewing a capture buffer or independently.

To view the saved packet capture files:

1. Click Tools > View Packet File.

   The File Open dialog box is displayed.

2. Browse and select the packet capture file.

   The .TR1 file extension will be appended automatically.

Viewing Captured Packets

You can use the Trace Display view to view the decoded packet capture information, the packet data in hexadecimal format, and a summary of the captured packets:

To view a captured packet:

1. In Novell ConsoleOne, select a node or a segment.

2. Click File > Actions > Capture Packet.

3. Capture packets using the capture filter of your choice. See Defining a Capture Filter for details.

4. Click the View button in the Capture Status dialog box.

The Trace Display window contains three panes that display captured and decoded packets, as described in the following sections:

• Viewing the Packet Decode
• Viewing Packet Data in Hexadecimal Format
• Viewing a Summary of Captured Packets

When you view packets initially, the first packet in the Summary pane is highlighted and selected. The contents of that packet are displayed in the Decode pane. If you select a different packet in the Summary pane, it is highlighted and the Decode pane displays its decoded contents.

You can change the size of the Trace Display panes by dragging the divider between windows.

Filtering Packets for Display

After you have captured packets, you can apply a display filter to the capture buffer and view only the packets that interest you. You can filter on node names or addresses, protocol families or protocol layers, or contents of a selected field. This is useful in situations when, after you have captured packets, you realize there is a problem with a specific workstation and you want to display only the packets it has sent or received.

Display filtering requires the transfer of a portion of every captured packet from the RMON agent to Novell ConsoleOne. For large captures, this consumes time and network bandwidth. We recommend that you define very specific capture filters rather than filtering during display. However, subsequent filtering of the same capture does not result in additional data transfer from the traffic analysis agent because the data is already transferred to Novell ConsoleOne. Therefore, it is much quicker to filter the same packet capture a second time.

Display filters affect only the display; they do not change the capture buffer. All captured packets remain in the capture buffer and are available for viewing with a different display filter or without any display filter.

You can define a display filter in either of two ways:

• From the Trace Display window, click View > Filter.

  The Display Filter dialog box is displayed. For details, see Defining the Display Filter.

• Double-click a packet in the Summary pane or double-click a selected protocol layer or field in the Decode or Hexadecimal pane.

  A filter is set based on what you selected. You can also modify the filter information as needed. For details, see Point-and-Click Filtering.

Defining the Display Filter

Capture packets using the capture filter of your choice. See Defining a Capture Filter for details. To define a display filter:

1. In Novell ConsoleOne, select a segment.

2. Click File > Actions > Packet Capture.

3. Click the View button in the Capture Status dialog box.

4. With the Trace Display window displayed and active, click View > Filter.

5. Select the nodes from the drop-down lists. You can select from IP, IPX or MAC address.

   Alternatively, you can enter a node name or address in place of ANY in either or both of the drop-down list boxes.

6. Select the direction of the traffic flow from the arrow options available in the drop-down list.

7. To display all the packets of a specific protocol layer:

   1. Double-click a protocol suite name from the list of protocols to display a list of all the protocols in the suite.

   2. Scroll through the list to find the protocol you want.

   3. Select the protocol.

8. To display all the packets that have the same contents in a specific field:

   1. Enter the offset in hexadecimal bytes.

      You can count the offset in the Hexadecimal pane when the packet is decoded, using the offset column for guidance. See Viewing Packet Data in Hexadecimal Format for details.

   2. Specify whether the offset is counted from the beginning of the packet or from the beginning of a protocol layer.

      If you choose the protocol layer option, you must select a specific protocol in the Protocol box.

   3. Enter the data that you want to include in the filter.

   4. Specify the format in which you want the data to be displayed. Select from hexadecimal, ASCII, or EBCDIC format options.

      You can also fill in the values using point-and-click filtering. See Point-and-Click Filtering.

9. Click OK.

   The dialog box closes and Novell ZENworks Server Management begins to select the required packets from the capture buffer.

   If you have a large capture buffer, Novell ZENworks Server Management displays the initial packets that pass the filter. Novell ZENworks Server Management continues to filter in the background while you examine these packets.

   The Summary pane shows the list of filtered packets that met the criteria in the display filter. You can view and decode them as described earlier in this section.

Selecting and Decoding a Different Packet

To select a different packet for decoding:

1. Select View > Go To.

   You can also use the arrow keys on your keyboard to highlight a different packet.

2. Enter the packet number.

   If the packet number specified is more than the total number of captured packets, an error message displays. If a display filter is set and the specified packet number has not passed the filter, then a packet closest to the specified packet is displayed.

Packets are retrieved from the RMON agent as you select their headers in the Summary pane using the mouse or the arrow keys. Using the Go To dialog box avoids transferring unwanted packet data from the RMON agent. Similarly, scrolling the Summary pane with the scroll button retrieves only the packet header data when creating the decode summary, whereas using the arrow keys retrieves all packet data.

Highlighting Protocol Fields and Hexadecimal Bytes

Novell ZENworks Server Management provides a highlighting tool that helps you associate protocol fields and hexadecimal bytes. Highlighting can be a useful training tool for new network managers who want to learn about protocol decoding.

You can use this tool in the following ways:

• Highlight a protocol layer in the Decode pane.

  All bytes are highlighted in the selected protocol layer of the Hexadecimal pane.

• Click a field in any of the protocol layers in the Decode pane.

  Associated bytes are highlighted in the Hexadecimal pane.

• Click hexadecimal bytes in the Hexadecimal pane.

  All hexadecimal and ASCII or EBCDIC bytes of this field in the Hexadecimal pane are highlighted, and the associated field is highlighted in the Decode pane.

• Click ASCII or EBCDIC text in the Hexadecimal pane.

  All hexadecimal and ASCII or EBCDIC bytes that belong to the field are highlighted in the Hexadecimal pane, and the associated field is highlighted in the Decode pane.

Saving Packet Files

You can save captured packets to a file and open the file later to analyze or print. When you save packets to a file, Novell ZENworks Server Management creates a binary file with the name you specify. You might want to save packets to a file in the following situations:

• To transfer the packets to another system or to send them for analysis.
• To apply a display filter to decoded captured packets so you can view only the packets that interest you. After you apply the display filter, you can save the filtered packets to a file.
• To compare packets saved from your buffer with other packets. You can either save the other packets, or view them from the capture buffer. You can view only one active capture buffer at a time. However, after you have saved packets to a file, you can open as many files as you want, and simultaneously view a capture buffer, if desired.

Packet files are compatible with the Traffic Analysis Agent for Windows and earlier versions of ManageWise^®. Hence, packets captured and saved using Traffic Analysis Agent for Windows can be viewed using Novell ZENworks Server Management.

To save captured packets to a file while viewing the capture buffer:

1. Click File > Save As.

   The Save Filtered Packets or Save Unfiltered Packets dialog box is displayed, depending on whether you filtered your packets.

2. Enter the name in the Filename text box.

   The .TR1 file extension is appended automatically.

3. Click OK.

   IMPORTANT:  Filter out the captured packets you want to save. (See Filtering Packets for Display.) When you save packets, you save only those that pass the display filter. If you did not filter the display, all packets are saved.

Opening Packet Files

To open a packet file:

1. From the main menu of Novell ConsoleOne, click Tools > View Packet File.

2. Double-click the file you want to open.

Printing Packets

To print packets:

1. Open a Trace Display window, either by capturing packets or by opening a packet file.

2. Click File > Print.

3. Select the print options you want.

   You can select the destination, format, and the packets you want to print.

   • Choose whether to print to your default printer or to a file. If you choose a file, enter its name and specify whether the current packet data should overwrite the file or be appended to it.
   • Choose whether you want a summary of the packet information, only the hexadecimal information, a full decode, or a brief decode. These formats correspond to the three panes described in Viewing Captured Packets.
   • Choose whether to print all packets, a range of packets, or only the filtered packets.

4. Click OK.

Displaying a List of Protocols Used in Your Network

You can use the Protocol Directory property page to view a hierarchical representation of supported and custom protocols used in the network, transport, and application layers in your network. By default, the page displays the Protocol Directory Tree that displays a collapsed list of protocols. The protocols used in the data link layer are displayed at the top level. You can expand each protocol to display the list of supported and custom protocols under the selected protocol.

You can also use the Protocol Directory property page to add or delete the protocols supported by the RMON2 agent. For details, see Adding Supported Protocols to the Protocol Directory Tree. The custom protocols that are used by the nodes in your network but are not supported by the RMON2 agent can also be added using the limited extensibility feature of RMON2. For details, see Adding Custom Protocols to a Supported Protocol Tree. For details about the limited extensibility feature, see RFC 2021.

For a selected protocol, you can specify the RMON2 groups you want the RMON2 agent to support. This will let you obtain the RMON2 details of the groups that you specify the agent to support. While adding the protocol, you can enable the agent support for the Host group, Matrix group, and Address Map group. The Groups Supported box in the lower portion of the property page indicates whether the agent support for the Host and Matrix groups in the network layer and application layer, and support for the Address Map group are enabled, disabled, or not supported for the selected protocol. You can configure the values displayed in the Groups Supported box.

The Add and Remove buttons are enabled only when you select a protocol in the Protocol Directory tree.

IMPORTANT:  The Traffic Analysis Agent for NetWare and Traffic Analysis Agent for Windows do not support enabling of the Address Map, Host, and Matrix groups for protocols in the Protocol Directory.

To open the Protocol Directory property page:

1. In Novell ConsoleOne, click RMON2 under Service within a node.

2. Click File > Properties > Protocol Directory tab.

Refer to the following sections:

• Adding Supported Protocols to the Protocol Directory Tree
• Adding Custom Protocols to a Supported Protocol Tree

Determining the Distribution of Protocols in a Segment

Novell ZENworks Server Management lets you determine the distribution of protocols discovered by the RMON2 agent. You can use the information displayed in this view to analyze the traffic in your network and to troubleshoot network problems. Use the Protocol Directory property page to add, delete, or edit a protocol. See Adding Supported Protocols to the Protocol Directory Tree and Adding Custom Protocols to a Supported Protocol Tree for details.

The distribution of protocols discovered by the RMON2 agent is displayed in the Protocol Distribution view, based on the layer in which the protocols are discovered.

To view the distribution of protocols in the selected segment:

1. In Novell ConsoleOne, select a segment.

2. Click View > Protocol Distribution.

The view displays the following three tables that list the protocols discovered in the network:

• Network layer table
• Transport layer table
• Application layer table

The protocols discovered by the RMON2 agent are placed in the appropriate table in the Protocol Distribution view depending on the layer in which they were discovered. Each table displays protocol statistics that are updated every 15 seconds.

The following table describes the protocol statistics displayed in the Protocol Distribution view.

Statistic	Description
Protocol Name	The name of the protocol
Packets/s	The average number of packets transmitted per second using the protocol discovered by the agent on the monitored segment
Bytes/s	The average number of bytes transmitted per second using the protocol discovered by the agent discovered on the monitored segment
Packet Rate %	The percentage of packets transmitted using the protocol; this is relative to the total percentage of packets transmitted using all protocols discovered by the agent
Byte Rate %	The percentage of bytes transmitted using the protocol; this is relative to the total percentage of bytes transmitted using all protocols discovered by the agent

IMPORTANT:  Only one entry of each protocol is displayed in the Protocol Distribution view. Consolidated statistics are displayed for a supported protocol in more than one protocol suite.

Viewing Statistics for Ports in a Switch

You can use the Unified Port Traffic view to obtain statistical information about every switch port in your network. The view also displays a drop-down list of nodes connected to each port. The information displayed in this view is useful if you want to troubleshoot a port.

The Unified Port Traffic view displays a list of nodes connected to ports on the switch and statistics for each port. You can view Ethernet specific statistics for Ethernet ports on a switch. Statistics specific to FDDI and token ring ports are not displayed with this version of Novell ZENworks Server Management, although general port statistics are displayed for all ports on a switch regardless of the media type. You can choose to display all statistics or configure the Unified Port Traffic view to display selected statistics. For details, see Choosing Statistics to Display in the Unified Port Traffic View.

To display the statistics of ports in a switch:

1. In Novell ConsoleOne, select Switch/Bridge under Services within a switch.

2. Click View > Port Traffic.

Viewing the Summarized Switch Information

The Switch Summary view provides brief information about a selected switch. You can view static information about a selected switch and information about alarms generated on the switch. You can also determine the packets and broadcasts received by the switch per second.

To view the summarized switch information:

1. In Novell ConsoleOne, select Switch/Bridge under Services within a switch.

2. Click View > Switch Summary.

The Switch Summary view displays static information about a selected switch, as described in the following table.

Statistic	Explanation
Vendor	Name of the switch vendor
Switch Type	Type of switch: Transparent or Source Route
Number of Ports Active	Number of active ports on the switch
Forwarding Table Overflow Count	Number of times the forwarding table has exceeded its capacity
Up Time	Time since the switch was last rebooted
Number of Ports Present	Number of ports present on the selected switch
Number of MAC Addresses Learned	Number of MAC addresses dynamically discovered by the switch

The Switch Summary view displays information about alarms generated on a selected switch, as described in the following table.

Statistic	Explanation
Severity	Severity level attributed to the trap.
From	Network address of the device that sent the alarm to the alarm management system.
Owner	Segment or device affected by the alarm.
Summary	Summary of the event, often including the name or address of the object affected by the alarm.
Received Time	Date and time when the alarm management system received the alarm.
Type	Generic description of the alarm. For example, Volume out of disk space.
Category	Displays the category of the alarm based on the MIB that defines the trap-type objects. The category is directly related to the MIBs included in the management server MIB pool. For example, the category for NetWare servers is based on the NetWare Server Alarm MIB.

The Switch Summary view displays dynamic information about a selected switch, as described in the following table.

Statistics	Explanation
Switch Load (pkts/sec)	The load on the switch based on packets received by the switch per second
Frames Dropped/sec	The number of received packets discarded per minute
Broadcasts/sec	The number of broadcasts received by the switch from the nodes connected to ports of the switch