SOFTWARE REQUIRED VAX/VMS version V5.1+. AVAILABILITY For executables only, FTP to the ANONYMOUS account (password GUEST) on CCC.NMFECC.GOV and GET the follow- ing files: [ANONYMOUS.PROGRAMS.ENTM]ENTM.DOC (ASCII text) [ANONYMOUS.PROGRAMS.ENTM]ENTM.EXE (binary) [ANONYMOUS.PROGRAMS.ENTM]EN_TYPES.DAT (ASCII text) [ANONYMOUS.PROGRAMS.ENTM]IP_TYPES.DAT (ASCII text)
NAME etherfind KEYWORDS traffic; ethernet, IP, NFS; eavesdrop; UNIX. ABSTRACT Etherfind examines the packets that traverse a network interface, and outputs a text file describing the traffic. In the file, a single line of text describes a single packet: it contains values such as protocol type, length, source, and destination. Etherfind can print out all packet traffic on the ethernet, or traffic for the local host. Further packet filtering can be done on the basis of protocol: IP, ARP, RARP, ICMP, UDP, ND, TCP, and filtering can also be done based on the source, destination addresses as well as TCP and UDP port numbers. MECHANISM In usual operations, and by default, etherfind puts the interface in promiscuous mode. In 4.3BSD UNIX and related OSs, it uses a Network Interface Tap (NIT) to obtain a copy of traffic on an ethernet interface. CAVEATS None. BUGS None known. LIMITATIONS Minimal protocol information is printed. Can only be run by the super user. The syntax is painful. HARDWARE REQUIRED Ethernet. SOFTWARE REQUIRED SunOS. AVAILABILITY Executable included in Sun OS "Networking Tools and Programs" software installation option.
NAME etherhostprobe KEYWORDS map, routing; ethernet, IP; ping; UNIX; free. ABSTRACT Output list of hosts on an ethernet that respond to IP ARP. Produces a list in the following format: 08:00:20:01:96:62 18.104.22.168 apptek4 08:00:20:00:02:fe 22.214.171.124 apptek5 08:00:20:00:57:6a 126.96.36.199 apptek6 08:00:20:00:65:34 188.8.131.52 apptek7 08:00:20:06:58:6f 184.108.40.206 apptek8 08:00:20:00:03:4f 220.127.116.11 apptek9 The first column is the ethernet address, the second the IP address, and the third is the hostname (which is omitted if the name could not be found via gethost- byaddr). A starting and ending IP address may be specified on the command line, which will limit the search. MECHANISM Etherhostprobe sends a UDP packet to the ``echo'' port, then looks in the kernel's ARP cache for the corresponding address entry. Explicit response (or lack of same) to the UDP packet is ignored. The cache will be checked up to four times at one-quarter-second intervals. Note that this allows the program to be run by a user with no special privileges. CAVEATS Etherhostprobe will fill the kernel's ARP cache with possibly useless entries, possibly causing delays to programs foolishly attempting to accomplish real work. Etherhostprobe causes -lots- of ARPs to be generated, possibly fooling network monitoring software (or peo- ple) into concluding that something is horribly broken. Etherhostprobe spends up to one second looking for each possible address. Thus, exhaustively searching a class-C network will take about four minutes, and exhaustively searching a class-B network will take about 18 hours. Exhaustively searching a class-A net- work will take the better part of a year, so don't even
think about it. Etherhostprobe will be fooled by gateways that imple- ment proxy ARP; every possible address on the proxy- ARPed subnet will be listed with the gateway's ethernet address. BUGS None known. LIMITATIONS If a given machine is not running IP ARP at the time that it is probed, it will be considered nonexistent. In particular, if a given machine is down at the time that it is probed . . . All hosts being probed must be on the same (possibly bridged) ethernet. HARDWARE REQUIRED No restrictions, but see below. SOFTWARE REQUIRED Runs on SunOS 3.5, and possibly elsewhere. The major non-standard portion of code is ``tx_arp.c'', which reads the kernel's ARP cache. AVAILABILITY Copyrighted, but freely distributed. Available via anonymous FTP from spam.itstd.sri.com (18.104.22.168). From pub directory, file EHP.1 for etherhostprobe, and files IPF.1 and IPF.2 for ipForwarding.
NAME EtherMeter (tm), model LANB/150 KEYWORDS alarm, map, traffic; ethernet; NMS, proprietary; stan- dalone. ABSTRACT The Network Applications Technology (NAT) EtherMeter product is a dedicated ethernet traffic monitor that provides statistics on the ethernet segment to which it is attached. The EtherMeter reports three major kinds of statistics. For good packets, it reports the total number of good packets seen on the segment, the number of multicast and broadcast packets, and the total number of bytes in all packets seen. For packets with errors, it reports the number of CRC errors, short packets, oversize packets, and alignment errors. It also reports the distribution of packet by type, and the number of protocols seen on the segment. A count of transmit collisions is reported. Peak and current ethernet utilization rates are also reported, etc. Alarms can be set for utilization rate, packet rate, total error count, and delta error. The EtherMeter reports the statistics to a Network Management Station (NMS), also available from NAT, via IP/UDP datagrams, so that the meters can be monitored through routers. The NMS displays graphical and/or textual information, and EtherMeter icons turn colors to indicate status. Alarms can be set, and if the lev- els are exceeded an audible alarm is generated on the NMS, and the EtherMeter icon changes from green to yel- low on the network map. MECHANISM The EtherMeter is a self-contained board that can either be plugged into a PC/AT bus for power or installed in a small stand-alone enclosure. The board can be obtained with either a 10BASE5 thick ethernet transceiver cable connector, or a 10BASE2 thin ethernet BNC connector. CAVEATS The EtherMeter is primarily a passive device whose only impact on the network will come from the monitoring packets sent to the NMS. The EtherMeter is assigned an IP address for communication with the NMS.
BUGS None known. LIMITATIONS Proprietary protocol currently in use. The company has stated its intention to develop SNMP for the EtherMeter product in the first half of 1990. Currently the NMS does not keep log files. This limitation is ack- nowledged, and plans are underway to add ASCII log file capability to the NMS. HARDWARE REQUIRED An EtherMeter board and a PC/AT bus to plug it into, or a stand-alone enclosure with power supply (available from NAT). A Network Management Station and its software is required as well, to fully interact with the EtherMeter devices. SOFTWARE REQUIRED The EtherMeter software is included in ROM on the dev- ice. The NMS software is bundled in with the NMS hardware. AVAILABILITY The EtherMeter device, stand-alone enclosure, and Net- work Management Station, are available commercially from: Network Application Technology, Inc. 21040 Homestead Road Cupertino, California 95014 Phone: (408) 733-4530 Fax: (408) 733-6478
NAME EtherView(tm) KEYWORDS traffic; ethernet, IP, NFS; eavesdrop; UNIX. ABSTRACT EtherView is a network monitoring tool which runs on Sun workstations and allows you to monitor your hetero- geneous internet network. It monitors all systems on the ethernet. It has three primary functions: Load Profile: It allows users to monitor the load on the ethernet over extended periods of time. The net- work administrator can use it to characterize load gen- erated by a node on the network, determine which sys- tems and applications generate how much of the load and how that load fluctuates over long periods of time. NFS Profile: It allows the network administrator to determine the load on NFS servers, the average response time NFS servers and the mix of NFS load on each of the servers. Users can use the data to benchmark different NFS servers, determine which servers are overloaded, deduce the number of clients that each server can sup- port and evaluate the effectiveness of NFS accelera- tors. Protocol Analyzer: Users can capture packets based on source, destination, application, protocol, bit pat- tern, packet size or a boolean filtering expression. It provides all standard features such as configurable buffer size, packet slicing and bit pattern based triggering criterion. It does automatic disassembly of NFS, TCP, UDP, IP, ICMP, ARP and RARP packets. Packets can be examined in any combination of summary, hex or detail format. MECHANISM EtherView uses the Sun's NIT interface to turn the eth- ernet interface into promiscuous mode to capture pack- ets. A high level process manages the interface and a low level process does the actual capturing and filter- ing. Shared memory is used to communicate between the two processes. BUGS None known.
LIMITATIONS Because of limitations in Sun's NIT interface, Ether- View will not capture packets originating from the sys- tem where it is run. EtherView requires super-user privileges on the system where it is run. HARDWARE REQUIRED EtherView runs on all models of Sun-3, Sun-4 and Sun- 386i. SOFTWARE REQUIRED Sun-3 - SunOS 4.0.3. (SunOS 4.0 with NIT fixes). Sun-4 - SunOS 4.0. Sun-386i - SunOS 4.0. Runs under SunView. Will run under X Windows in future. AVAILABILITY EtherView is copyrighted, commercial product of: Matrix Computer Systems, Inc. 7 1/2 Harris Road Nashua, NH 03062 Tel: (603) 888-7790 email: ...uunet!matrix!eview
NAME getone, getmany, getroute, getarp, getaddr, getif, getid. KEYWORDS manager, routing, status; IP; NMS, SNMP; UNIX. ABSTRACT These commands retrieve and format for display values of one or several MIB variables (RFC1066) using the SNMP (RFC1098). Getone and getmany retrieve arbitrary MIB variables; getroute, getarp, getaddr, and getif retrieve and display tabular information (routing tables, ARP table, interface configuration, etc.), and getid retrieves and displays system name, identifica- tion and boot time. Getone <target> <mibvariable> retrieves and displays the value of the designated MIB variable from the specified target system. The SNMP community name to be used for the retrieval can also be specified. Getmany works similarly for groups of MIB variables rather than individual values. The name of each variable, its value and its data type is displayed. Getroute returns information from the ipRoutingTable MIB structure, displaying the retrieved information in an accessible format. Getarp behaves similarly for the address translation table; getaddr for the ipAddressTable; and getif displays information from the interfaces table, supplemented with information from the ipAddressTable. Getid displays the system name, identification, ipFor- warding state, and the boot time and date. All take a system name or IP address as an argument and can specify an SNMP community for the retrieval. One SNMP query is performed for each row of the table. MECHANISM Queries SNMP agent(s). CAVEATS None. BUGS None known. LIMITATIONS None reported.
HARDWARE REQUIRED Distributed and supported for Sun 3 systems. SOFTWARE REQUIRED Distributed and supported for SunOS 3.5 and 4.x. AVAILABILITY Commercial product of: Wellfleet Communications, Inc. 12 DeAngelo Drive Bedford, MA 01730-2204 (617) 275-2400
NAME hammer & anvil KEYWORDS benchmark, generator; IP; DOS; free. ABSTRACT Hammer and anvil are the benchmarking programs for IP routers. Using these tools, gateways have been tested for per-packet delay, router-generated traffic over- head, maximum sustained throughput, etc. MECHANISM Tests are performed on a gateway in an isolated testbed. Hammer generates packets at controlled rates. It can set the length and interpacket interval of a packet stream. Anvil counts packet arrivals. CAVEATS Hammer should not be run on a live network. BUGS None reported. LIMITATIONS Early versions of hammer could not produce inter-packet intervals shorter than 55 usec. HARDWARE REQUIRED Hammer runs on a PC/AT or compatible, and anvil requires a PC or clone. Both use a Micom Interlan NI5210 for LAN interface. SOFTWARE REQUIRED MS-DOS. AVAILABILITY Hammer and anvil are copyrighted, though free. Copies are available from pub/eutil on husc6.harvard.edu.
NAME hopcheck KEYWORDS routing; IP; ping; DOS; free. ABSTRACT Hopcheck is a tool that lists the gateways traversed by packets sent from the hopcheck-resident PC to a desti- nation. Hopcheck uses the same mechanism as traceroute but is for use on IBM PC compatibles that have ethernet connections. Hopcheck is part of a larger TCP/IP pack- age that is known as ka9q that is for use with packet radio. Ka9q can coexist on a PC with other TCP/IP packages such as FTP Inc's PC/TCP, but must be used independently of other packages. Ka9q was written by Phil Karn. Hopcheck was added by Katie Stevens, email@example.com. Unlike traceroute, which requires a UNIX kernel mod, hopcheck will run on the standard, unmodified ka9q release. MECHANISM See the description in traceroute. CAVEATS See the description in traceroute. BUGS None known. LIMITATIONS Host table required. Does not work with domain name server or with IP address as the argument. This is mainly an inconvenience. HARDWARE REQUIRED IBM PC compatible with ethernet network interface card, though does not work with 3Com 505 board. SOFTWARE REQUIRED DOS.
AVAILABILITY Free. On deposit at the National Center for Atmospher- ic Research. For access from UNIX, available via anonymous FTP from windom.ucar.edu, in directory "etc," as hopcheck.tar.Z. For access directly from a PC, fetch nethop.exe and readme.hop; nethop.exe is execut- able. Also available via anonymous FTP at ucdavis.edu, in the nethopexe or nethopsrc suite of files in direc- tory "dist."
NAME HyperMIB KEYWORDS reference; Macintosh; free, sourcelib. ABSTRACT HyperMIB is a hypertext presentation of the MIB (RFC1066). The tree structure of the MIB is presented graphically, and the user traverses the tree by select- ing branches of the tree. When the MIB variables are displayed, selecting them causes a text window to appear and show the definition of that variable (using the actual text of the MIB document). MECHANISM The Apple Macintosh HyperCard utility is used. The actual text of the MIB document is read into scrollable text windows, and a string search is done on the vari- able selected. A person familiar with HyperCard pro- gramming could modify the program to suit their needs (such as to add the definitions for their company's private space). CAVEATS None. BUGS None known. LIMITATIONS This program only gives the definition of the MIB vari- ables. It cannot poll a node to find the value of the variables. HARDWARE REQUIRED Apple Macintosh computer with at least 1MByte of RAM. SOFTWARE REQUIRED Apple Macintosh operating system and HyperCard. AVAILABILITY This software may be copied and given away without charge. The files are available by anonymous FTP on CCC.NMFECC.GOV. The files are: [Anonymous.programs.HyperMIB]Hyper_MIB.help (ASCII text) [Anonymous.programs.HyperMIB]Hyper.MIB (binary)
[Anonymous.programs.HyperMIB]MIB.tree (binary) The software is also available for a nominal fee from: National Energy Software Center Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (312) 972-7250
NAME Internet Rover KEYWORDS status; IP, SMTP; curses, ping, spoof; UNIX; free, sourcelib. ABSTRACT Internet Rover is a prototype network monitor that uses multiple protocol "modules" to test network functional- ity. This package consists of two primary pieces of code: the data collector and the problem display. There is one data collector that performs a series of network tests, and maintains a list of problems with the network. There can be many display processes all displaying the current list of problems which is useful in a multi-operator NOC. The display task uses curses, allowing many terminal types to display the problem file either locally or from a remote site. Full source is provided. The data collector is easily configured and extensible. Contri- butions such as additional protocol modules, and shell script extensions are welcome. MECHANISM A configuration file contains a list of nodes, addresses, NodeUp? protocol test (ping in most cases), and a list of further tests to be performed if the node is in fact up. Modules are included to test TELNET, FTP, and SMTP. If the configuration contains a test that isn't recognized, a generic test is assumed, and a filename is checked for existence. This way users can create scripts that create a file if there is a prob- lem, and the data collector simply checks the existence of that file to determine if there is problem. CAVEATS None. BUGS None known.
LIMITATIONS This tools does not yet have the capability to perform actions based on the result of the test. Rather, it is intended for a multi-operator environment, and simply displays a list of what is wrong with the net. HARDWARE REQUIRED This software is known to run on Suns and IBM RTs. SOFTWARE REQUIRED Curses, 4.xBSD UNIX socket programming libraries, BSD ping. AVAILABILITY Full source available via anonymous FTP from merit.edu (22.214.171.124) in the ~ftp/pub/inetrover directory. Source and executables are public domain and can be freely distributed for non-commercial use. This pack- age is unsupported, but bug reports and fixes may be sent to: firstname.lastname@example.org.
NAME LAN Patrol KEYWORDS security, traffic; ethernet, star; eavesdrop; DOS. ABSTRACT LAN Patrol is a full-featured network analyzer that provides essential information for effective fault and performance management. It allows network managers to easily monitor user activity, find traffic overloads, plan for growth, test cable, uncover intruders, balance network services, and so on. LAN Patrol uses state of the art data collection techniques to monitor all activity on a network, giving an accurate picture of how it is performing. LAN Patrol's reports can be saved as ASCII files to disk, and imported into spreadsheet or database pro- grams for further analysis. MECHANISM The LAN Patrol interface driver programs a standard interface card to capture all traffic on a network seg- ment. The driver operates from the background of a standard PC, maintaining statistics for each station on the network. The information can be viewed on the PC's screen, or as a user-defined report output either to file or printer. CAVEATS None. Normal operation is completely passive, making LAN Patrol transparent to the network. BUGS None known. LIMITATIONS LAN Patrol can monitor up to 10,000 packets/sec on an AT class PC, and is limited to monitoring a maximum of 1024 stations for intervals of up to 30 days. Because LAN Patrol operates at the physical level, it will only see traffic for the segment on which it is installed; it cannot see traffic across bridges.
HARDWARE REQUIRED Computer: IBM PC/XT/AT, PS/2 Model 30, or compatible. Requires 512K memory and a hard drive or double-sided disk drive. Display: Color or monochrome text. Color display allows color-coding of traffic information. Ethernet, StarLAN, LattisNet, or StarLAN 10 network interface card. SOFTWARE REQUIRED PC DOS, MS-DOS version 3.1 or greater. AVAILABILITY LAN Patrol many be purchased through network dealers, or directly from: Legend Software, Inc. Phone: (201) 227-8771 FAX: (201) 906-1151
NAME LanProbe -- the HP 4990S LanProbe Distributed Analysis System. KEYWORDS alarm, manager, map, status, traffic; ethernet; eaves- drop, NMS; proprietary. ABSTRACT The LanProbe distributed monitoring system performs remote and local monitoring of ethernet LANs in a pro- tocol and vendor independent manner. LanProbe discovers each active node on a segment and displays it on a map with its adapter card vendor name, ethernet address, and IP address. Additional informa- tion about the nodes, such as equipment type and physi- cal location can be entered in to the data base by the user. When the NodeLocator option is used, data on the actual location of nodes is automatically entered and the map becomes an accurate representation of the physical lay- out of the segment. Thereafter when a new node is installed and becomes active, or when a node is moved or becomes inactive, the change is detected and shown on the map in real time. The system also provides the network manager with precise cable fault information displayed on the map. Traffic statistics are gathered and displayed and can be exported in (comma delimited) CSV format for further analysis. Alerts can be set on user defined thres- holds. Trace provides a remote protocol analyzer capability with decodes for common protocols. Significant events (like power failure, cable breaks, new node on network, broadcast IP source address seen, etc.) are tracked in a log that is uploaded to Pro- beView periodically. ProbeView generates reports that can be manipulated by MSDOS based word processors, spreadsheets, and DBMS.
MECHANISM The system consists of one or more LanProbe segment monitors and ProbeView software running under Microsoft Windows. The LanProbe segment monitor attaches to the end of an ethernet segment and monitors all traffic. Attachment can be direct to a thin or thick coax cable, or via an external transceiver to fiber optic or twist- ed pair cabling. Network data relating to the segment is transferred to a workstation running ProbeView via RS-232, ethernet, or a modem connection. ProbeView software, which runs on a PC/AT class works- tation, presents network information in graphical displays. The HP4992A NodeLocator option attaches to the opposite end of the cable from the HP4991A LanProbe segment mon- itor. It automatically locates the position of nodes on the ethernet networks using coaxial cabling schemes. CAVEATS None. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED HP 4991A LanProbe segment monitor HP 4992A NodeLocator (for optional capabilities) 80386 based PC capable of running MS-Windows SOFTWARE REQUIRED HP 4990A ProbeView MSDOS 3.0 or higher and Microsoft Windows/286 2.1. AVAILABILITY A commercial product available from: Hewlett-Packard Company P.O. Box 10301, Palo Alto, CA 94303-0890
NAME LANWatch KEYWORDS alarm, analyzer, traffic; CHAOS, DECnet, DNS, ethernet, IP, OSI, ring, SMTP, star; eavesdrop; DOS; library, sourcelib. ABSTRACT LANWatch 2.0 is an inexpensive, powerful and flexible network analyzer that runs under DOS on personal com- puters and requires no hardware modifications to either the host or the network. LANWatch is an invaluable tool for installing, troubleshooting, and monitoring local area networks, and for developing and debugging new protocols. Network managers using LANWatch can inspect network traffic patterns and packet errors to isolate performance problems and bottlenecks. Protocol developers can use LANWatch to inspect and verify proper protocol handling. Since LANWatch is a software-only package which installs easily in existing PCs, network technicians and field service engineers can carry LANWatch in their briefcase for convenient network analysis at remote sites. LANWatch has two operating modes: Display and Examine. In Display Mode, LANWatch traces network traffic by displaying captured packets in real time. Examine Mode allows you to scroll back through stored packets to inspect them in detail. To select a subset of packets for display, storage or retrieval, there is an exten- sive set of built-in filters. Using filters, LANWatch collects only packets of interest, saving the user from having to sort through all network traffic to isolate specific packets. The built-in filters include alarm, trigger, capture, load, save and search. They can be controlled separately to match on source or destination address, protocol, or packet contents at the hardware and transport layers. LANWatch also includes suffi- cient source code so users can modify the existing filters and parsers or add new ones. The LANWatch distribution includes executables and source for several post-processors: a TCP protocol analyzer, a node-by-node traffic analyzer and a dump file listing tool. MECHANISM
Uses many common PC network interfaces by placing them in promiscuous mode and capturing traffic. CAVEATS Most PC network interfaces will not capture 100% of the traffic on a fully-loaded network (primarily missing back-to-back packets). BUGS None known. LIMITATIONS LANWatch can't analyze what it doesn't see (see Caveats). HARDWARE REQUIRED LANWatch requires a PC or PS/2 with a supported network interface card. SOFTWARE REQUIRED LANWatch runs in DOS. Modification of the supplied source code or creation of additional filters and parsers requires Microsoft C 5.1 AVAILABILITY LANWatch is commercially available from FTP Software, Incorporated, 26 Princess Street, Wakefield, MA, 01880 (617 246-0900).
NAME map -- Interactive Network Map KEYWORDS manager, map; CHAOS, ethernet, IP, ring, star; NMS, ping, SNMP, X; UNIX; free, sourcelib. ABSTRACT Map draws a map of network connectivity and allows interactive examination of information about various components including whether hosts can be reached over the network. The program is supplied with complete source and is written in a modular fashion to make addition of dif- ferent protocols stacks, displays, or hardcopy devices relatively easy. This is one of the reasons why the initial version supports at least two of each. Contri- butions of additional drivers in any of these areas will be welcome as well as porting to additional plat- forms. MECHANISM Net components are pinged by use of ICMP echo and, optionally, CHAOS status requests and SNMP "gets." The program initializes itself from static data stored in the file system and therefore does not need to access the network in order to get running (unless the static files are network mounted). CAVEATS As of publication, the tool is in beta release. BUGS Several minor nits, documented in distribution files. Bug discoveries should be reported by email to Bug- Map@LCS.MIT.Edu. LIMITATIONS See distribution file for an indepth discussion of sys- tem capabilities and potential. HARDWARE REQUIRED An X display is needed for interactive display of the map, non-graphical interaction is available in non- display mode. For hardcopy output a PostScript or Tek- tronix 4692 printer is required.
SOFTWARE REQUIRED BSD UNIX or related OS. IP/ICMP is required; CHAOS/STATUS and SNMP can be used but are optional. X-Windows is required for interactive display of the map. AVAILABILITY As of publication, map is in beta release. To be added to the email forum that discusses the software, or to obtain individual files or instructions on getting the full current release, send a request to: MAP-Request@LCS.MIT.Edu. The program is Copyright MIT. It is available via anonymous FTP with a license making it free to use and distribute for non-commercial purposes.
NAME mconnect KEYWORDS status; SMTP; spoof; UNIX. ABSTRACT Mconnect allows an interactive session with a remote mailer. Mail delivery problems can be diagnosed by connecting to the remote mailer and issuing SMTP com- mands directly. MECHANISM Opens a TCP connection to remote SMTP on port 25. Pro- vides local line buffering and editing, which is the distinction between mconnect and a TELNET to port 25. CAVEATS None. BUGS None known. LIMITATIONS Mconnect is not a large improvement over using a TELNET connection to port 25. HARDWARE REQUIRED No restrictions. SOFTWARE REQUIRED BSD UNIX or related OS. AVAILABILITY Available with 4.xBSD UNIX and related operating sys- tems.
NAME Netlabs CMOT Agent KEYWORDS manager, status; IP, OSI; NMS. ABSTRACT Netlabs' CMOT code debuted in Interop 89. The CMOT code comes with an Extensible MIB, which allows users to add new MIB variables. The code currently supports all the MIB variables in RFC 1095 via the data types in RFC 1065, as well as the emerging MIB-II, which is currently in experimental stage. The CMOT has been benchmarked at 100 Management Operations per Second (MOPS) for a 1-MIPS machine. MECHANISM The Netlabs CMOT agent supports the control and moni- toring of network resources by use of CMOT message exchanges. CAVEATS None. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED Portable to most hardware. SOFTWARE REQUIRED Portable to most operating systems. AVAILABILITY Commercially available from: Netlabs Inc 11693 Chenault Street Ste 348 Los Angeles CA 90049 (213) 476-4070 email@example.com (Anne Lam)
NAME Netlabs SNMP Agent. KEYWORDS manager, status; IP; NMS, SNMP. ABSTRACT Netlabs' SNMP code debuted in Interop 89, where it showed interoperation of the code with several imple- mentations on the show floor. The SNMP code comes with an Extensible MIB, which allows users to add new MIB variables. The code currently supports all the MIB variables in RFC 1066 via the data types in RFC 1065, as well as the emerging MIB-II, which is currently in experimental stage. The SNMP has been benchmarked at 200 Management Operations per Second (MOPS) for a 1- MIPS machine. MECHANISM The Netlabs SNMP agent supports the control and moni- toring of network resources by use of SNMP message exchanges. CAVEATS None. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED Portable to most hardware. SOFTWARE REQUIRED Portable to most operating systems. AVAILABILITY Commercially available from: Netlabs Inc 11693 Chenault Street Ste 348 Los Angeles CA 90049 (213) 476-4070 firstname.lastname@example.org (Anne Lam)
NAME netmon KEYWORDS status; DNS, IP; ping; DOS; free. ABSTRACT Netmon is a DOS-based program that pings hosts on a monitored list at user-specified intervals. In addi- tion, a user may optionally ping hosts not on the list. Netmon also performs domain lookups. Furthermore, a user may build and send a domain query to any desired DNS server. MECHANISM The tool works by using the echo service feature of ICMP. It reports if it receives an incorrect response or no response. CAVEATS Depending on the frequency of pinging and the number of hosts pinged, netmon could create a high volume of traffic. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED A PC, and a Western Digital WD8003 interface card (or any other card for which there is a packet driver for FTP Software Inc.'s PC/TCP kernel). Both monochrome and color displays are supported, though color is recommended. SOFTWARE REQUIRED DOS operating system, and the PC/TCP Kernel by FTP Software, Inc. AVAILABILITY The BYU modified version is available for anonymous FTP from Dcsprod.byu.edu, in directory "programs." It can be freely distributed for non-commercial use.
NAME NETMON and iptrace KEYWORDS traffic; IP; eavesdrop; UNIX; free. ABSTRACT NETMON is a facility to enable communication of net- working events from the BSD UNIX operating system to a user-level network monitoring or management program. Iptrace is a program interfacing to NETMON which logs TCP-IP traffic for performance measurement and gateway monitoring. It is easy to build other NETMON-based tools using iptrace as a model. NETMON resides in the 4.3BSD UNIX kernel. It is independent of hardware-specific code in UNIX. It is transparent to protocol and network type, having no internal assumptions about the network protocols being recorded. It is installed in BSD-like kernels by adding a standard function call (probe) to a few points in the input and output routines of the protocols to be logged. NETMON is analogous to Sun Microsystems' NIT, but the interface tap function is extended by recording more context information. Aside from the timestamp, the choice of information recorded is up to the installer of the probes. The NETMON probes added to the BSD IP code supplied with the distribution include as context: input and output queue lengths, identification of the network interface, and event codes labeling packet dis- cards. (The NETMON distribution is geared towards measuring the performance of BSD networking protocols in an IP gateway). NETMON is designed so that it can reside within the monitored system with minimal interference to the net- work processing. The estimated and measured overhead is around five percent of packet processing. The user-level tool "iptrace" is provided with NETMON. This program logs IP traffic, either at IP-level only, or as it passes through the network interface drivers as well. As a separate function, iptrace produces a host traffic matrix output. Its third type of output is abbreviated sampling, in which only a pre-set number of packets from each new host pair is logged. The
three output types are configured dynamically, in any combination. OSITRACE, another logging tool with a NETMON interface, is available separately (and documented in a separate entry in this catalog). MECHANISM Access to the information logged by NETMON is through a UNIX special file, /dev/netmon. User reads are blocked until the buffer reaches a configurable level of full- ness. Several other parameters of NETMON can be tuned at com- pile time. A diagnostic program, netmonstat, is included in the distribution. CAVEATS None. BUGS Bug reports and questions should be addressed to: email@example.com Requests to join this mailing list: firstname.lastname@example.org Questions and suggestions can also be directed to: Allison Mankin (703)883-7907 email@example.com LIMITATIONS A NETMON interface for tcpdump and other UNIX protocol analyzers is not included, but it is simple to write. NETMON probes for a promiscuous ethernet interface are similarly not included. HARDWARE REQUIRED No restrictions. SOFTWARE REQUIRED BSD UNIX-like network protocols or the ability to install the BSD publicly available network protocols in the system to be monitored.
AVAILABILITY The NETMON distribution is available by anonymous FTP in pub/netmon.tar or pub/netmon.tar.Z from aelred- 3.ie.org. A short user's and installation guide, NETMON.doc, is available in the same location. The NETMON distribution is provided "as is" and requires retention of a copyright text in code derived from it. It is copyrighted by the MITRE-Washington Networking Center.
NAME NETMON -- an SNMP-based network management tool from SNMP Research. KEYWORDS alarm, control, manager, map, routing; DECnet, ether- net, IP, OSI, ring, star; NMS, SNMP; DOS; sourcelib. ABSTRACT The NETMON application implements a network management station based on a low-cost DOS-based platform. It can be successfully used with many types of networks, including both wide area networks and those based on various LAN media. NETMON has been used with multipro- tocol devices including those which support TCP/IP, DECnet, and OSI protocols. The fault management tool displays the map of the network configuration with current node and link state indicated in one of several colors. Alarms may be enabled to alert the operator of events occurring in the network. Events are logged to disk. The NETMON application comes complete with source code including a powerful set of portable libraries for generating and parsing SNMP messages. Output data from NETMON may be transferred via flat files for additional report generation by a variety of statistical packages. MECHANISM The NETMON application is based on the Simple Network Management Protocol (SNMP). Polling is performed via the powerful SNMP get-next operator and the SNMP get operator. Trap directed polling is used to regulate the focus and intensity of the polling. CAVEATS None. BUGS None known. LIMITATIONS The monitored and managed nodes must implement the SNMP over UDP per RFC 1098 or must be reachable via a proxy agent. HARDWARE REQUIRED The minimum system is a IBM Personal Computer (4.77 MHz) with DOS 3.0 or later, an Enhanced Graphics
Adapter, Enhanced Graphics Monitor, a single 360 Kbyte floppy drive, and an ethernet adapter. However, most users will find a hard disk to be helpful for storing network history and will be less impatient with a fas- ter CPU. SOFTWARE REQUIRED DOS 3.0 or later and TCP/IP software from one of several sources. AVAILABILITY This is a commercial product available under license from: SNMP Research P.O. Box 8593 Knoxville, TN 37996-4800 (615) 573-1434 (Voice) (615) 573-9197 (FAX) Attn: Dr. Jeff Case
NAME netstat KEYWORDS routing; IP; UNIX, VMS; free. ABSTRACT Netstat is a program that accesses network related data structures within the kernel, then provides an ASCII format at the terminal. Netstat can provide reports on the routing table, TCP connections, TCP and UDP "listens", and protocol memory management. MECHANISM Netstat accesses operating system memory to read the kernel routing tables. CAVEATS Kernel data structures can change while netstat is run- ning. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED No restrictions. SOFTWARE REQUIRED BSD UNIX or related OS, or VMS. AVAILABILITY Available via anonymous FTP from uunet.uu.net, in directory bsd-sources/src/ucb. Available with 4.xBSD UNIX and related operating systems. For VMS, available as part of TGV MultiNet IP software package, as well as Wollongong's WIN/TCP.
NAME netwatch KEYWORDS traffic; ethernet, IP, ring; eavesdrop; DOS; free. ABSTRACT PC/netwatch listens to an attached local broadcast net- work and displays one line of information for every packet that goes by. This information consists of the "to" and "from" local network addresses, the packet length, the value of the protocol type field, and 8 selected contiguous bytes of the packet contents. While netwatch is running it will respond to commands to display collected information, change its operating mode, or to filter for specific types of packets. MECHANISM Puts controller in promiscuous mode. CAVEATS None. BUGS None known. LIMITATIONS The monitor can handle a burst rate of about 200 pack- ets per second. Packets arriving faster than that are missed (but counted in the statistics of the network driver). The display rate is about 25 packets per second and there is a buffer that can hold 512 undisplayed packets. The monitor discards overflow packets. HARDWARE REQUIRED IBM PC compatible with CGA and network interface (3com 3C501, Interlan NI5010, or proNet p1300). SOFTWARE REQUIRED DOS 2.0 or higher, MicroSoft C (to generate custom exe- cutables)
AVAILABILITY Available as a utility program in the pcip distribution from host husc6.harvard.edu, in directory pub/pcip. Available in a standalone package via anonymous FTP from windom.ucar.edu, in file pc/network/netwatch.arc; a binary "dearc" program is also available from windom.ucar.edu.
NAME Network Integrator I KEYWORDS map, traffic; ethernet; UNIX. ABSTRACT This tool monitors traffic on network segments. All information is dumped to either a log file or, for real-time viewing, to a command tool window. Data is time-stamped according to date and time. Logging can continue for up to 24 hours. The tool is flexible in data collection and presenta- tion. Traffic filters can be specified according to header values of numerous protocols, including those used by Apple, DEC, Sun, HP, and Apollo. Bandwidth utilization can be monitored, as well as actual load and peak throughput. Additionally, the Network Integrator can analyze a network's topology, and record the location of all operational nodes on a network. Data can be displayed in six separate formats of bar graphs. In addition, there are several routines for producing statistical summaries of the data collected. MECHANISM The tools work through RPC and XDR calls. CAVEATS Although the tool adds only little traffic to a net- work, generation of statistics from captured files requires a significant portion of a workstation's CPU. BUGS None known. LIMITATIONS Must be root to run monitor. There does not seem to be a limit to the number of nodes, since it monitors by segments. The only major limitation is the amount of disk space that a user can commit to the log files. The size of the log files, however, can be controlled through the tool's parameters. HARDWARE REQUIRED Sun3 or Sun4.
SOFTWARE REQUIRED 4.0BSD UNIX or greater, or related OS. AVAILABILITY Copyrighted, commercially available from Network Integrators, (408) 927-0412.
NAME net_monitor KEYWORDS routing, status; DECnet, IP; curses, ping; UNIX, VMS; free, sourcelib. ABSTRACT Net_monitor uses ICMP echo (and DECnet reachability information on VAX/VMS) to monitor a network. The mon- itoring is very simplistic, but has proved useful. It periodically tests whether hosts are reachable and reports the results in a full-screen display. It groups hosts together in common sets. If all hosts in a set become unreachable, it makes a lot of racket with bells, since it assumes that this means that some com- mon piece of hardware that supports that set has failed. The periodicity of the tests, hosts to test, and groupings of hosts are controlled with a single configuration file. The idea for this program came from the PC/IP monitor facility, but is an entirely different program with different functionality. MECHANISM Reachability is tested using ICMP echo facilities for TCP/IP hosts (and DECnet reachability information on VAX/VMS). A DECnet node is considered reachable if it appears in the list of hosts in a "show network" com- mand issued on a routing node. CAVEATS This facility has been found to be most useful when run in a window on a workstation rather than on a terminal connected to a host. It could be useful if ported to a PC (looks easy using FTP Software's programming libraries), but this has not been done. Curses is very slow and cpu intensive on VMS, but the tool has been run in a window on a VAXstation 2000. Just don't try to run it on a terminal connected to a 11/750. BUGS None known.
LIMITATIONS This tool is not meant to be a replacement for a more comprehensive network management facility such as is provided with SNMP. HARDWARE REQUIRED A host with a network connection. SOFTWARE REQUIRED Curses, 4.xBSD UNIX socket programming libraries (lim- ited set) and some flavor of TCP/IP that supports ICMP echo request (ping). It has been run on VAX/VMS run- ning WIN/TCP and several flavors of 4BSD UNIX (includ- ing SunOS 3.2, 4.0, and 4.3BSD). It could be ported to any platform that provides a BSD-style programming li- brary with an ICMP echo request facility and curses. AVAILABILITY Requests should be sent to the author: Dale Smith Asst Dir of Network Services University of Oregon Computing Center Eugene, OR 97403-1211 Internet: firstname.lastname@example.org. BITNET: email@example.com UUCP: ...hp-pcd!uoregon!dsmith Voice: (503)686-4394 With the source code, a makefile is provided for most any UNIX box and a VMS makefile compatible with the make distributed with PMDF. A VMS DCL command file is also provided, for use by those VMS sites without "make." The author will attempt to fix bugs, but no support is promised. The tool is copyrighted, but free (for now).
NAME nfswatch KEYWORDS traffic; ethernet, IP, NFS; curses, eavesdrop; UNIX; free. ABSTRACT Nfswatch monitors all incoming ethernet traffic to an NFS file server and divides it into several categories. The number and percentage of packets received in each category is displayed on the screen in a continuously updated display. All exported file systems are monitored by default. Other files may optionally be monitored. Options also allow monitoring of traffic destined for a remote host instead of the local host, or monitoring traffic sent by a single host. Items such as the sample interval length can be adjusted either on the command line or interactively. Facilities for taking screen "snapshots," saving all data to a log file, and summar- izing the log file are included. Nfslogsum, a program that summarizes the log file, is included in the dis- tribution. MECHANISM Nfswatch uses the Network Interface Tap in promiscuous mode to monitor the ethernet. It filters out NFS pack- ets destined for the local (or remote) host, and then decodes the file handles in order to determine which file or file system a request pertains to. CAVEATS Because the NFS file handle is a non-standard (server private) piece of data, the file system monitoring part of the program will break whenever the format of a file handle is not what it expects to see. This is easily fixed in the code, however. The code presently under- stands SunOS 4.0 file handles. BUGS None known.
LIMITATIONS Up to 256 exported file systems and 256 individual files can be monitored, but only (2 * (DisplayLines - 16)) will be displayed on the screen (all data will be written to the log file). Only NFS requests made by client machines are counted; the NFS traffic generated by the server in response to these requests is not counted. HARDWARE REQUIRED Has been tested on Sun-3 and Sun-4 systems. No hardware dependencies, but see below. SOFTWARE REQUIRED SunOS 4.0 or higher. The STREAMS NIT device is used. Fairly easy code modifications should be able to make it run under older SunOS releases, or other versions of BSD UNIX with a NIT-like device. AVAILABILITY Copyrighted, but freely distributable. Available via anonymous FTP from hosts icarus.riacs.edu and spam.itstd.sri.com in pub/nfswatch.tar.Z. There should also be a copy on the 1989 Sun User's Group tape.
NAME nhfsstone KEYWORDS benchmark, generator; NFS; spoof; UNIX; free. ABSTRACT Nhfsstone (pronounced n-f-s-stone, the "h" is silent) is an NFS benchmarking program. It is used on an NFS client to generate an artificial load with a particular mix of NFS operations. It reports the average response time of the server in milliseconds per call and the load in calls per second. The nhfsstone distribution includes a script, "nhfsnums" that converts test results into plot(5) format so that they can be graphed using graph(1) and other tools. MECHANISM Nhfsstone is an NFS traffic generator. It adjusts its calling patterns based on the client's kernel NFS statistics and the elapsed time. Load can be generated over a given time or number of NFS calls. CAVEATS Nhfsstone will compete for system resources with other applications. BUGS None known. LIMITATIONS None reported. HARDWARE REQUIRED No restrictions. SOFTWARE REQUIRED 4.xBSD-based UNIX AVAILABILITY Available via anonymous FTP from bugs.cs.wisc.edu. Alternatively, Legato Systems will provide the program free of charge, if certain conditions are met. Send name and both email and U.S. mail addresses to: Legato Systems, Inc. Nhfsstone 260 Sheridan Avenue Palo Alto, California 94306
A mailing list is maintained for regular information and bug fixes: firstname.lastname@example.org or uunet!legato.com!nhfsstone. To join the list: email@example.com or uunet!legato.com!nhfsstone-request.