Network Probe 0.3 User's Guide

INTRODUCTION

This network monitor and protocol analyzer gives you an instant picture of the traffic situation on your network and enables you to monitor network traffic in real time, and hunt down, identify and isolate potential traffic problems and slowdowns.

Requirements

A Java Runtime Environment and 64 MB RAM is required on the server, as well as a network interface card (NIC). Clients need a web browser supporting Java.

Network Probe supports Windows 2000, Windows XP, Windows NT and Linux. There is a separate distribution for Linux, see http://www.objectplanet.com/Probe/

Switched networks:
Note that the probe should be placed on a computer connected to a mirrored port on the switch or a router. When connected to a normal switch port, only broadcast traffic is seen (as well as all traffic on the probing computer).

Installation

[1]Launch NetProbe-0.3-install.exe, follow instructions (most likely done if you read this)
[2]Log onto your system with administrator rights
[3]Make sure the computer is configured for networking and that TCP/IP is setup and running correctly
 
WINDOWS 2000 and XP users:
[4]Launch Network Probe from your Start->Programs->Network Probe menu
[5]The NetProbe Packet Driver will be installed first time you run the program
[6]Reboot your computer when installation is complete
 
WINDOWS NT users:
[4]Open the control panel
[5]Double click the network icon
[6]Select the services tab
[7]Click the add button
[8]Click the Have Disk button
[9]Browse to directory where Network Probe is installed, usually c:\program files\NetProbe\driver\winnt
[10]Click OK
[11]Close the network dialog box
[12]Reboot your computer

Linux users:
 Download Linux distribution at http://www.objectplanet.com/Probe/.
(The Windows distribution will work on Linux as well, but you'll manually have to copy the files to the Linux system).
Starting the network probe
  • The Network Probe server may be started from the Network Probe program menu, as well as from command line. Select a network card, if more than one card is found: (Or start the probe with a preselected card from the command line).

[Figure 1: Network Probe server]

Pressing CTRL-C quits Network Probe.
The very first time Network Probe is started, you'll be prompted to set a password for the "admin" user.

Starting the client
  • Connecting with a web browser to http://localhost:7030/ will load the user interface (disable proxies for local addresses in your browser first). Remote computers must replace 'localhost' with the IP address or host name of the computer where the probe is running. Log in with username "admin" and the password you set on startup.
User interface

[Figure 2: Network Probe client]

  • Connecting with a web browser to http://localhost:7030/ will load the user interface (disable proxies for local addresses in your browser first). Remote computers must replace 'localhost' with the IP address or host name of the computer where the probe is running. Log in with username "admin" and the password you set on startup.
  • The user interface displays which protocols are used, hosts active on your network, conversations on your network, which protocols are being used by each host and conversation, and the the activity for each network card and network card conversation.

  • Each tab can be detached into it's own top-level application window by right-clicking an active tab. This allows you to display several of the panels at the same time as well as resizing them individually.


  • The tables are refreshed every 20 seconds. Press F5 for immediate refresh (select a table first).


  • The menu is below the applet:


  • [Figure 3: Menu]


Probe setup
  • The probe can be started and stopped, with other available network cards as well.
  • Statistics entries can be turned on and off.
  • By default, the network probe will reset every day at midnight, but can be configured to reset at your preference.

  • Only admin and super users can access this.


[Figure 4: Probe Setup]
User setup
  • By default, only the admin user exists, but users can be added, modified and deleted.

  • Only admin and super users can access this. Super users cannot change admin's password.


[Figure 5: User Setup]
  • Users can be added as "normal user" or "super user". Super users can access everything. Normal users have restricted access, as defined when adding a new user:


[Figure 6: Add user]


Pop-up menus
  • Double clicking or right clicking a table entry will display a pop-up menu enabling you to display more details.



Sorting data
  • Click column header to sort data. Click again to sort in the opposite direction.


Filtering and searching data
  • The filter bar is located below the data rows:


    [Figure 7: Filtering and searching]

  • You can display selected protocols and hosts by selecting the desired row, then toggle the filter field by right-clicking it. This turns on the filter and displays only rows containing the text in the field.

  • You can use the filter field to search for rows by left-clicking the field and type in the text you want to find. This will find the first row containing the text you type.

  • You navigate the filter fields with home, end, left, right, backspace, and delete. Tab and Shift+Tab moves between the filter fields.

  • Filter syntax:
    filter display only strings containing the filter
    filter> or >filter display only strings larger than filter
    filter>= or >=filter display only strings larger than or equal to filter
    filter< or <filter display only strings smaller than filter
    filter<= or <=filter display only strings smaller than or equal to filter
    filter<> or <>filter display only strings not equal to filter
    [Table 1: Filter syntax]

Table descriptions

protocols
  • The protocol table contains statistics for all protocols discovered on this network segment. The protocol entries show the encapsulating protocol as well, such as TCP running on IP and IP running on ethernet.

hosts
  • Shows statistics for each host sending or receiving traffic on the network.

conversations
  • The internet conversations table shows all conversations between one host and another.

protocols per host
  • Shows all protocols used per host.

protocols per conversation
  • Shows all protocols used per conversation.

network cards
  • Counts total traffic on all network cards discovered on this segment.

network conversations
  • Shows statistics for conversations among network cards on the network segment.

Command line options

  • You can manually start the probe from command line:
    java -classpath Probe.jar com.objectplanet.probe.server.Probe

    Options:
    -r [FILE] 1000 record 1000 frames to a file and stop
    -p [FILE] read data from a file and stop
    -pl [FILE] loop through the file reading traffic
    -port [PORT_NUMBER] set port to listen on (default is 7030)
    -card [CARD_NUMBER] network card number to use
    -nostart starts the probe, but not the data collection
    -count [host,matrix,nlhost,
    nlmatrix,alhost,almatrix,protocol]
    the probe will only count the specified data tables, in order to reduce memory consumption
Troubleshooting

  • SERVER
    • On 2000 and NT you must be logged in with administrator rights to run the probe server
    • Also make sure you've rebooted your computer after installing the packet driver.
    • A few NIC's (Network Interface Cards) don't support promiscuous mode. This means you won't be able to collect frames which destinate to other mac addresses than your own.
  • CLIENT
    • Your browser must support Java 1.1.8 or higher (have a JVM - Java Virtual Machine - installed).
    • If your browser is using proxies, you must bypass proxy server for local addresses, if you will access the host from the same machine as the probe server runs on. For Internet Explorer, choose 'Tools->Internet options->Connections->LAN settings->Bypass proxy server for local addresses'
    • Click on the chart or push the F5 key if the charts are unproperly rendered.
Feel free to contact us at probe@objectplanet.com


© 2002 ObjectPlanet, Inc., Rosenkrantzgate 20, 0160 Oslo, Norway
Tel (+47) 2233 3360 | Fax (+47) 2233 3361 | probe@objectplanet.com