Visual Networks' Uptime Select

UpTime classifies its probes by domain, network, site and WAN access line. This hierarchy puts site performance and event impact in context, and makes viewing performance data more manageable by improving navigation.

Probing Network Problems

The probes sit passively inline or on a switch span port. UpTime comes with numerous probes supporting many means of WAN access, including ATM, E1, Ethernet, frame relay, HDLC, PPP and T1. I tested the 10/100 Ethernet set.

When connected on Ethernet to a span port, an ASE must support bidirectional communications. At first I found this odd, as probes usually offer a second management interface. But unlike most probes, which are implemented in LANs where bandwidth and connectivity are cheap, the ASE is designed to sit at the expensive edge of WAN traffic and leave as small a footprint as possible.

I tested inline on an Ethernet segment leading to a WAN connection. UpTime has two low-speed 10/100 Ethernet probes: One can handle up to 3 Mbps of data; the other, which I tested, can suck up up to 20 Mbps. If you're scratching your noggin wondering why a 10/100-Mb ASE can ramp up to only 20 percent of the maximum, bear in mind that WAN speeds for branch offices usually run less than 1.54 Mbps.

The first thing I noticed about the 10/100 ASE was the lack of the usual half-the-size-of-a-Vermont-brick transformer. In fact, the transformer is built into the probe. Setup requires the usual serial cable plug-in, adding IP, SNMP Community and router.

For inline installs, WAN connectivity is supposed to continue even if the ASE fails. When I powered off the ASE, no packets were lost. However, when I rebooted--a 10-second process--two to 10 pings failed.

User administration supports access control by limiting each user's capabilities to predefined functions like reporting, traffic capture and event management. Sadly, there isn't group- or role-based access. Password and account management includes useful features like aging, expiration and the requirement for nonsimple/text-only passwords.

The probe can monitor up to 10 applications using TCP/IP ports and QoS (quality of service). This setup let me choose from a list of predefined, well-known TCP and UDP ports. Additionally, user ports can be custom-defined.

The server also supports monitoring of DiffServ. By default, the first three services are downloaded from the probe and named Gold, Silver and Bronze, but you can rename them.Comprehensive Reports

Although the ASE collects usage information on all the traffic it sees, it will report on only 10 TCP and UDP ports. For my tests, I let the ASE run a few days and then looked at the usage percentages to choose the applications most used. During testing, I got to look at more than 98 percent of all traffic running over our WAN connection.

One reason for limiting data collection from the TCP/UDP ports is that such collection can be periodic. Again, this reflects the WAN implementation of the ASE probes, which are designed to collect and store data for as long as several days if necessary. This not only reduces WAN bandwidth used to communicate between the ASE and server, it also helps make the entire UpTime application resilient to WAN outages. Each ASE can store data for about a day for lower-use links. Limiting data collection to what matters improves this offline time.

View From the Top

The view from my ASE of applications running over our WAN connection was useful. I could see the chosen applications' actual usage on a daily basis, and how that usage related to our normal baseline usage. I was also able to look at application flows between hosts, in real time, and historical hunks in 15-minute, one-hour or one-day increments. This history was available the entire week I tested.Packet capture supports triggers, filters and varied buffer sizes. Decodes are only through Layer 4, but preconfigured filters work at Layers 3, 4 and 5. Although there are no application layer decodes, hex and ASCII are displayed. Export as a CAP file is supported to load the capture into another, more capable protocol analyzer.

A separate Java application is part of UpTime to create reports. This Planning and Reporting application works as a report scheduler, providing information on usage and service by way of a few dozen predefined reports. The scheduling outputs HTML or CSV to a directory, or will FTP automated updates daily, weekly or monthly as defined by the user. Many of the reports relate to WAN circuit usage, but some also monitored IP traffic via Ethernet in my testing. A good example of the granularity of the data was the Burst Advisor, which reports utilization over time, and then recommends increasing, decreasing or maintaining circuit bandwidth.

This version of UpTime can give your network engineers a deeper understanding of how valuable WAN access is being used. It can also offer them a lightweight tool for communicating WAN usage to management.

Bruce Boardman, executive editor of Network Computing, tests and writes about network and systems management. Write to him at [email protected].