FILEVIEW: LANalyzer Applications for NetWare File Service Diagnostics on a
Locally Attached Network Segment

Ron Lee
Senior Consultant
Systems Engineering Division

Abstract:

     The LANalyzer applications described herein allow the network
     administrator to characterize the workload of both servers and
     workstations in a local area network. Four network management
     applications are included.

Disclaimer

     Novell, Inc. makes no representations or warranties with respect to
     the contents or use of these Application Notes (AppNotes) or of any of
     the third-party products discussed in the AppNotes. Novell reserves
     the right to revise these AppNotes and to make changes in their
     content at any time, without obligation to notify any person or entity
     of such revisions or changes. These AppNotes do not constitute an
     endorsement of the third-party product or products that were tested.
     Configuration(s) tested or described may or may not be the only
     available solution. Any test is not a determination of product quality
     or correctness, nor does it ensure compliance with any federal, state
     or local requirements. Novell does not warranty products except as
     stated in applicable Novell product warranties or license agreements.

     Copyright { 1991 by Novell, Inc., Provo, Utah. All rights reserved.

     As a means of promoting NetWare AppNotes, Novell grants you without
     charge the right to reproduce, distribute and use copies of the
     AppNotes, provided you do not receive any payment, commercial benefit
     or other consideration for the reproduction or distribution, or change
     any copyright notices appearing on or in the document.

Introduction

     The FILEVIEW filters collect eight different kinds of NetWare Core
     Protocol (NCP) file service requests on the locally attached network
     segment.

     Information gathered during this test provides interesting insight,
     into the file level use of the network. Although the test's default
     filter settings are configured to capture all file service requests,
     the test can easily be altered to capture requests addressed to a
     specific server, or those requests transmitted by a specific
     workstation.

     Data gathered by FILEVIEW provides an accurate assessment of the
     various levels of file access on the network or target node. With the
     gathered information, the network manager can keep a use history for
     each subnetwork, server, and workstation, and identify the number and
     volume of read and write operations being serviced by a NetWare file
     server.

     FILEVIEW is a Novell LANalyzer application, included with LANalyzer
     v3.0 that began shipping in 1990. The applications described in this
     AppNote are derivatives of the default FILEVIEW application.

How It Works

     Novell's NetWare Core Protocol (NCP) is the remote procedure call
     language that NetWare workstation shells use to communicate with
     NetWare file servers. Some other tightly integrated products such as
     NetWare Loadable Modules (NLMs) also use NCP when communicating with
     NetWare servers.

     With the exception of peer-to-peer traffic, routing traffic (RIP), and
     broadcast messages, the majority of NetWare traffic is made up of
     request and or response messages coded in NCP primitives and
     encapsulated within IPX frames.

     When an application residing at a workstation initiates a DOS Open
     File operation (3Dh), for example, the NetWare shell intercepts the
     request and translates it into an NCP request. The new NCP request is
     built from information in the DOS request and forwarded to the file
     server. The server processes the request and sends a response back to
     the workstation. The workstation shell receives the response and
     passes all completion codes and data back to the application.

     FILEVIEW captures selected NCP requests as they travel from the source
     workstation to the destination server. The default FILEVIEW test is
     configured with a source and destination addresses set to "don't care"
     to capture all file-related traffic. However, by setting the source or
     destination address to known workstations or servers, the file-
     related traffic originating from or destined to a specific set of
     nodes may be examined.

Operating Instructions

     Before using the FILEVIEW default application or derivatives,
     determine whether the target network is configured for Ethernet II
     (the ECONFIG configuration) or 802.3 (the standard NetWare
     configuration). If you don't know how the network is configured, use
     the LANalyzer application NETVIEW to determine the kind of packets
     being broadcast on the wire and the packet type configuration.

     : NETVIEW Run Rate Screen

     If NETVIEW captures ECONFIG packets (as in ), then select the ECONFIG
     LANalyzer application suite for NetWare. If NETVIEW captures only
     802.3 packets, then select the 802.3 LANalyzer application suite for
     NetWare.

     Select FILEVIEW to run or edit the FILEVIEW application.

Receive Channels

     : FILEVIEW Receive Channels, Triggers and Controls Edit Screen

Receive Channel 1: Read

     : Receive Channel 1 - Read Setup Pattern Screen

     Read Filter: All NetWare Core Protocol (NCP) Read From A File
          (template = NetWare)
          Request Type = 2222
          Function Code = 72

     This NCP request reads a block of byes from a file starting at a
     specified file offset.

Receive Channel 2: Write

     : Receive Channel 2 - Write Setup Pattern Screen

     Write Filter: NetWare Core Protocol (NCP) Write to a file
          (template = NetWare)
          Reply Type = 3333
          Function Code = 73

     This NCP request writes a block of data to a file.

Receive Channel 3: Search

     : Receive Channel 3 - Search Setup Pattern Screen

     Search Filter: NetWare Core Protocol (NCP) Search For A File
          (template = NetWare)
          Request Type = 2222
          Function Code = 64

     This NCP request allows a client to search the specified server's
     directory.

Receive Channel 4: Open

     : Receive Channel 4 - Open Setup Pattern Screen

     OpenOld Filter: NetWare Core Protocol (NCP) Open File (old)
          (template = NetWare)
          Reply Type = 2222
          Function Code = 65

     This NCP request is the pre-NetWare v2.0a form of Open File.

     OpenNew Filter: NetWare Core Protocol (NCP) Open File
          (template = NetWare)
          Reply Type = 2222
          Function Code = 76

     This NCP request allows a client to open an existing file for future
     access.

Receive Channel 5: Close

     : Receive Channel 5 - Close Setup Pattern Screen

     Close Filter: All NetWare Core Protocol (NCP) Close File
          (template = NetWare)
          Request Type = 2222
          Function Code = 66

     This NCP closes a file.

Receive Channel 6: Create

     : Receive Channel 6 - Create Setup Pattern Screen

     Create Filter: All NetWare Core Protocol (NCP) Create File
          (template = NetWare)
          Request Type = 2222
          Function Code = 67

     This NCP request creates a new file for the calling client in the
     indicated directory.

     Create New Filter: All NetWare Core Protocol (NCP) Create New File
          (template = NetWare)
          Request Type = 2222
          Function Code = 77

     This NCP request is exactly like the Create File request, but will
     always fail if the specified file already exists.

Receive Channel 7: Erase

     : Receive Channel 7 - Erase Setup Pattern Screen

     Erase Filter: All NetWare Core Protocol (NCP) Erase File
          (template = NetWare)
          Request Type = 2222
          Function Code = 68

     This NCP request allows a client to delete files from the target
     directory.

Receive Channel 8: Dir

     : Receive Channel 8 - Dir Setup Pattern Screen

     Dir Filter: NetWare Core Protocol (NCP) Directory Requests
          (template = NetWare)
          Request Type = 2222
          Function Code = 22

     This filter captures all of the NCP directory requests, except the
     Purge a File and Erase a File NCP requests. Both exceptions are
     filtered out by the filters below.

     Purge Filter: NetWare Core Protocol (NCP) Purge File
          (template = NetWare)
          Request Type = 2222
          Function Code = 76

     Erase Filter: NetWare Core Protocol (NCP) Erase File
          (template = NetWare)
          Request Type = 2222
          Function Code = 76

Transmit Channels

     No transmit channels are defined or active during this application.

Applications

Application 1: Segment Characterization

     This application characterizes network file service (default).

     1.   Load and run the default FILEVIEW application.

     2.   At the Run Rate Screen, the channel packet counters provide the
          total number of NCP file requests, broken down by request type.

     3.   If the test is run for a specified amount of time and started at
          the same time each day, using the LANalyzer's start and stop
          triggers, then the gathered data can be compared and contrasted
          over time.

Application 2: Single Server Characterization

     This application characterizes network file service by server.

     1.   Load the default FILEVIEW.

     2.   At the Receive Channel "dest" pattern, set the Ethernet
          Destination address to the desired target Ethernet address of a
          known NetWare file server. For example, to capture file requests
          addressed to NetWare server NCS with the Ethernet address
          00001B02127A, set the filter as follows:

          Dst Station 00 00 AB 02 12 7A <---- XX XX XX XX XX XX

     3.   Run the FILEVIEW application.

     4.   The test results will reflect all filtered file-related requests
          addressed to the destination server.

Application 3: Single Workstation Characterization

     This application characterizes network file service by workstation.

     1.   Load the default FILEVIEW application.

     2.   At the Receive Channel "src" pattern, set the Ethernet source
          address to the desired Ethernet address of a known NetWare
          workstation. For example, to capture file requests transmitted by
          a workstation with the Ethernet address 00001B02127A, set the
          filter as follows:

          Src Station 00 00 AB 02 12 7A ----> XX XX XX XX XX XX

     3.   Run the FILEVIEW application.

     4.   The test results will reflect all filtered file-related requests
          transmitted by the source node.

Application 4: Write Activity Analysis

     This application determines the number of file writes occurring during
     a given period of time.

     1.   Load the default FILEVIEW application.

     2.   At the Receive Channel "dest" pattern, set the Ethernet
          Destination address to the desired target Ethernet address of a
          known NetWare file server (see Application 2.)

     3.   Run the FILEVIEW application.

     4.   At the Run Rate Screen, the write channel packet counter provides
          the total number of NCP write requests.

     5.   If the test is run for a specified amount of time and started at
          the same time each day, using the LANalyzer's start and stop
          triggers, then the gathered data can be used to estimate the
          total volume of written data for a day, week, or month. This
          information can be used in long-term planning, especially in the
          estimation of disk storage requirements for transaction tracking
          or audit trail services.

Editor's Note: The author accepts written feedback at FAX (801) 429-5511.


