A pair of new RMON probes

*A pair of new RMON probes peer deep; NetScout has better interface, higher price than EtherMeter. (Frontier Software Development Inc's NetScout and Network Applications Technology Inc's EtherMe
PC Week Oct 17, 1994 v11 n41 pN1(3)
PC Week Oct 17, 1994 v11 n41 pN1(3)

A pair of new RMON probes peer deep; NetScout has better
interface, higher price than EtherMeter. (Frontier Software
Development Inc's NetScout and Network Applications
Technology Inc's EtherMeter Ethernet probes) (includes
related article on testing methods) (PC Week Netweek)

by Blakeley, Michael

Abstract
Frontier Software Development Inc's $2,995 NetScout Ethernet probe
offers better functionality and a superior interface than Network
Application Technology Inc's $1,295 EtherMeter, but EtherMeter's low
price cannot be overlooked by corporate buyers. NetScout delivers
excellent large-scale probe management. It provides good network
management tools and WAN ports, but its export capabilities are
lacking, as are custom report-generation tools. EtherMeter performs
well at executing packet capture and decoding functions, and it uses
low-priced hardware and software components, but this package is not
good for use on enterprisewide networks; it is best for smaller
networks that mostly need troubleshooting tools.

Full Text
To help systems administrators stay one step ahead of constantly
growing networks, Frontier Software Development Inc. and Network
Application Technology Inc. recently started to ship RMON-compatible
Ethernet probes with management consoles for Microsoft Corp. Windows.

Based on PC Week Labs tests of Frontier's $2,995 NetScout and NAT's
$1,295 EtherMeter, the NetScout clearly offers a superior interface and
functionality. However, the EtherMeter's lower price will attract many
corporate buyers.

Frontier's NetScout architecture has two components: the NetScout
hardware and the NetScout Manager software. The software, currently in
Release 3.0 for Windows, also runs on Sun Microsystems Computer
Corp.'s SPARC systems and other platforms, with or without
Hewlett-Packard Co.'s OpenView.

The NetScout RMON (remote monitoring) probe is available with one or
two Ethernet, Token-Ring, or WAN ports.

NAT's network-analysis tools include the EtherMeter and TokenMeter
stand-alone RMON probes (the TokenMeter is slated to ship in December),
as well as the ISA-based EtherMeterCard; we tested both
implementations. Regardless of implementation, the EtherMeter is
managed through NAT's Windows-based NMS (Network Management
System) 3.01, and the company also provides plug-in modules for HP
OpenView on Sun SPARC and other Unix platforms.

PC Week Labs tested the NetScout with one Ethernet and one WAN port,
managed by NetScout Manager 3.0 running under Windows 3.1.

We tested the EtherMeterCard using NAT's NMS 3.01 running under
Windows 3.1.

Both Frontier and NAT have infused their management software with a
wide range of tools designed to tackle such tasks as probe management,
packet capture, network capacity planning, and troubleshooting.

Network-management tools

For a large corporate network, probe management may be the most
important feature of an RMON console. Because most RMON vendors
encourage the placement of a probe on every LAN segment, management
consoles must be able to manage hundreds of probes in a streamlined
manner.

Frontier's NetScout Manager passes this test with flying colors: Its
ability to administer each probe both individually and in groups
outshines the EtherMeter NMS' one-at-a-time approach to probe
management.

We were confused by the EtherMeter NMS' approach to probe management
-- when one probe stopped communicating, it took us two hours and a
lengthy call to NAT technical support to bring that probe back on-line.
NAT officials are planning to update this aspect of EtherMeter by rolling
out a more scalable EnterpriseEtherMeter product during 1995.

Both the EtherMeter NMS and NetScout Manager management consoles
allowed us to change probe IP addresses, names, SNMP community
strings, and other essentials without resorting to a dumb terminal.

Both RMON probes support all of the Ethernet and Token-Ring groups as
specified in the RMON Management Information Base. These include the
nine Ethernet groups of RMON objects: Statistics, History, Alarm, Host,
HostTopN, Matrix, Filter, Packet Capture, and Event. The Token-Ring
levels include Ring Station, Ring Station Order, Ring Station
Configuration, and Source Routing.

Once we had the RMON probes firmly in hand, we were interested in
gauging the health of our network and planning for its future growth. The
NetScout Manager provided a particularly easy interface with which to
perform network-health monitoring and capacity planning, including a
point-and-click short-term and long-term network vital signs chart
that covered utilization, broadcast, and error statistics.

Although the EtherMeter NMS was capable of providing the same data, its
reports were more difficult to set up.

On the other hand, the EtherMeter NMS offered some additional
network-health monitoring tools, including duplicate IP detection and
new node discovery -- these two features also count as security
measures, because they help network managers detect unauthorized
nodes.

The EtherMeter NMS provided better packet-capture and decoding tools
than the NetScout. Both packages allowed us to set a RAM pool for
captures and to limit captures to the first "n" bytes of any packet, but
the NetScout Manager's low-level decoding tools did not provide as much
detail as its NAT counterpart. Both packages were also able to provide
raw hexadecimal code.

Both solutions offered administrators the ability to set alarms upon
rising and falling thresholds of any RMON variable. However, the
NetScout Manager went further: It implemented a Unix-like shell that
could be linked to an alarm so administrators could proactively link an
action, such as launching a specific Windows application, to a particular
network event.

Ease of use

Neither system provides an ideal user interface, but the NetScout
Manager's conformance to Windows standards by far exceeded that of the
EtherMeter NMS. While neither application included an Edit menu with
copy-and-paste functionality, the NetScout Manager outdid the
EtherMeter NMS by providing a more consistent menu-driven interface,
good use of icon buttons, and resizable windows.

The EtherMeter NMS suffered from an awkward, double-click pop-up
menu. This and other interface elements made it resemble a sloppy Motif
port more than a Windows application.

Both management consoles would benefit from a more context-sensitive
interface, allowing users to simply double-click on any element and
drill down to a more detailed view.

Beyond surface issues of look and feel, what good are troubleshooting
and capacity-planning tools if you can't merge their findings into a
budget request? The ideal network-analysis console should be able to
export data to files, printers, and clipboards; allow managers to create
custom reports; and provide a powerful query interface for report
creation.

Both the EtherMeter NMS and the NetScout Manager offered file-export
capabilities, but neither supported copy-and-paste functions. The
EtherMeter NMS included menu items for exporting data to a file,
printing, and starting a DDE (Dynamic Data Exchange) server, while the
NetScout Manager's data-logging could only be configured by manually
editing a file in the $NSHOME\usr directory.

In terms of task automation, neither package directly supports custom
report generation -- though the NetScout Manager does provide custom
filter sets with which users can automatically create reports about IP,
IPX, or all protocol-oriented packets.

Network managers can also define custom filters, called domains, for
any byte pattern at any offset in a packet, and these filters can be saved
for future use.

However, customizations to an individual chart or table cannot be saved.

Similarly, although the EtherMeter NMS could not generate custom
reports, we were able to configure a given chart or table in a highly
customized fashion -- but we couldn't save our customizations for
future use.

And although the EtherMeter NMS does provide a DDE server for data
export -- allowing users to prepare such custom templates as, for
example, a Microsoft Excel spreadsheet -- it does require proficiency
with DDE and another DDE-compliant application.

NAT plans to update its EtherMeter reporting capabilities with a new
Meter Reporting System for Windows, slated for release in late 1994 or
early 1995, according to company officials.

Ease of learning/Installation

We were shocked to discover that neither management console offered
on-line help.

Frontier and NAT should take a cue from the extensive on-line help
provided by Network General Corp. in its line of networking tools.
Frontier plans to introduce on-line help early in 1995, while NAT will
follow suit later that year, officials said.

The documentation for both systems was adequate. However, because the
EtherMeter NMS is also a general-purpose SNMP console, we were
required to dig through a huge manual to locate specific information on
RMON.

Installing the software for both products proved fairly simple. The
NetScout Manager offered Winsock compliance, so it should work with
any current Windows IP stack. We tested it with NetManage Inc.'s
Chameleon stack.

The EtherMeter NMS comes with a customized Ethernet card that
includes an on-board TCP/IP stack, and the firm claims that its console
also works with Winsock products from NetManage and FTP Software Inc.

Hardware setup was slightly trickier but still easy for both products.
Installing NAT's EtherMeterCard required a free ISA slot and an I/O
address but no interrupt request was needed.

However, we had to run specialized DOS software on the workstation to
configure the EtherMeterCard. We configured the EtherMeter stand-alone
probe via a BOOTP server that came bundled with EtherMeter NMS.

The NetScout also supports BOOTP, but no BOOTP server is supplied with
the console, so we configured the NetScout with an IP address and other
parameters through its console port, using a VT100 emulator.

PC Week Labs tested Frontier's NetScout RMON probe configured with one
Ethernet and one WAN port. We tested NAT's EtherMeterCard installed in
the ISA slot of a 25MHz 486SX-based Hewlett-Packard Co. Vectra with
4M bytes of RAM, as well as NAT's stand-alone EtherMeter probe. Both
NetScout Manager 3.0 and EtherMeter NMS 3.01 were installed on a
66MHz 486DX2-based Digital Equipment Corp. DECpc 466d2 LP with 16M
bytes of RAM running Microsoft Corp.'s Windows 3.1.

Type: Software Review
Evaluation

Company: Frontier Software Development Inc.
Network Application Technology Inc.

Product: NETscout (LAN monitor)
Ethermeter (Network management software)

Topic: Evaluation
LAN Monitor
Comparison
Network Management Software

Record# 16 168 393