Auditing the LAN with Network Discovery · trates a basic network diagram of a small and medium...
Transcript of Auditing the LAN with Network Discovery · trates a basic network diagram of a small and medium...
Application Note
WEBSITE: www.jdsu.com/test
Auditing the LAN with Network Discovery
IntroductionThis application note is one in a series of papers about troubleshooting local area networks (LAN) from JDSU Communications Test and Measurement. Auditing the LAN can be achieved by conducting a Network Discovery. The Network Discovery process “learns” which devices are attached to the network and provides valuable information such as Internet Protocol (IP) addresses, Media Access Controller (MAC) addresses, virtual LAN (VLAN) configuration, and device configuration information.
Typical uses for Network Discovery include:• identifyingthetypesofdevicesthatareattachedtothenetwork(routers,switches,workstations,hosts,
printers, and others)• assistingwithon-sitetroubleshooting(forexample,datacenterorremoteoffice)byverifyingthatanew
server or host is actually online, without the need for an enterprise Network Operations Center (NOC) system management tool
• verifyingthedevicesthatareattachedtothenetworkaresupposedtobeattachedtothenetwork(forexample,detectwirelessaccessportsorpersonalcomputers[PCs])
• detectingdeviceanomaliessuchashighswitchportcollisionsandFrameCheckSequence(FCS)—onsite and without the need for an enterprise NOC system management tool
• identifyingspecificswitchandrouterinterfaceswithhighutilizationbeforeutilizingactivetapsorcon-figuring mirror ports.
Figure 1: JDSU T-BERD®/MTS-4000 (with ESAM) connected to a normal switch port
NetworkDiscoverydoesnotrequirethespecialportmonitoringaccessmode.AsFigure1shows,theJDSUEnterpriseServicesApplicationModule(ESAM)canconnecttostandardofficewalljacksorswitchportstoconduct Network Discovery tests.NetworkDiscoveryreliesonasophisticatedcombinationofpassiveandactivetechniquesthatallowstheESAM to accurately detect and identify hosts on and off of the local subnet.
JDSU T-BERD/MTS-4000 with ESAM
WAN
Application Note: Auditing the LAN with Network Discovery 2
Network Discovery WorkflowThisapplicationnotedemonstratesusecasesforLANnetworkdiscoveryandprovidesexamplesusingtheJDSUESAMfortheT-BERD/MTS-4000.AsSection1references,NetworkDiscoverydoesnotrequirespecialmonitoringaccessandtheESAMconnectsjustasanyotherhosttonormalofficeLANports,switchports, and others.It is common to enter a data center or other central networking location to gain basic insight into the network,suchaswhichsubnetispresentandaretheexpectedswitchesandrouterspresent.Figure2illus-tratesabasicnetworkdiagramofasmallandmediumbusiness(SMB)officelocation.
Figure 2: Typical SMB Office Network
ForaNetworkDiscoveryaudit,technicianscanconnecttheJDSUESAMtoaspareofficeLANwalljackorspareinterfaceononeoftheswitches.Figure3showsthesummaryresultsscreenreceivedaftertheESAMconducts network discovery.
Laptops
Printers
Phones
Cell phonePDA
Web Server
Layer 2 Switch
RouterRouter
Firewall
Layer 2 SwitchWireless Access
Point
Internet
Mail Server
Application Note: Auditing the LAN with Network Discovery 3
Figure 3: Network Discovery Result
The devices are logically layered based on the Cisco network reference model: Access, Distribution, and Core.AlthoughthisreferencemodelisCisco-based,theITcommunitywidelyusesandunderstandsit.Thefollowingsubsectionsdescribearecommendedworkflowafterobtainingthenetworkdiscoveryresultsbutarenotintendedtoimplythatthisworkflowisstatic.Dependinguponthediagnosticquestionthat must be answered, users will likely navigate directly to a problem device or host.
Basic Interpretation of Network Discovery Results
Thefirstquestiontoanswerafteranetworkdiscoverymightbe:arethesethedevicesthatshouldbeonthenetwork?BaseduponthediscoveryresultsshowninFigure3,thesewerethedevicesdetected:• 9servers• 92hosts(orworkstations)• 5printers• 2switches• 4routers.Scanning the workstations, it is easy to determine the overall summary of connected hosts by clicking ontheHostsiconasshowninFigure4.ThistablesummarizesWorkstationIPaddresses,Windowshostnames, and other information.
Application Note: Auditing the LAN with Network Discovery 4
Figure 4: Drilling into Hosts from the Discovery Summary Screen
AsSection1mentioned,thenetworkdiscoveryprocessissometimesusedtodetermineifdevicesarepres-entonthenetworkthatshouldnotbe.Basedonthiscase,thenetworkmanagerrealizesthatthenumberofroutersshouldhaveequaled3andneedstoinvestigatethepresenceofthefourthrouter.ClickingtheRoutericonontheESAMuserinterfaceprovidesalistofRoutersalongwiththeirsourceMACaddressesasFigure5shows.
Figure 5: Drilling into Routers from the Discovery Summary Screen
ThedetailedRouterstableshowsthreeCiscodevices(expected)andanunexpectedCisco-Linksys®device.TheunauthorizedLinksysdeviceisawirelessaccesspointthatisinstalledonanenterprisenetwork,whichis a fairly common occurrence.
All network devices have a 6-byte Ethernet MAC address in the form of 00:22:BE:EA:FC:00. The first three bytes are referred to as the Organization Unique Identifier (OUI) that identifies the company that manufactured the network device.
In this case, 00:22:BEs and the 00:00:0C OUIs belong to Cisco Systems, but the 00:1D:7E OUI belongs to Cisco-Linksys, which is the wireless company within Cisco. The IEEE maintains a list of OUIs and their associated companies. The link to look up OUIs is http://standards.ieee.org/regauth/oui/index.shtml.
Application Note: Auditing the LAN with Network Discovery 5
Detailed Interpretation of Specific Devices
Beyondthebasicnetworkdevicesurvey,itisimportanttoknowwhichlinksareconsumingexces-sivebandwidthorwhichlinksexhibitexcessiveerrors,suchasFCSerrors,collisions,andothererrors.ObtainingthisdetaileddeviceinformationrequiresenablingSimpleNetworkManagementProtocol(SNMP)accessonthedeviceandallowingtheESAMaccesstotheSNMPcommunitystring(atextstringthat acts as a password).Figure6showstheexaminationofanSNMPenablededgeswitch.
SNMP is widely used to manage LAN networks. Devices that support SNMP store various configuration and performance information in a Managed Information Base (MIB) that can be queried via an SNMP client or management console. The SNMP client can query an SNMP agent (device) to obtain MIB information such as vendor name, software version, hard-ware specifications, and performance statistics such as CPU utilization, network port errors, and utilization to name a few.
Access to the SNMP functionality is controlled via an SNMP community string that is used to authenticate messages sent between the SNMP manager and the SNMP agent. Most IT administrators have access to the SNMP community “read” string, which permits SNMP management tools to poll the SNMP agents and retrieve the SNMP MIB information.
The JDSU ESAM supports SNMP version v1, v2c, or v3.
Figure 6: Interface Summary of an SNMP Enabled Switch
Application Note: Auditing the LAN with Network Discovery 6
The interface summary clearly shows the number of interfaces for the switch and the operational status as well “up/down”.Forevenmoredetailedinformation,drillintoaspecificportastheInterfaceDetailsviewinFigure7.
Figure 8: Frame Stats View of an SNMP Enabled Switch
Figure 7: Interface Details View of an SNMP Enabled Switch
InFigure7,thereportedSNMPport18isdrilledintowhichcorrespondstoswitchport“FastEthernet0/6”.ThisdetailedinformationofswitchportFastEthernet0/6providesthefollowinginterfaceinformation:• VLANID=1• MTU=1500• Collisioncount=3171• FCSErrors=0Fromtheinformationprovided,thenetworktroubleshootermaydiscoverthattheportisassociatedwiththeincorrectVLAN,themaximumtransmissionunit(MTU)sizeisnotasexpected,ormaywanttoinves-tigate the cause for the high collision count on this port.Figure8showstheFrameStatsviewthatprovidesmoredetailedinterfaceusagestatistics.Itshowsthetotalnumber of ingress and egress octets as well as discards and errored octets, which also provides valuable insightintopossiblecongestion(discards)andFCS-errorframes.
Application Note: Auditing the LAN with Network Discovery 7
ConclusionGainingvisibilityintotheLANisanimportantfirststepinmanyLANtroubleshootingexercises.Itisimportanttoverifythepresenceofdevicesattachedtothenetworksaswellasunauthorizeddevicesthatshouldnotbethere.Networkdiscoveryaccomplishesthisbyquicklyestablishingthebaseline—whatisattachedtothenetwork—andthendeterminingwhattheattacheddevicesaredoingonthenetwork.TheJDSUESAMfortheT-BERD/MTS-4000providesaworkflow-basedinterfacethat“walks”usersthroughthebestpracticesapproachtowardsolvingamultitudeofnetworkproblems.Figure9illustratestheJDSUESAMinterfaceandFigure10showstheworkflow-baseduserinterface.
Figure 9: JDSU T-BERD/MTS-4000 platform with the ESAM
Figure 10: Workflow Based User Interface of the ESAM
Application Note: Auditing the LAN with Network Discovery 8
Productspecificationsanddescriptionsinthisdocumentsubjecttochangewithoutnotice.©2010JDSUniphaseCorporation301681900000710AUDITINGLAN.AN.TFS.TM.AEJuly2010
Test & Measurement Regional Sales
NORTH AMERICATEL: 1 866 228 3762FAX: +1 301 353 9216
LATIN AMERICATEL: +1 954 688 5660FAX: +1 954 345 4668
ASIA PACIFICTEL: +852 2892 0990FAX: +852 2892 0770
EMEATEL: +49 7121 86 2222FAX: +49 7121 86 1222
WEBSITE: www.jdsu.com/esam
TheJDSUESAMfortheT-BERD/MTS-4000providescomprehensiveLANtestingcapabilitywiththesefeatures:• Layer1-7protocolcaptureandexpertanalysis• networkconnectivity• networkdiscovery• afullrangeofphysicalmediatests• aworkflow-baseduserinterface• amodularplatformwithmanyoptions: – VoIP phone emulation –opticalpowermeter/visualfaultlocator –fiberinspectionprobewithautomatedpass/fail –Wirelessfidelity(WiFi)testing –OTDRmodules
Throughitsworkflow-basedintuitiveuserinterface,theESAMprovidesphysicalmediatestsinclud-ingspeed-certificationofelectricalEthernetcabling,networkconnectivitytests,discovery,wirespeeddeep-packetstatistics,andwirespeedprotocolcaptureandexpertanalysisusingunique,in-depthJDSUJ-Mentorcapabilities.Inaddition,theESAMispartofthemodularJDSUT-BERD/MTS-4000plat-formallowingadditionaloptionsthatincludevoiceoverIP(VoIP)emulation,WiFitesting,IPvideotesting,opticalpowermeters(OPMs),visualfaultlocators(VFLs),digitalfiberinspectionprobes,andOpticaltimedomainreflectometers(OTDRs).Testconnectivitycanbeobtainedeitherelectricallyviaa10/100/1000RJ45EthernetjackorviaanSFPforopticalEthernet.