We describe our real-time monitor for IEEE 802.5 token ring LANs. Unlike a protocol analyzer that first records network traffic and later disassembles packets and replays them, this monitor displays network traffic and statistics in real time. All user interaction with the monitor is controlled by pop-up menus which select various modes. In graphic mode the monitor displays current network statistics, scroll graphs of network load, and a histogram of network packet lengths. In trace mode it displays the contents of packets in a format specified by the user. The monitor will report on all network traffic or, using user-specified pattern matching filters, will select a subset of network traffic based on any combination of packet source address, destination address, or packet content. An alarm option provides notification when a specific event first occurs or when a repeated event deviates from a user-specified minimum or maximum frequency.
BackgroundIn cooperation with our industrial partner, Sperry Marine Inc. of Charlottesville, Virginia, the Computer Networks Laboratory at the University of Virginia designed and built a real-time network for use on ships. Called SeaNET, the network interconnects devices on the ship's bridge such as the gyrocompass, autopilot, heading indicator, situation display, collision avoidance systems, and navigation computers. The network is based on an IEEE 802.5 token ring LAN and software of our own design. Our real-time messaging system provides the communications primitives needed to open, close, and manage connections, send and receive messages, set options, and report status. The user's application program, hosted on an ordinary PC/AT, can send or receive approximately 425 short (100-byte) messages/second continuously. The end-to-end delay (user memory to user memory, including all operating system interaction and all network transit delays) for short messages is less than 4 ms. Using longer 2000-byte messages, a single station can transmit approximately 1.5 Mbps continuously.One of the early difficulties we faced was that we could not directly observe network traffic; correct operation could only be inferred from the action of the transmitters and receivers. Thus we also designed and built a real-time network monitor which we could use to visualize network traffic. The monitor is completely passive so that its use does not affect network loading in any way. The monitor provides a menu-based user interface, real-time displays of network traffic, scrolling graphs of network traffic, histograms of packet sizes, statistics such as maximum and mean network loading observed, traces of messages observed, and automatic alarms for single events and for event frequency deviations. The monitor will display and analyze all network traffic or any subset of that traffic as specified by user-programmed filters.
Network Diagnostic ToolsNetwork diagnostic tools fall into two broad categories: protocol analyzers and real-time network monitors. Protocol analyzers, such as Network General's Sniffer a...
