Customer login  |   Contact us
Home Company Products Support Purchase
Forum Home » Network Probe

Topic: Discrepancy in traffic monitor result?
Replies: 6   Pages: 1   Last Post: Jul 31, 2004 6:08 AM by: coolnyan »


Back to Topic List Back to Topic List Topics: [ Previous | Next ]
Replies: 6   Pages: 1  
coolnyan

Posts: 2
From: seattle
Registered: Jul 9, 2004
Discrepancy in traffic monitor result?
Posted: Jul 9, 2004 9:20 PM
  Reply

I am evaluating Network Probe 1.1.1 and I installed the software on two PCs. On PC-A the bandwidth consumed by PC-A shows 18M, but PC-B Network Probe shows the bandwidth used by PC-A only 300K. The same thing also happens with the bandwidth measurement on PC-A, where it shows bandwidth used by PC-B is 700K, while the network probe on PC-B itself shows 30M. Both PCs are on same subnet.

Do you know why the bandwidth number is different? I have hit refresh button at the same time for both Network Probe softwares, but it doesn't fix the problem.

Thanks.
Khiat

torgeir

Posts: 1,096
From: Oslo
Registered: Jun 20, 2002
Re: Discrepancy in traffic monitor result?
Posted: Jul 9, 2004 11:03 PM
  Reply

Could it be that one of the nics does not support promiscuous mode? In that case, it will only see traffic to/from itself.

Khiat
Re: Discrepancy in traffic monitor result?
Posted: Jul 12, 2004 5:27 PM
  Reply

Both NICs are the same & they support promiscuous mode. The NICs are 3com 3C905

Eivind Pedersen

Posts: 473
From: Oslo, Norway
Registered: Jun 11, 2002
Re: Discrepancy in traffic monitor result?
Posted: Jul 12, 2004 7:42 PM
  Reply

Most likely you're on a switched network. Replace your switch with a hub - or go for the expensive solution: use a switch with a SPAN port.

Coolnyan
Re: Discrepancy in traffic monitor result?
Posted: Jul 17, 2004 3:17 AM
  Reply

So, in order for Network Probe to monitor traffic ACCURATELY, the network needs to be connected to only HUB or Switch with SPAN? Network probe will run perfect on HUB network, but I don't think I will sacrifice my network performance so I can monitor the network traffic accurately.

Is switch with SPAN mean switch with spanning-tree protocol to prevent switching loop network? My network currently has one switch with SPAN and two other switches w/o SPAN. Both switch w/o SPAN connected to switch with SPAN and the switch w/ SPAN connected to CISCO router. Do I need to connect network probe computer to the switch w/ SPAN to get accurate result?

I think this product is great! However, I need to proof to my boss that it's worth it to buy this product. Please let me know what is the best setup to get accurate network traffic.

Thanks,
Khiat

Eivind Pedersen

Posts: 473
From: Oslo, Norway
Registered: Jun 11, 2002
Re: Discrepancy in traffic monitor result?
Posted: Jul 19, 2004 9:15 AM
  Reply

SPAN means switched port analyser. Sometimes called port mirroring or port monitoring. And yes, you need to connect Network Probe to a computer connected to this port.
What switch do you have?

coolnyan
Re: Discrepancy in traffic monitor result?
Posted: Jul 31, 2004 6:08 AM
  Reply

I use 3com 4924 managed gigabit switch (http://www.3com.com/products/en_US/detail.jsp?tab=features&pathtype=purchase&sku=3C17701-US). This switch connect to CISCO 5500 which goes out to Internet. There are two other 3com 4824 unmanaged switches that connect to 3com 4924.

Thanks for your help.

Khiat



© 1998-2019 ObjectPlanet, Inc. Øvre Slottsgate 5, 0157 Oslo, Norway Tel (+47) 2233 3360 | Fax (+47) 2233 3361