NOVELL TECHNICAL INFORMATION DOCUMENT TITLE: Frequent Questions about LANalyzer for Windows DOCUMENT ID: TID200014 DOCUMENT REVISION: B DATE: 05NOV93 ALERT STATUS: Yellow INFORMATION TYPE: Issue README FOR: NA NOVELL PRODUCT and VERSION: LANalyzer for Windows 2.0 ABSTRACT: This file contains the most frequently asked questions and answers about the LANalyzer for Windows 2.0 product. AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA DISCLAIMER THE ORIGIN OF THIS INFORMATION MAY BE INTERNAL OR EXTERNAL TO NOVELL. NOVELL MAKES EVERY EFFORT WITHIN ITS MEANS TO VERIFY THIS INFORMATION. HOWEVER, THE INFORMATION PROVIDED IN THIS DOCUMENT IS FOR YOUR INFORMATION ONLY. NOVELL MAKES NO EXPLICIT OR IMPLIED CLAIMS TO THE VALIDITY OF THIS INFORMATION. AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ISSUE This document contains information on the most frequently asked questions about LANalyzer for Windows 2.0: Q:Does LANalyzer for Windows work with a "True Blue" IBM 8-bit 16/4 Token Ring board? A:No. These IBM boards use the TROPIC chipset and there is a limitation on the chipset that won't allow it to go into promiscuous mode, which is required by LANalyzer for Windows. Q:What does Promiscuous Mode mean? A:This is the mode in which the network interface card (NIC) receives and passes on all packets that arrive. The LANalyzer for Windows network analyzer monitors network traffic by configuring its NIC to receive every packet on the network. Q:What boards are supported with the ODI drivers shipped with LANalyzer for Windows? A:3Com 3C503 Etherlink II 3C505 Etherlink + Ethernet 3C523 Etherlink/MC Cabletron E20 E21 E2HUB EXOS HP MC Adapter/16 Ethernet HP PC Adapter/8,16,16+ Ethernet IBM PS/2 Ethernet LANalyzer Ethernet Board Madge Smart 16/4 (Token Ring) NE1000 NE1500T NE2 NE2_32 NE2000 NE2100 NE3200 SMC Ethercard Plus Q:Is it possible to configure the LANalyzer for Windows to see through the server/router? A:No. LANalyzer for Windows will only see the packets on the segment that it is attached to. (If activity from another segment is transmitted onto the segment with the LANalyzer for Windows, you will see that activity.) To see another segment, you must move the LANalyzer for Windows to that segment. However, this functionality is available with NetWare Management System (NMS) 2.0. Q:Can LANalyzer for Windows decode IBM NetBIOS traffic? A:No. It will not decode the IBM NetBIOS packets; however, it will present you with the MAC-layer header information and a raw hex dump of the rest of the packet. It will be included in the utilization, packet rate, error graphs, and the Station Monitor. Q:What is the complete list of protocols that LANalyzer for Windows will decode? A:NetWare IPX/SPX NCP RIP SAP TCP/IP TCP/IP SNMP OSPF AppleTalk ATP AFP RTMP ZIP Q:Are there any patches available on NetWire for LANalyzer for Windows? A:Yes, there two different patches. The LZW40.EXE patch gives you NetWare 4.0 decodes, and the LZW143.ZIP file contains the current certified promiscuous mode ODI drivers for LANalyzer for Windows 2.0. Q:Does LANalyzer for Windows work with OS/2? A:No. Q:Is it a requirement to load APPLE.EXE? A:No; however, you will lose Apple support if it is not loaded. Q:Is it a requirement to load NETX? A:No; however, without it, you lose NetWare name gathering. Q:Can you give a brief explanation of Server Monitoring? A:When LANalyzer for Windows is started, server monitoring broadcasts a "Get Nearest File Server" packet. For a file server to respond, the file server must have parameter set to respond to the broadcast request: "SET RespondToNearestFileServer = ON" Also, a known limitation is on NetWare SFT III servers in that they do not seem to want to respond to the broadcast request, and the SET command is not supported for some reason. All the servers that respond to this broadcast will be added to the "Server Monitor" screen. Not all servers always respond. For whatever reason, some might fail to respond every time. Novell believes that this is due to the server being busy and that responding to the packet is a low priority. This will explain why servers sometimes get in the list and others do not, and it seems to change. Now, you have a list of servers to poll. The idea is to go down the list of servers, one at a time, and send them a packet. If they respond, server monitoring moves on to the next server until it reaches the end of the list. Then, it starts over at the top of the list. One server from the list is polled ever 15 seconds or so. If a server fails to respond to the poll, it goes into a "retry" mode. Server monitoring tries more frequently to poll the server (every 2 seconds or so) for three or so tries. If the server has not replied to even one of the polls, server monitoring calls it down and send an alarm. Then server monitoring just moves on to the next server. When it cycles around the list again, it still tries the down server to see if it is back up. After several times through the list, server monitoring "rebuilds" the list. The idea here is to get rid of servers that are down for a long time or have been moved to another segment. It also picks up new servers that were just added or came on line since server monitoring started. The rebuild process is basically, a throw out the old list and start over with the broadcast procedure. Unfortunately the side effects of all this are that servers can tend to "come and go" from the list. There is no way to "Fix" or "Set" the list to poll. You can only determine the servers you want or do not want. The easiest way to see this algorithm in action is to set up a capture filter between "This Workstation" and "ANY." Let server monitoring run for an hour or so. Then "Post Filter" on NetWare SAPs. You do this by double clicking on the SAP layer in the decode, and it will appear as follows: =========== Service Advertising Protocol ============= Router polling is exactly the same except that NetWare RIP packets are used in place of SAP packets. y