Open Up and Say Ahhhhh

Open Up and Say Ahhhhh!

Just as a runny nose can tell you that you're coming down with a cold, symptoms on a network can indicate when problems are about to occur. You should not only monitor your server and network for its general health, but also walk around the building and talk to your users. We find that a lot of users don't report problems as often as we would like. Sometimes you bump into users who casually tell you about a problem they have that forces them to reboot several times a day. The users just accept this instead of reporting it. We like to consider "walking the floors" as part of our general networkmonitoring scheme.

The network's getting sleepy...very sleepy

Anytime the network begins to slow down, suspect trouble right away and start poking around at the disk space and memory on Windows Server 2003. Bad network interface cards (NICs) in workstations can cause a slowdown because the network tries to work around the malfunctioning board. You can use System Monitor and Network Monitor (NetMon) to poke around and gather information about what's messing up. If you have intelligent hubs on your network that are collecting Simple Network Management Protocol (SNMP)-type statistics to a centralized management console, look at those logs also. Often, they graphically depict a workstation NIC that's acting up.

Yeah man, it's NetMon

NetMon is a Windows Server 2003 utility that enables you to poke around the data on the network in a fashion similar to the way a protocol analyzer works. You can set up your Windows Server 2003 computer to capture frames from the network and analyze what's going on at an error level, protocol level, and more. NetMon is not that fancy because you can't view your entire network. You can view only the incoming frames to your Windows Server 2003 computer on which you install the agent and tools. Ifyou want to view frames in an entire network segment, you have to use NetMon for Systems Management Server (SMS), simply because it's more robust and includes more features.

Network Monitor has two parts : the administrative tool (Network Monitor) and the network protocol (Network Monitor driver). You have to install both of these before you can begin to analyze the frames. Convenience then dictates that when you install Network Monitor, the driver is automatically installed along with it. That was nice of Microsoft.

The Windows Server 2003 installation doesn't install NetMon automatically. It's a service that you install separately and access through the Control Panel. Follow these steps to install NetMon on your server:

1. Choose Start Control Panel Add or Remove Programs.

   The Add or Remove Programs dialog box appears.

2. Click Add/Remove Windows Components.

   The Windows Components Wizard appears.

3. Choose Management and Monitoring Tools, and then click Details.

4. In the Management and Monitoring Tools window, mark the Network Monitor Tools check box, and click OK.

5. Click Next.

6. Ifyou are prompted for more files to complete the installation, do one of the following:
   
   

   1. If you copied your Windows Server 2003 CD to the network, tell the wizard the path of the files.

   2. Otherwise, insert your Windows Server 2003 CD.

After you have everything installed, you can start NetMon through the Administrative Tools area (Start Administrative Tools Network Monitor). Your screen should look similar to Figure 20-3.

Figure 20-3: The Network Monitor in action.

After you've launched NetMon, you can set up filters to capture only certain information. For example, you may not want to monitor NetBIOS multicast information, but you may want to hone in on Internet Protocol (IP) information. You set filters to separate what's captured and what's not.

You can set triggers on events so that "when this happens, take this action." For example, you may not want to capture all the data coming and going on the server. You may be looking for a certain pattern and when that pattern occurs, you want to begin the capture. These filtered captures help you further define what you're looking at in the capture trace.

Tip 

Microsoft has a wealth of information about NetMon that you should become familiar with (Start Help and Support Administration and Scripting Tools Monitoring and Status Tools Network Monitor). Always start with the Best Practices section to learn what Microsoft feels is the best way to set up a particular function on your network.