Chapter 4: Deploying Probes In Your Network; Deploying Probes In Your Network; Monitoring Half-Duplex And Full-Duplex Ethernet Links - Network Instruments GigaStor User Manual

Chapter 4: Deploying Probes in your Network

Deploying probes in your network

You need visibility into every corner of the network, from the edge to the core. A distributed analysis solution
can provide the coverage you need, but where should you deploy probes for maximum visibility at minimum
cost? Because every network is different, the examples shown may not look like your network, but the concepts
demonstrated will be applicable to most situations.
Successfully deploying a distributed analysis solution on your network requires that you understand some basic
concepts about distributed analyzers and network technologies.
In deploying probes, make sure that you understand the visibility requirements unique to your deployment
goals and the design of the network you are analyzing. For 100% visibility of traffic:
Deploy TAPs and specialized high-speed probes on core switch connections to servers, server farms, and
other critical network infrastructure.
Deploy less-costly probe appliances on switch monitor (e.g., SPAN/mirror) ports at the edge of your
network.
Most commercial packet analyzers, like Observer, are distributed. Packet captures and some analysis are
performed by distributed agents called probes, which in turn send the packets (or the analysis results–e.g.,
bandwidth utilization statistics, most active stations, etc.) to analyzers for further processing and display.
Distributed analysis is the only practical way to make different parts of a switched or wireless network visible and
therefore manageable. From a single analyzer you can monitor and view traffic from anywhere on the network
where a probe has been deployed, from any type of media or topology (Ethernet, wireless, and so on).

Monitoring half-duplex and full-duplex Ethernet links

If your IT department is typical, you have a limited budget. Therefore, before you spend any money on analyzers,
TAPs, and probes, you should assess what kinds of traffic you need to see and what kinds of traffic you want to
see for effective network management. This allows you to deploy the correct technology needed to meet your
particular goals.
On wired networks with multiple switches, most of the stations are plugged into half-duplex ports, even if the
backbone or server connections are Gigabit Ethernet or greater. Being able to see the traffic local to each switch
at the edge can give you insight unavailable from tapping the core connections. For example, client-to-client
communications are invisible from the backbone or server connections. It can also be useful to isolate a segment
Deploying Probes in your Network | 23