FILEVIEW: LANalyzer Applications for NetWare File Service Diagnostics on a Locally Attached Network Segment Ron Lee Senior Consultant Systems Engineering Division Abstract: The LANalyzer applications described herein allow the network administrator to characterize the workload of both servers and workstations in a local area network. Four network management applications are included. Disclaimer Novell, Inc. makes no representations or warranties with respect to the contents or use of these Application Notes (AppNotes) or of any of the third-party products discussed in the AppNotes. Novell reserves the right to revise these AppNotes and to make changes in their content at any time, without obligation to notify any person or entity of such revisions or changes. These AppNotes do not constitute an endorsement of the third-party product or products that were tested. Configuration(s) tested or described may or may not be the only available solution. Any test is not a determination of product quality or correctness, nor does it ensure compliance with any federal, state or local requirements. Novell does not warranty products except as stated in applicable Novell product warranties or license agreements. Copyright { 1991 by Novell, Inc., Provo, Utah. All rights reserved. As a means of promoting NetWare AppNotes, Novell grants you without charge the right to reproduce, distribute and use copies of the AppNotes, provided you do not receive any payment, commercial benefit or other consideration for the reproduction or distribution, or change any copyright notices appearing on or in the document. Introduction The FILEVIEW filters collect eight different kinds of NetWare Core Protocol (NCP) file service requests on the locally attached network segment. Information gathered during this test provides interesting insight, into the file level use of the network. Although the test's default filter settings are configured to capture all file service requests, the test can easily be altered to capture requests addressed to a specific server, or those requests transmitted by a specific workstation. Data gathered by FILEVIEW provides an accurate assessment of the various levels of file access on the network or target node. With the gathered information, the network manager can keep a use history for each subnetwork, server, and workstation, and identify the number and volume of read and write operations being serviced by a NetWare file server. FILEVIEW is a Novell LANalyzer application, included with LANalyzer v3.0 that began shipping in 1990. The applications described in this AppNote are derivatives of the default FILEVIEW application. How It Works Novell's NetWare Core Protocol (NCP) is the remote procedure call language that NetWare workstation shells use to communicate with NetWare file servers. Some other tightly integrated products such as NetWare Loadable Modules (NLMs) also use NCP when communicating with NetWare servers. With the exception of peer-to-peer traffic, routing traffic (RIP), and broadcast messages, the majority of NetWare traffic is made up of request and or response messages coded in NCP primitives and encapsulated within IPX frames. When an application residing at a workstation initiates a DOS Open File operation (3Dh), for example, the NetWare shell intercepts the request and translates it into an NCP request. The new NCP request is built from information in the DOS request and forwarded to the file server. The server processes the request and sends a response back to the workstation. The workstation shell receives the response and passes all completion codes and data back to the application. FILEVIEW captures selected NCP requests as they travel from the source workstation to the destination server. The default FILEVIEW test is configured with a source and destination addresses set to "don't care" to capture all file-related traffic. However, by setting the source or destination address to known workstations or servers, the file- related traffic originating from or destined to a specific set of nodes may be examined. Operating Instructions Before using the FILEVIEW default application or derivatives, determine whether the target network is configured for Ethernet II (the ECONFIG configuration) or 802.3 (the standard NetWare configuration). If you don't know how the network is configured, use the LANalyzer application NETVIEW to determine the kind of packets being broadcast on the wire and the packet type configuration. : NETVIEW Run Rate Screen If NETVIEW captures ECONFIG packets (as in ), then select the ECONFIG LANalyzer application suite for NetWare. If NETVIEW captures only 802.3 packets, then select the 802.3 LANalyzer application suite for NetWare. Select FILEVIEW to run or edit the FILEVIEW application. Receive Channels : FILEVIEW Receive Channels, Triggers and Controls Edit Screen Receive Channel 1: Read : Receive Channel 1 - Read Setup Pattern Screen Read Filter: All NetWare Core Protocol (NCP) Read From A File (template = NetWare) Request Type = 2222 Function Code = 72 This NCP request reads a block of byes from a file starting at a specified file offset. Receive Channel 2: Write : Receive Channel 2 - Write Setup Pattern Screen Write Filter: NetWare Core Protocol (NCP) Write to a file (template = NetWare) Reply Type = 3333 Function Code = 73 This NCP request writes a block of data to a file. Receive Channel 3: Search : Receive Channel 3 - Search Setup Pattern Screen Search Filter: NetWare Core Protocol (NCP) Search For A File (template = NetWare) Request Type = 2222 Function Code = 64 This NCP request allows a client to search the specified server's directory. Receive Channel 4: Open : Receive Channel 4 - Open Setup Pattern Screen OpenOld Filter: NetWare Core Protocol (NCP) Open File (old) (template = NetWare) Reply Type = 2222 Function Code = 65 This NCP request is the pre-NetWare v2.0a form of Open File. OpenNew Filter: NetWare Core Protocol (NCP) Open File (template = NetWare) Reply Type = 2222 Function Code = 76 This NCP request allows a client to open an existing file for future access. Receive Channel 5: Close : Receive Channel 5 - Close Setup Pattern Screen Close Filter: All NetWare Core Protocol (NCP) Close File (template = NetWare) Request Type = 2222 Function Code = 66 This NCP closes a file. Receive Channel 6: Create : Receive Channel 6 - Create Setup Pattern Screen Create Filter: All NetWare Core Protocol (NCP) Create File (template = NetWare) Request Type = 2222 Function Code = 67 This NCP request creates a new file for the calling client in the indicated directory. Create New Filter: All NetWare Core Protocol (NCP) Create New File (template = NetWare) Request Type = 2222 Function Code = 77 This NCP request is exactly like the Create File request, but will always fail if the specified file already exists. Receive Channel 7: Erase : Receive Channel 7 - Erase Setup Pattern Screen Erase Filter: All NetWare Core Protocol (NCP) Erase File (template = NetWare) Request Type = 2222 Function Code = 68 This NCP request allows a client to delete files from the target directory. Receive Channel 8: Dir : Receive Channel 8 - Dir Setup Pattern Screen Dir Filter: NetWare Core Protocol (NCP) Directory Requests (template = NetWare) Request Type = 2222 Function Code = 22 This filter captures all of the NCP directory requests, except the Purge a File and Erase a File NCP requests. Both exceptions are filtered out by the filters below. Purge Filter: NetWare Core Protocol (NCP) Purge File (template = NetWare) Request Type = 2222 Function Code = 76 Erase Filter: NetWare Core Protocol (NCP) Erase File (template = NetWare) Request Type = 2222 Function Code = 76 Transmit Channels No transmit channels are defined or active during this application. Applications Application 1: Segment Characterization This application characterizes network file service (default). 1. Load and run the default FILEVIEW application. 2. At the Run Rate Screen, the channel packet counters provide the total number of NCP file requests, broken down by request type. 3. If the test is run for a specified amount of time and started at the same time each day, using the LANalyzer's start and stop triggers, then the gathered data can be compared and contrasted over time. Application 2: Single Server Characterization This application characterizes network file service by server. 1. Load the default FILEVIEW. 2. At the Receive Channel "dest" pattern, set the Ethernet Destination address to the desired target Ethernet address of a known NetWare file server. For example, to capture file requests addressed to NetWare server NCS with the Ethernet address 00001B02127A, set the filter as follows: Dst Station 00 00 AB 02 12 7A <---- XX XX XX XX XX XX 3. Run the FILEVIEW application. 4. The test results will reflect all filtered file-related requests addressed to the destination server. Application 3: Single Workstation Characterization This application characterizes network file service by workstation. 1. Load the default FILEVIEW application. 2. At the Receive Channel "src" pattern, set the Ethernet source address to the desired Ethernet address of a known NetWare workstation. For example, to capture file requests transmitted by a workstation with the Ethernet address 00001B02127A, set the filter as follows: Src Station 00 00 AB 02 12 7A ----> XX XX XX XX XX XX 3. Run the FILEVIEW application. 4. The test results will reflect all filtered file-related requests transmitted by the source node. Application 4: Write Activity Analysis This application determines the number of file writes occurring during a given period of time. 1. Load the default FILEVIEW application. 2. At the Receive Channel "dest" pattern, set the Ethernet Destination address to the desired target Ethernet address of a known NetWare file server (see Application 2.) 3. Run the FILEVIEW application. 4. At the Run Rate Screen, the write channel packet counter provides the total number of NCP write requests. 5. If the test is run for a specified amount of time and started at the same time each day, using the LANalyzer's start and stop triggers, then the gathered data can be used to estimate the total volume of written data for a day, week, or month. This information can be used in long-term planning, especially in the estimation of disk storage requirements for transaction tracking or audit trail services. Editor's Note: The author accepts written feedback at FAX (801) 429-5511.