No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of APconnections, Inc. APconnections, Inc. // 303.997.1300 // www.netequalizer.com...
Where to Install NetEqualizer ................. 5 Setting up the NetEqualizer..................6 Factory Default IP Settings ....................6 Accessing the NetEqualizer via the Web GUI IP ............... 6 Cabling the NetEqualizer into your Network ................6 Configuring the NetEqualizer ..................... 8 The NetEqualizer Dashboard ...................
Page 3
Appendix 2 - Setting/Forcing LAN Speeds and Duplex ........... 83 Appendix 3 - Packet Capturing for taps such as CALEA ..........85 Appendix 4 - NetEqualizer Caching Option (NCO) ............87 Appendix 5 - Tuning Parameters for a Large Number of subnet-ranged Limits, Pools, & Masks ..88 Appendix 6 - Syncing NetEqualizer Date/Time ............
Page 4
NetEqualizer Quick Start Guide. It also includes appendices describing our add-on modules. Once up and running, it is a good idea to review this entire NetEqualizer User Guide, to become familiar with all of the advanced features available to you.
User Guide Where to Install NetEqualizer NetEqualizer can be installed on any link whose traffic you would like to shape. For maximum effectiveness, most users should install NetEqualizer between the network users and the Internet trunk. Traffic running between your network and the Internet is generally a constriction point in traffic flow where many users compete for this limited resource.
API. Accessing the NetEqualizer via the Web GUI IP To access the NetEqualizer via the Web GUI IP, plug a laptop/PC into your Switch, and then set to the 192.168.1.x range (x not 143) to access the NetEqualizer. Once you...
Page 7
Once your machine is on & connected, you should see green lights in the Power LED, Eth0, and Eth1 LEDs, as in the above picture of the LED panel. Note: We recommend that you install your NetEqualizer on a UPS, to protect from power surges and outages.
Accessing the NetEqualizer via the Web GUI Once you login to the NetEqualizer, your next steps in setting up the NetEqualizer will be to configure your IP settings, set your passwords, install your license key, and set the date/time and time zone for your NetEqualizer. All these functions are found under the...
NetEqualizer. Think of the Dashboard as your command and control center for managing your NetEqualizer. On the picture below, the key elements that make up the Dashboard are labeled: Status Indicators, Navigation Menu, Common Tasks, and NetEqualizer Menus.
Page 10
To make sure you know what date/time and time zone you have set, we display that as well. The Dashboard can be set to Auto Refresh (On/Off), at available intervals of 5, 10, or 30 seconds, which should work for most users. Note: The NetEqualizer Dashboard is available in Software Update 6.0 and above.
This process continues until network congestion eases. NetEqualizer is the only tool on the market to offer bandwidth shaping in these 3 modes: Equalizing only (simplest) Equalizing Rules = on. Custom Rules have not been defined.
Page 12
[Start Equalizing]. Equalizing in Action Once NetEqualizer is installed and running, a review of the NetEqualizer Log File will allow you to monitor and analyze how NetEqualizer is responding to your network’s traffic. To see the last 25 lines of the log, from the Dashboard, Click on ->...
RATIO parameter refers to the network utilization on a percentage basis. RATIO can be set from 1 to 100. A value of 100 tells NetEqualizer not to have the default rules kick in until the trunk is 100 percent utilized; a value of 85 would have the rules kick in at 85 percent utilized.
(Bandwidth Down). NetEqualizer allows for different speeds for outbound and inbound links, as equalizing shapes bi-directionally. These parameters are set in bytes/per second, and are used by the NetEqualizer so it can react and take action when your trunk is nearing capacity.
Penalty Unit (PENALTY_UNIT) (units are 100ths of seconds, Default = 2) PENALTY_UNIT is the unit of time that NetEqualizer will start with when delaying a packet of Internet data. It iteratively increases penalties by this value should a “hog” not respond to the initial penalty.
Page 17
ANCIENT (units are seconds, Default = 20) Ancient is no longer visible on the NetEqualizer GUI. The Ancient parameter is how long to keep a penalty in effect, in seconds. The preset value for ANCIENT from our factory- delivered NetEqualizer is designed to handle any size network and need not be changed.
(slowed down). When NetEqualizer sets a penalty on a connection, it assigns a “delay” buffer to this connection to slow it down. NetEqualizer reserves a finite number of “delay” buffers when it powers up.
User Guide no activity is detected. Generally, we are not interested in connections that are idle. For example, a value of 200 for this parameter instructs the NetEqualizer to “cancel” tracking a connection after 2 seconds. Viewing your Equalizing Parameter Settings...
NetEqualizer enables you to limit the amount of bandwidth a specific IP address or set of IP addresses can use. There are two ways to configure this in the NetEqualizer, to best meet your needs.
Page 21
Make sure when setting up your Connection Limits that you do not create an overlap between subnetted Connection Limits (/24, /16, etc.). The NetEqualizer does not support an overlap between subnetted Connection Limits. For example, this is NOT allowed, as the subnet ranges overlap.
Limit as high as sixty (60) to facilitate online game playing. Note: When you first set up a Connection Limit for an IP address, NetEqualizer will not drop existing connections over the limit. We wait until the overages die off or finish, but in the meantime the IP address cannot open any more connections.
Page 24
1. Dynamic Hogmin 2. Dynamic Hogmin Connections Dynamic Hogmin When turned on, NetEqualizer will allocate bandwidth based on the number of connections a given IP is using. To set Dynamic Hogmin, click on the drop down box and select ON.
Note: You cannot assign a Bandwidth Limiting Rule to an IP address that physically sits on the WAN side of the NetEqualizer. For example, you cannot put a hard limit on an Internet site such as yahoo.com. If you do, the Hard Limit will be ignored. This makes sense, as the NetEqualizer is intended to manage your internal (LAN) IP addresses.
In order to make bursting a “special” feature, it obviously can’t be on all the time. For this reason, by default the NetEqualizer will force a user to wait 80 seconds before they can burst again.
NetEqualizer to accommodate cases where bandwidth is advertised and sold as "you are one of n customers sharing x bandwidth". Think of a pool as a "virtual NetEqualizer". You can group users into logical trunks by IP address and apply equalizing technology to each logical group (bandwidth pool).
Bandwidth Pools can number from 1 to 300; up to 300 different bandwidth pools per NetEqualizer (< 4.5 the number is limited to 40). Note: If you plan to set up a large number of subnet-ranged Pools (>=32 subnet ranges), you will need to set several tuning parameters.
VLAN. For example, if you set the download limit on a specific VLAN to 192,000 bytes per second (T1) and the VLAN usage level reaches 85 percent, the NetEqualizer will begin to penalize any connection exceeding the value of HOGMIN within the VLAN.
Equalizing Rules. However, some organizations need to setup Bandwidth Priority Rules for specific traffic types. There are two types of priority that you can set up on the NetEqualizer: 1) traffic with priority over equalizing, and traffic hidden from equalizing.
Note that if you set too much priority traffic, you will push all your remaining traffic into a very small window. Factory delivered, NetEqualizer defaults are set to perform congestion control on your trunk when it becomes 85 percent full. In most cases, important business applications, such as VoIP, citrix, blackboards, web browsing, and e-mail will receive preferential treatment, and therefore there is no need to assign priority.
Click on -> Start Priority by Whois. Note: These rules do not persist upon a restart or reboot. When you stop and start the NetEqualizer process or reboot your machine, you will need to run Start Priority by Whois again to add these back into memory.
Page 37
User Guide use masking. NetEqualizer is typically setup on your Internet link, and does not see Local Traffic. Note: If you plan to set up a large number of subnet-ranged Masks (>=32 subnet ranges), you will need to set several tuning parameters. Please see...
In order to work with the quota commands, you must first start the Quota System. If not started, the other commands will return with errors stating "quota server busy or not running". You can use the new NetEqualizer Dashboard to see if the Quota System is running.
Page 43
However, the current class of NetEqualizer systems do not have disk drives (for a variety of good reasons), and so we have not incorporated this into our Quota System.
Click on -> [Remove MAC Rule]. Any time you add or remove an authorized MAC address, you will need to restart the NetEqualizer Firewall for the change to take effect. Go to the Setup and Configuration Menu, Click on -> Manage Firewall Settings ->...
Note: You can store and view up to one (1) month of data on the NetEqualizer, if you are running version 4.5 or greater. To view additional history, you can set up a process to dump data periodically to a separate ntop server.
User Guide Dynamic Real-Time Reporting (RTR) One of the things that has always differentiated the NetEqualizer from other monitoring and shaping tools is that we have the actual data for every user accurately updated by the second. Thus, we are able to make shaping decisions based on usage every second. This sets us apart from other network tools that report on traffic.
As of software update 7.4, we have added real-time graphical traffic reporting to the NetEqualizer. Traffic Reports enable you to quickly see how busy your network has been over a period of time, or hone in on an individual IP for analysis.
Page 55
User Guide For Traffic Reporting by IP, you need to also let the NetEqualizer know which IPs you would like to report on. To do this, click on ->[Add a Subnet to IP Tracking] and then type in a subnet (not greater than a /24) that you would like to track.
User Guide Top Once (back) View this report to check out what processes are running on your NetEqualizer. Use this report to see how much CPU is being consumed by each process. Useful in troubleshooting efforts. From the RTR Dashboard, Click on ->[Top Once].
Click on -> [Show the Log] to view 25, 50, or 100 lines of the log. In the NetEqualizer Log File, you will see three main types of entries, discussed below: 1. Traffic Up and Down - Traffic flowing on your network in bytes/second.
Page 58
User Guide Sample NetEqualizer Log File Above is an example of a NetEqualizer Log File. Yours may differ slightly, depending on your NetEqualizer model. In this example, we have highlighted three (3) lines: The first shows a penalty being DECREASED. Penalties are being applied where it says "PENALTY".
The View P2P Report contains a record list of suspected P2P traffic for an IP or subnet. Although the NetEqualizer has long been able to thwart both encrypted and unencrypted P2P behavior without any controversial layer-7 packet inspection, the View P2P Report can automatically pinpoint and identify an individual P2P user or gamer without looking at any private data.
Curious about how much bandwidth a particular IP address, Pool, or VLAN is utilizing on your network? Our Instant Report enables you to query instantaneous bandwidth usage in real-time right from the NetEqualizer Web GUI. This enables you to measure a customer’s current bandwidth utilization by IP, VLAN or Bandwidth Pool, allowing you to...
User Guide Email Notifications You can set-up an email account to receive alerts and notifications from the NetEqualizer. Notifications (email alerts) can be sent either immediately, or if you prefer less email, they can be batched up and sent out once per day.
Note: We do not recommend that you run trend analysis and graphs (via ntop) on the NetEqualizer Lite, due to the load on the CPU. If you need trend analysis and historical reporting, you should consider the NetEqualizer 2000 series.
If you do get ntop in a state that you cannot resolve, then your best option to fix it is to get a new software image file, by contacting our Support Team at 303.997.1300 x102 or emailing support@apconnections.net. You will need to have purchased for your unit.
Creating a Reporting Data Warehouse (back) Typically, you can store up to 1 month of reporting (ntop) data on your NetEqualizer. However, as the reporting data is stored in NetEqualizer memory (RAM), we recommend that if you plan to use historical reporting often, consider setting up a Reporting Data Warehouse to store your reporting (ntop) data.
User Guide Redundancy and Failover If you are concerned about passing traffic if your NetEqualizer goes down, either for scheduled maintenance or due to an unplanned failure (i.e. power outage, equipment failure, etc.), you might want to consider building in a plan for either: 1) full redundancy, or 2) failover.
If you do not need full redundancy, but would like a failover solution to ensure that your network continues to pass traffic if your NetEqualizer goes down, you can configure a STP- capable switch to bypass the NetEqualizer. You can use your own switch or try our...
User Guide Maintenance Tasks Powering Off the NetEqualizer If you ever need to shutdown the NetEqualizer (not just a reboot), here is a graceful way to do that: Go to the Maintenance and Reference Menu, Click on -> Maintenance -> [Run A Command].
Page 73
CF card. Two CFs are provided with each NetEqualizer (one in the unit, and a backup CF in the Accessories Box). You can round-robin your CFs. Please be aware that when you replace the CF you replace every file and setting, as this is no different than putting a new hard drive into a system and removing the old one.
User Guide Troubleshooting This section of the User Guide contains some ideas to troubleshoot your NetEqualizer. For our full Support Archive, please go to our NetEqualizer News blog site. You can also review Advanced Tuning library, recommended for NetEqualizer power users. Finally, you can contact Support at support@apconnections.net...
Page 76
303.997.1300 x102 or support@apconnections.net. I cannot get traffic through the NetEqualizer (back) Can you put a keyboard and monitor on the NetEqualizer and see if there are any errors showing up on screen? From the Troubleshooting and Support menu, Click on-> Troubleshooting, then Click on ->...
Page 77
Save Page As… filename.txt, and then enter a valid text file filename. Attach the file to an email and send to support@apconnections.net, along with a description of the problem you are encountering. Once your file is received, Support will review your diagnostic file, and contact you to help troubleshoot your system.
Go to the "NAME=" parameter line in the file and change whatever is listed after the equal sign to what you want to call this NetEqualizer. For example, if you decided to name by location, you might have a NAME=BoulderNetEQ.
Page 79
When you do your initial testing on Bandwidth Limits (bandwidth limiting rules), use file transfers that persist for more than 15 seconds to allow NetEqualizer to come to a steady rate of data transfer. APconnections, Inc. // 303.997.1300 // www.netequalizer.com...
Page 80
However, the NetEqualizer will allow some bursts through. As NetEqualizer takes a few seconds to adjust to changing traffic situation, if you are testing with one or two large downloads, the bursts will be more pronounced than traffic on a busy network.
Occasionally you need to manually set LAN Port Speed and Duplex in order for the NetEqualizer to operate at the expected port speeds and in the correct duplex mode. The NetEqualizer LAN ports auto-negotiate 95% of the time. However, the NetEqualizer may need to be manually set to work with some Routers or Switches.
CALEA module is not covered under NSS, consulting charges may apply. For additional information on CALEA, go to: http://transition.fcc.gov/pshs/services/calea/. The NetEqualizer is set up as a CALEA Probe in two steps, which must be executed in the order below: 1.
Page 86
Set up the port to listen on: On the receiving computer, run the command line of: nc -l -p XXXXX where XXXXX is the port you want to listen on, and that you setup on the NetEqualizer to send on. Pipe results to a File (optional): Netcat can be piped to a file using the >...
We have developed an embedded caching capability used to cache frequently used, static content, primarily YouTube videos. The NetEqualizer Caching Option (NCO) runs directly on the NetEqualizer 3000 and 4000 series. When NCO is activated, a squid proxy server and web cache daemon are loaded, along with proprietary NetEqualizer Caching configuration and integration software and a new internal solid-state drive (SSD).
Tuning for a Large Number of subnet-ranged (>=32 subnet ranges) Connection Limits, Hard Limits, Masks, Pools, and VLANs The NetEqualizer currently simplifies your configuration set-up by enabling you to enter Hard Limits, Connection Limits, Masks, and Pools as “subnet ranges” (i.e. HARD x.x.x.x/24 or /16), instead of as individual rules.
/root/settime.sh and /root/crontab files from the command line or SSH with a text editor. Note: You must have NetEqualizer setup so that it can access the Internet for this to function. Note: You must make sure that ntop is not running, or stop ntop, before changing the time on your NetEqualizer.
Page 90
Click on -> [Submit] to save. Go to the NetEqualizer Dashboard, scroll down if needed, and refresh your screen. Make sure the Date/Time is set to your Past Date/Time. Now wait 5 or more minutes (the cron job runs every 5 minutes), go back to the Dashboard, and refresh your screen again. Make sure that the Date/Time is now Current.
User Guide Appendix Appendix 8 - Firewalling the NetEqualizer This appendix is for customers that need to install the NetEqualizer outside of their firewall, on the public side of their Internet pipe. Firewall rules are provided to prohibit unauthorized users from accessing the NetEqualizer IP and thus SSH access and the NetEqualizer Web GUI screen.
Directory Integration has the obvious benefit of utilizing known usernames from your system to identify data flows & activity in the NetEqualizer, rather than IP addresses. As you can imagine, this could make it much easier to trace activity back to a particular user.
Page 95
IP and returns a random user name, to serve as an example of the format of the NDI API. You can run this on your NetEqualizer box, as long as you have Software Update 7.0 loaded. From the Maintenance and Reference Menu, Click on ->...
Page 96
Our first extension of the NDI, Named Quotas, is available for Beta Test. With Named Quotas, once the generic NDI API is setup, the data is used by the NetEqualizer to provide status for User Quotas. This makes the User Quota capability even more meaningful, as quotas are tied to a consistent user’s name rather than an IP address.
Need help?
Do you have a question about the NetEqualizer and is the answer not in the manual?
Questions and answers