OVERVIEW: LANalyzer Applications for NetWare File Server Access Characterization On a Locally Attached Network Segment Ron Lee Senior Consultant Systems Engineering Division Abstract: The LANalyzer applications described herein allow the network administrator to characterize the workload of both servers and workstations on a local area network. Four network management applications are included. Disclaimer Novell, Inc. makes no representations or warranties with respect to the contents or use of these Application Notes (AppNotes) or of any of the third-party products discussed in the AppNotes. Novell reserves the right to revise these AppNotes and to make changes in their content at any time, without obligation to notify any person or entity of such revisions or changes. These AppNotes do not constitute an endorsement of the third-party product or products that were tested. Configuration(s) tested or described may or may not be the only available solution. Any test is not a determination of product quality or correctness, nor does it ensure compliance with any federal, state or local requirements. Novell does not warranty products except as stated in applicable Novell product warranties or license agreements. Copyright { 1991 by Novell, Inc., Provo, Utah. All rights reserved. As a means of promoting NetWare AppNotes, Novell grants you without charge the right to reproduce, distribute and use copies of the AppNotes, provided you do not receive any payment, commercial benefit or other consideration for the reproduction or distribution, or change any copyright notices appearing on or in the document. Introduction The OVERVIEW filters collect eight different kinds of NetWare Core Protocol (NCP) file service requests on the locally attached network segment. Information gathered during this test provides interesting insights into the use of NetWare file servers. Although the test's default filter settings are configured to capture all file service requests on the locally attached network segment, the test can easily be altered to capture requests addressed to a specific server or requests transmitted by a specific workstation. Data gathered by OVERVIEW provides an accurate assessment of the various levels of file server use. With the gathered information, the network manager can keep a utilization history for each NetWare server. OVERVIEW is a Novell LANalyzer application, included with LANalyzer v3.0 that began shipping in 1990. The applications described in this AppNote are derivatives of the default OVERVIEW application. How It Works Novell's NetWare Core Protocol (NCP) is the remote procedure call language that NetWare workstation shells use to communicate with NetWare file servers. Some other tightly integrated products, such as NetWare Loadable Modules (NLMs) also use the NCP when communicating with NetWare servers. With the exception of peer-to-peer traffic, routing traffic (RIP), and broadcast messages, the majority of NetWare traffic is made up of request and response messages encoded in NCP primitives. When an application residing at a workstation initiates a DOS Open File operation (3Dh), for example, the NetWare shell intercepts the request and translates it into an NCP request. The new NCP request is built from information in the DOS request and forwarded to the file server. The server then processes the request and sends a response back to the workstation. Finally, the workstation shell receives the response and passes any completion codes and data back to the application. OVERVIEW captures selected NCP requests as they travel from workstations to the destination server. The default OVERVIEW test is configured with source and destination addresses set to "don't care" to capture all server-related traffic. However, by setting the source or destination address to known workstations or servers, the server- related traffic originating from or destined to a specific set of nodes may be examined. Operating instructions Before using the OVERVIEW default application or derivatives, determine whether the target network is configured for Ethernet II (the ECONFIG configuration) or 802.3 (the standard NetWare configuration). If you don't know how the network is configured, use the LANalyzer application NETVIEW to determine the kind of packets being broadcast on the wire and the packet type configuration. : NETVIEW Run Rate Screen If NETVIEW captures ECONFIG packets (as in ), then select the ECONFIG LANalyzer application suite for NetWare. If NETVIEW captures only 802.3 packets, then select the 802.3 LANalyzer application suite for NetWare. Select OVERVIEW to run or edit the OVERVIEW application. Receive Channels : OVERVIEW Receive Channels, Triggers and Controls Edit Screen Receive Channel 1: Requests : Receive Channel 1 - Requests Setup Pattern Screen Requests Filter: All NetWare Core Protocol (NCP) Requests (template = NetWare) Request Type = 2222 This NCP request filter captures all NetWare workstation file service requests except two: Create Service Connection and Destroy Service Connection. All others have their request type set to 0x2222. (The Create Service Connection and Destroy Service Connection NCP requests are not captured during this test. Their presence, however, is reflected in the Login Receive Channel 3). Receive Channel 2: Replies : Receive Channel 2 - Replies Setup Pattern Screen Replies Filter: NetWare Core Protocol (NCP) Write To A File (template = NetWare) Reply Type = 3333 This NCP reply filter captures all NetWare file server service replies except one: Request Being Processed. All others have their reply type set to 0x3333. (The Request Being Processed NCP reply is captured with receive channel five). Receive Channel 3: LoginOut : Receive Channel 3 - LoginOut Setup Pattern Screen Logout Filter: NetWare Core Protocol (NCP) Logout (template = NetWare) Request Type = 2222 Function Code = 25 This NCP request allows a client to relinquish its current server access privileges without breaking its service connection. LoginObj Filter: NetWare Core Protocol (NCP) Login Object (template = NetWare) Request Type = 2222 Function Code = 20 This NCP request allows a client to identify itself to the file server and thereby gain rights to access certain directories within the file server. Receive Channel 4: Delays : Receive Channel 4 - Delays Setup Pattern Screen Delays Filter: NetWare Core Protocol (NCP) Request Being Processed (template = NetWare) Reply Type = 9999 The file server returns this message when it receives a duplicate service request while the original request is still being processed. Receive Channel 5: Messages : Receive Channel 5 - Messages Setup Pattern Screen Messages Filter: All NetWare Core Protocol (NCP) Message requests (template = NetWare) Request Type = 2222 Function Code = 21 This filter captures all NCP requests that make up the file server's message services. Receive Channel 6: Queues : Receive Channel 6 - Queues Queues Filter: All NetWare Core Protocol (NCP) Queue requests (template = NetWare) Request Type = 2222 Function Code = 17 This filter captures all NCP requests that make up the file server's queue services. Receive Channel 7: TTS : Receive Channel 7 - TTS Setup Pattern Screen TTS Filter: All NetWare Core Protocol (NCP) TTS requests (template = NetWare) Request Type = 2222 Function Code = 34 This filter captures all NCP requests that make up the file server's TTS services. Receive Channel 8: NetWare : Receive Channel 8 - NetWare NetWare Filter: NetWare Core Protocol (NCP) Directory Requests (template = NetWare) Request Type = 2222 Function Code = 22 Transmit Channels No transmit channels are defined or active during this application. Applications Application 1: Segment Characterization This application characterizes network server access (default). 1. Load and run the default OVERVIEW application. 2. At the Run Rate Screen, the channel packet counters provide the total number of NCP service requests and responses broken down by type. 3. If the test is run for a specified amount of time and started at the same time each day, using the LANalyzer's start and stop triggers, then the gathered data can be compared and contrasted. Application 2: Single Server Characterization This application characterizes network server access by server. 1. Load the default OVERVIEW test. 2. In the RECEIVE CHANNEL "dest" pattern, set the Ethernet Destination address to the desired target Ethernet address of a known NetWare file server. For example, to capture file requests addressed to NetWare server NCS with the Ethernet address 00001B02127A, set the filter as follows: Dst Station 00 00 AB 02 12 7A <---- XX XX XX XX XX XX 3. In the RECEIVE CHANNEL "src" pattern, set the Ethernet Source address to the desired target Ethernet address of the same known NetWare file server as in step 2. For example, to capture service replies transmitted from NetWare server NCS with the Ethernet address 00001B02127A, set the filter as follows: Src Station 00 00 AB 02 12 7A ----> XX XX XX XX XX XX 4. Run the OVERVIEW test. 5. The test results will reflect all filtered file service requests and responses addressed to and from the destination server. Application 3: Workstation Characterization This application characterize network server access by workstation. 1. Load the default OVERVIEW test. 2. In the RECEIVE CHANNEL "dest" pattern, set the Ethernet Destination address to the desired target Ethernet address of a known NetWare file server. For example, to capture file requests addressed from workstation 00001B02127B to NetWare server NCS with the Ethernet address 00001B02127A, set the filter as follows: Dst Station 00 00 1B 02 12 7B <---- 00 00 1B 02 12 7A 3. In the RECEIVE CHANNEL "src" pattern, set the Ethernet Source address to the desired Ethernet addresses of the same known NetWare file server and workstation as in step 2. For example, to capture service replies transmitted from NetWare server NCS with the Ethernet address 00001B02127A to the target workstation 00001B02127B, set the filter as follows: Src Station 00 00 1B 02 12 7B ----> 00 00 1B 02 12 7A 4. Run the OVERVIEW test. 5. The test results will reflect all filtered file service requests and responses addressed to and from the target workstation. Application 4: Server Workload Analysis This application determines the number of delay packets observed during a given time period. 1. Load the default OVERVIEW test. 2. In the RECEIVE CHANNEL "dest" pattern, set the Ethernet Destination address to the desired target Ethernet address of a known NetWare file server (see Application 2). 3. Run the OVERVIEW test. 4. At the Run Rate Screen, the delay channel packet counter provides the total number of NCP Request Being Processed replies. Editor's Note: The author accepts written feedback at FAX (801) 429-5511.