NETWORK ANALYZER AND NETWORK MONITORING USING SNMP

1.0 Introduction

1.1 Background of the Study

Network monitoring and measurement have become more and more important in a modern complicated network. In the past, administrators might only monitor a few network devices or less than a hundred computers. The network bandwidth may be just 10 or 100Mbps (Megabit per second) ; however, now administrators have to deal with not only higher speed wired network ( more than 10Gps( Gigabit per second) and Asynchronous Transfer Mode(ATM) network) but also wireless network .They need more sophisticated network traffic monitoring and analysis tools in order to maintain the network system stability and availability such as to fix network problems on time or to avoid network failure, to ensure the network security strength, and to make good decisions for network planning, when a network failure occurs, monitoring agents have to detect, isolate, and correct malfunctions in the network and possibly recover the failure. Commonly, the agents should warm the administrators to fix the problems within a minute. With the stable network, the administrator's jobs remain to monitor constantly if there is a threat from either inside or outside network. Moreover, they have to regularly check the network performance if the network devices are over loaded to avoid a failure occurring due to the overloaded, information about network usage can be used to make a network plan for short-term and long-term future improvement.

There are various kinds of tools use for dealing with the network monitoring and analysis; such as tools by simple network management protocol (SNMP), windows management instrumentation (WMI), sniffing and network flow monitoring and analysis. Given the data packet and network traffic flow information, administrators can understand network behavior, suchas application and network usage, utilization of network resources, and network anomalies and security vulnerabilities.

1.1.1 Basic Concepts

SNMP (Simple Network Management Protocol) was introduced in 1988 and was initially designed as a short-term solution to manage Transmission Control Protocol /Access Point(TCP/AP) based networks. With SNMP's Get, Set and Trap operations, monitoring and controlling can be realized in TCPAP networks. Since Transmission Control Protocol/Internet Protocol (TCP/IP) is dominant, implementation and deployment of SNMP management systems are important.Because of the limitations and deficiencies in the original SNMP suite, SNMP v2 was introduced and published in 1993.To address the security and remote configuration capabilities issues, a recent set of Request for Comments (RFCs), known collectively as SNMP v3, has also been recently introduced[Snmpv3].

A network management or monitoring system must have a management station or manager.The management station serves as the interface for the human network manager into the network management system so that the network manager can monitor and control the network management processes. Another key element in network management is the management agent. Any node in the network to be managed, such as PCs, workstations, servers, bridges and routers,should be equipped with an agent so that they can be managed from a management station. The agent gathers and records management information for one or more network elements and communicates that information to the manager. The communication is implemented according to a common network management protocol which is shared by al1 the management stations and agents.

Since the agent has a function of collecting and maintaining information for its local environment, the management information base (MIB) was introduced. The MIB contains current and historical information about its local configuration and traffic. The management station will maintain a global MIB with summary information from al1the agents.There are two techniques used for making the management information collected and stored by agents available to manager systems. One is polling, a process by which the manager queries the information from the agent and the agent responds by looking at its MIB. The other process is event reporting, which indicates that the manager listens for the event reports generated by the agents.

The heart of the network management system is a set of applications that meet the needs for network management. At a minimum, a system will include basic applications for performance monitoring, configuration control, and accounting. This study focuses on monitoring the system specified by the user in the local network and presenting the information via text or red the graph in the client's Web browser.Common Object Request Broker Architecture (CORBA) is defined by the Object Management Group (OMG) m provide middle ware for object-oriented applications. With a membership of over 800 companies, OMG represents the main spectrum of the computer industry except for Microsoft. For the majority of the industry, the next generation of middle ware is CORBA.

1.2 Statement of the Problem

As wireless networks become more popular, they are being deployed in more and more varying conditions. At the same time, the monitoring of these networks has also advanced and continues to reveal key implementation deficiencies that need to be corrected in order to improve operation and end-to-end performance. An increase in network load can give rise to several problems such as intermittent connectivity, low throughput, and high loss, resulting in an unreliable network, and in the worst-case, complete network failure. The objective in this study was to analyze the impact of congestion and AP hand offs in an IEEE 802.11 wireless network.

The problem addressed by this study is described by the following points:

1. The majority of previous research has discounted the use of SNMP on wireless
2. SNMP is not typically viewed as an accurate and reliable tool since it
   presents either aggregate or instantaneous information at the time it is
3. Vicinity Sniffing is still seen as the best method of observing a network's
   performance because of the level of granularity that is available.
4. When using Vicinity Sniffing in ideal conditions, it is possible to view the
   entire contents of packets that pass across the wireless network.
5. Although Vicinity Sniffing provides for packet-level detail, some limitations exist that reduce the level of accuracy such as the physical characteristics of the wireless medium itself.
6. SNMP does not provide the same level of detail as Vicinity Sniffing, but the data that is returned from a SNMP query covers 100% of the packets that have passed through a particular segment of the network, whereas the data obtained from Vicinity Sniffing is dependent upon the physical placement of the sniffers.

This study is designed to show that the latest wireless equipment is capable of producing results that are on a per-device level, and that the data retrieved from SNMP is valid, even for wireless networks. Further, we correlate data obtained through Vicinity Sniffing to data obtained from SNMP. This serves to partially validate that the results from both methods are accurate and to develop additional performance analysis dimensions that can be achieved when using an analysis methodology that includes both techniques.

1.3 Aim and Objectives of the Study

The main aim is to implement an effective wireless monitoring system using SNMP and demonstrating its effectiveness in traffic characterization and network diagnosis. Other specific objectives of study are:

• To determine the network performance matrices
• To determine the relationship between management information base (MIB) simple network management protocol (SNMP).
• To determine the types of network traffic flow monitoring and analysis tools
• To determine the role of SNMP in network performance monitoring.

1.4 Significance of the Study

The study on network analyzer and monitoring tools using SNMP will be of immense benefit to the communication industry in Nigeria, the government (local state and federal) and other researcher that desire to carry out similar research on the above topic as the findings of the study will educate the above population on network performance monitoring, common performance metrics, role of SNMP in network perform monitoring, management information base (MIB), and examples of network traffic flow monitoring and analysis tools. Finally, the study will contribute to the body of existing literature and knowledge in this field of study and provide a basis for further research.

1.5 Scope of the study

The scope of this study is based on developing an intelligent network monitor to dynamically distribute monitoring functionality, using SNMP at the devices where the managed resources are located. Specifically speaking, the intelligent monitoring goes in two ways:

1. First, manager applications can distribute monitoring intelligence to the managed network element. Instead of bringing data from the devices to the central station.The manager host and the network as a whole can then be relieved from the bottleneck and themicro-management problems.
2. Secondly, the network element's agent functionality can be dynamically modified or extended. Through SNMP. Manager applications can choose to distribute/delete whatever information to/from the device, at whatever time they like.

1.6 Limitation of the Study

Using SNMP for monitoring has proved that as congestion in the network intensifies, smaller frames are more likely to be successfully transmitted and received; and that in a congested network, the use of high data rates and the transmission of fewer frames reduces per-frame channel occupancy and decreases medium contention respectively.

1.7 Definition of Terms

• Agent:The software that runs on a managed network device and implements the information and / or management functionality of a management system.
• Managed Device: Any network device that is capable of participating in a network management system.
• Management Information Base (MIB):A hierarchical specification of the managment data on a managed network device.
• Management Station:The software that sends requests to agents and receives traps on behalf of an administrator or management software.
• NNetwork-Management System (NMS): A complete hardware and software system that monitors and manages a network.
• Application Programming Interface: In computer programming, an application programming interface(API) is a set of subroutine definitions, protocols, and tools for building application
• Basic Object Adapter:Basic Object Adapter (BOA) is an interface intended to be widely available and to support a wide variety of common object implementations.
• Common Gateway Interface:In computing, Common Gateway Interface (CGI) offers a standard protocol for web servers to execute programs that execute like Console applications (also called Command-line interface programs) running on a server that generates web pages dynamically.
• Simple Network Management Protocol (SNMP):A network protocol that is part of the internet protocol suite used to send and receive network management information.
• Trap: Asynchronous messages sent by agents to managers. May be used for alerts or event notifications; also known as notification.