The most recent articles from vnunet.com

Review: Ipswitch WhatsUp Gold Premium 12.3

Dave Bailey — 2009-02-03T10:37:00.000Z

Dave Bailey, vnunet.com, Tuesday 3 February 2009 at 10:37:00

Network monitor expands functionality through plug-ins

The Premium edition of Ipswitch WhatsUp Gold 12.3, launched in October but with several plug-ins added at regular intervals, helps IT managers to monitor networks and application performance in a package that's designed to be easy to install and manage.

However, configuration can be time consuming depending on how many devices or applications need to be monitored.

Three new plug-ins are now available for use in version 12.3, the first being WhatsUp Gold VoIP Monitor, which was launched before the 12.3 upgrade last June. This allows users with Cisco hardware running its Internetwork Operating System to use the IP service level agreement feature to assess a network's suitability to run VoIP, or to measure VoIP performance.

The plug-in provides mean opinion scoring (MOS), calculated planning impairment factor quality scoring as well as measurements of latency, jitter and packet loss. MOS threshold alerts are provided through an active Simple Network Management Protocol (SNMP) monitor.

The other two plug-ins are NetFlow Monitor, launched in October to take advantage of routing and traffic flow information provided by NetFlow-enabled network hardware, and a layer 2 topology WhatsConnected plug-in launched in December.

WhatsConnected takes layer 2 and layer 3 and can help IT managers visualise device connectivity down to port level, and then integrate that information with the main WhatsUp Gold package.

Version 12.3 now supports Windows Server 2008, Vista Ultimate and Vista Business. Vista can be used as a Windows management instrumentation monitored operating system, and as the actual monitoring workstation itself.

We installed the package on systems running Windows XP Professional and SQL Server, which took up the majority of the time. Customers can use the standard SQL Server Express or choose to connect to a running SQL Server database instance. We chose the Express install and within 10 minutes we could specify IP subnet ranges for the package to pick up the devices connected on our Labs test subnet.

Users can set up a web server to access WhatsUp Gold remotely, but we chose to access the device through a LogMeIn Pro service.

After opening firewall ports for specific protocols, and making sure that SNMP was running on workstations and other network hardware, we could use the 'discover devices' option to poll and discover our network devices. It correctly picked up our switches, servers, network-attached storage (NAS) device, wireless firewall router and wireless access point using a standard IP range scan. There are options to use an SNMP Smartscan, Network Neighbourhood scan or to import the local area network manager (LMhosts) file, which gives name resolution of the Windows NetBIOS host names to IP addresses.

After discovering all our devices, we could then set up the device dependencies and have alerts via email if devices go down or if specific parameters are out of defined bounds. Pager and SMS alerts can also be generated if a modem is connected.

Clicking on a device brings up a dialogue allowing users to add performance monitors, active monitors or passive monitors. Performance monitors can be set using Active Scripts, SNMP or Windows management instrumentation. If a large number of alert conditions need to be monitored, this could require setting up a lot of monitors, although WhatsUp Gold is charged per network device, not for the number of monitors.

The alternative would be to deploy an expert in Active Scripting with the ability to write Visual Basic or Java scripts.

Active monitors are used to query network events occurring on devices, like interface status for switch ports. Passive monitors can be used to monitor SNMP traps, syslog messages or Windows events. For example, an anti-virus program writing to syslog might only be picked up by a passive monitor checking the Windows event log.

For instance, we could create a performance monitor to check disk space remaining on our NAS device, or system memory usage on our 64-bit Windows Server 2008 system. We could also set up an active monitor to check switch connectivity from selected ports on our Zyxel ES-3148 switch. However, manually trawling through the myriad monitors that can be set up to test for system problems is not a trivial task.

After discovery it is possible to set actions if defined attributes go over or under defined thresholds. For instance, it was simple to set up an SMTP server to send an email if critical state changes to important network hardware or servers occurs. Some devices, however, can take time to settle down and could send too many emails if monitors and actions are not properly configured.

The new WhatsConnected plug-in runs through an easily traversable wizard. Users are first asked to name the discovery method they wish to use, and then what kind of sweep to use - an address resolution protocol cache sweep or a standard ping.

After this a seed IP scope can be entered, and there are options to add or exclude different IP subnets. Once the network has been discovered and connectivity automatically generated, this topology can be imported back into WhatsUp Gold, shortcutting the need to connect devices to each other manually.

Overall, WhatsUp Gold 12.3 is a good monitoring and troubleshooting program which, aside from the odd minor glitch, performed admirably, although it faces a lot of competition in the network monitoring market.

Apart from the Standard and Premium editions, there are also Distributed and managed service provider packages. The Standard and Premium versions are priced at £3,013 + VAT and £4,188 + VAT respectively, for monitoring 500 devices.

Review: Spiceworks IT Desktop 3.5

Dave Bailey — 2009-01-21T11:59:00.000Z

Dave Bailey, vnunet.com, Wednesday 21 January 2009 at 11:59:00

Free network management package targets larger firms with up to 500 networked devices

Version 3.5 of the free Spiceworks IT Desktop network management package, launched last week, adds several new features and now targets larger firms, although not yet large corporate enterprises.

Spiceworks saw the light of day in October 2006, and the first release was good for around 250 devices. Since then the software's network discovery has improved to the point where up to 500 devices can be scanned efficiently and, although it can work over the 500 limit, Spiceworks admitted that it will "not be as fast".

Spiceworks IT Desktop can perform network inventory and run a basic helpdesk, as well as provide functions enabling IT administrators to monitor, troubleshoot and report on their networks.

The browser-based package also puts users a step away from an IT administrator community, which could cut the time spent troubleshooting an irritating issue by supplying the answer much more quickly than support calls to other better known network management package vendors.

As with the previous version, Spiceworks can only run on Windows operating systems, with support for XP, Vista, Windows Server 2003 and Windows Server 2008. Although it will discover Linux, Mac and Unix systems, it will not run on them.

We downloaded the 17MB file and installed the package on a system running Windows XP with an Intel dual-core 3.2GHz processor and 2Gb of memory. We did try Spiceworks on a Server 2003 Enterprise Edition install, but that meant having to decrease browser security properties.

The first thing to do on start-up is to register your email address to log in to the package, which gives you the initial 'dashboard' screen showing all the IT management functions available, and the default setup as a variety of widgets showing things like Spiceworks news, current Microsoft security patches and others.

The next thing is to run an initial scan to pick up all the devices connected to the network. It picked up our router, switch, workstations, servers, wireless access point, printer and NAS backup device.

We could then customise Spiceworks to alert us when specific conditions arose, such as supplies running low on a printer, or a desktop's anti-virus signatures not being up to date, although only a subset of anti-virus packages are supported, namely those that support Windows Security Center. Alert notification involves setting up an email server, but as yet there are no facilities for SMS.

Version 3.5 contains a number of significant new features, one of the most useful being a 'timeline' widget that lists all the events occurring on your network, the last event uppermost. This could give several clues as to why particular failures on your network have occurred.

Spiceworks also now integrates with the enterprise-class open source Nagios monitoring system, and can pick up alerts from that package.

Another feature is the ability to create new dashboard pages, which we used to separate network devices such as switches and routers from the management of desktop and server hardware systems. It was also easy to set up separate pages for printers and wireless devices.

There's also a new network bandwidth analyser for checking traffic for simple network management protocol-enabled devices over a configurable timeline, and the facility to create custom SQL reports through a built-in SQL editor, which can insert graphical displays exportable to dashboard pages.

An extraordinary number of features are built in to this package, and we would recommend at least giving it a run on a test subnet as a check against the feature list of your current system.

Perhaps a downside for some IT administrators is that the software is supported by 'targeted' technology adverts occupying screen space alongside the Spiceworks graphical user interface (GUI).

It seems that in this new version the adverts are occupying more space than when we last reviewed the package. The ads used to occupy around a quarter of the screen on the right-hand side of the GUI, but this time we saw an advert on the bottom left-hand side of the screen as well.

As to how intrusive the ads are, most people probably tune out this 'noise' anyway, or like to think they do. It's not like the TV where adverts occupy 100 per cent of the screen space.

Firms wishing to use the extra screen estate without the adverts can pay a $220 per year subscription.

First Look: Spiceworks IT Desktop 3.5

Dave Bailey — 2009-01-16T10:48:00.000Z

Dave Bailey, vnunet.com, Friday 16 January 2009 at 10:48:00

Free network management package still going strong

Version 3.5 of the Spiceworks IT Desktop free network management package has finished beta testing and is now available to download and install.

The software can create an inventory of your network, run a helpdesk, and act as a network monitor, trouble shooter and reporter. The browser-based package can also put users in touch with an IT administrator community that may have experienced the same issue and are able to offer a solution.

We downloaded the 17MB file and installed the package on a system running Windows Server 2003 Enterprise Edition with an Intel dual-core 3.2GHz processor system and 2Gb of memory.

Starting the system and registering your email address to log in to the package gives you an initial dashboard screen, which has all the IT management functions currently available, such as network scans and helpdesk access.

After an initial network scan to pick up all the devices connected to the network, Spiceworks can then be customised to alert IT managers when specific conditions arise, for example if supplies run low on specific printers, or if a desktop anti-virus signature is not up to date.

Among the myriad new features in version 3.5 is the ability to timeline all the events occurring on your network, which could give some clue as to why a particular failure occurred.

Users can also now create customisable dashboards as separate pages and install widgets onto these pages. Spiceworks has also put in a new network bandwidth analyser for checking traffic for simple network management protocol-enabled devices over a configurable timeline.

The number of features built in to this software is extraordinary, and it should at least be 'test driven' by IT administrators to check it against their current solution, unless it is being provided by a managed service provider that is already using Spiceworks.

The vendor said that the package is aimed at firms with 500 or fewer devices and, although it will work over that limit, "it won't be as fast".

As before, Spiceworks can be run only on Windows operating systems, with current support including XP, Vista, Windows Server 2003 and Windows Server 2008. So, although it will discover Mac, Linux and Unix systems, the software will not run on these operating systems.

The downside for some IT administrators is that the software's research and development costs are offset through 'targeted' adverts occupying screen space alongside the Spiceworks graphics user interface.

How intrusive were the ads? Well, most web sites have ads and most people just tune out this 'noise' anyway. It is not like the TV, where adverts occupy 100 per cent of the screen space; the Spiceworks ads occupy only about a quarter of the screen estate. For $220 per year, Spiceworks can be 'sponsored' and the adverts removed.

We'll be putting out a full review of Spiceworks IT Desktop 3.5 later.

Review: Colasoft Capsa 6.9 Enterprise Edition

Dave Bailey — 2008-12-19T10:09:00.000Z

Dave Bailey, vnunet.com, Friday 19 December 2008 at 10:09:00

Network protocol analyser troubleshoots, monitors and checks network performance

Launched in November, Colasoft's Capsa 6.9 network protocol analyser has an uphill fight to disturb the leaders in this particular space, mainly because the market has moved on from straight network protocol analysis to digging directly into application network streams.

The network packet analysis market is currently crowded, with systems ranging from free open-source products like Wireshark, to high-end systems from better known vendors like Network Instruments with its Observer package.

The main new features in Capsa 6.9 are the ability to decode Cisco's Inter-Switch Link protocol to virtual local area network information as traffic negotiates switch and router network paths, and support for the Fibre Channel over Ethernet protocol.

Capsa 6.9 Enterprise Edition is currently certified for Windows 2000 Professional, XP Professional, Vista, Windows Server 2003, and Windows Server 2008, as well as 64-bit versions of these operating systems.

Network support extends from 10/100Mbit/s systems to gigabit connectivity, and has microsecond timestamp capability. Firms with a simple network can deploy a straight network connection, but managed switches need port mirroring or test access ports if specific network segments need traffic captured.

We installed Capsa 6.9 on a variety of systems, including hardware running Windows XP, Vista and Windows Server. We attached to hubs, managed switches (with port mirroring enabled) and took a specific feed off a router through a TAP.

Our Intel 'whitebox' server, which had DHCP and Active Directory installed, had a quad-port Intel PCI network interface card (NIC) connected to various s ubnets, as well as to an ADSL router for internet access. Capsa picked all four ports up as well as two extra NICs attached to the motherboard.

It was easy to capture and filter network traffic and use the diagnosis analyser to check different network layers. For example we could check for application layer problems like DNS server errors, and troubleshoot simple mail transport protocol problems.

The GUI is simple to negotiate and a few clicks were sufficient to pull network traffic off all our NICs, and perform quite detailed analysis. The provision of easy access web resources on a sidebar was another neat touch, addressing network technicians still new to network protocol analysis.

However, we could not see any alerting for paging network administrators or technicians, or configurable trigger functions to automatically react to adverse network events.

One area where the competition has a clear advantage is the ability to run on dedicated hardware with certified NICs. Competitors like Network General, Network Instruments and WildPackets all have turnkey appliances able to take 10 Gigabit Ethernet network traffic straight to terabyte-sized storage arrays for detailed forensic analysis.

Overall, Capsa is a pretty comprehensive package for network analysis, but users requiring high-end features, like the ability to analyse 10 Gigabit Ethernet connections in real time, may need to look at more expensive systems with dedicated hardware.

Colasoft did tell us that it is considering a move to address larger enterprise networks in the future.

Review: GFI LANguard 9.0

Dave Bailey — 2008-12-12T11:32:00.000Z

Dave Bailey, vnunet.com, Friday 12 December 2008 at 11:32:00

Vulnerability scanner gets new automation capabilities to ease IT admin burden

Launched in November, version 9.0 of GFI's LANguard network scanner includes a wide range of enhancements designed to make the lives of network administrators easier, including the ability to detect whether a desktop system is real or running as a virtual machine (VM).

Other new features accessible via the refreshed interface include better hardware auditing capabilities and a facility for firing up a remote desktop connection in the event that a system’s security issues cannot be fixed automatically.

Also new is the ability for LANguard to check if there are any unauthorised applications on the network, and automatically remove them. IT administrators need to define what applications to classify as unauthorised.

LANguard’s dashboard can now summarise all scan results, give an overview of the most highly vulnerable systems, and trend the security status of the network. GFI has also implemented custom vulnerability checks defined in the Python language.

We downloaded the package and installed it on a variety of desktop and server systems. The install took a little under 10 minutes, with most of that time taken up by the Microsoft Access database installation used to store scan and asset management data, although for larger networks IT managers can choose to point scan data at SQL Server installations.

Setting up a complete network scan was pretty straightforward, although we did have to log on to several systems to enable the NetBIOS protocol.

There are a large number of predefined scans provided by GFI, including ones for specifically auditing installed software or for a network vulnerability assessment. Network vulnerability assessments can be run against a database containing threat signatures from a number of respected security organisations, such as the SANS Institute.

When we scanned our test network LANguard picked up a Windows XP system with 11 missing patches. Fixing the system was a simple matter of downloading the patches and remote installing them. LANguard’s vulnerability reporting gives useful web links relating to any problems it finds.

Running the software and hardware audits quickly pulled out useful information about the configuration of our scanned systems. We could then “baseline” these systems as a way of detecting any subsequent changes to the state of their hardware and software. As well as being able to use LANguard to manually classify packages as being unauthorised, admins can set up the system so that it automatically removes unauthorised applications.

New to this version is the ability to pick up VMs running on systems connected to the network. LANguard detected and scanned a laptop on our test network with VMware’s Workstation version 6.5 running XP Professional and Vista Enterprise VMs.

The only minor niggle was that when we analysed the scan results, any errors in the scanner activity window were flagged with information as to what went wrong but not how to put the problem right.

On the whole though, LANguard 9.0 performs impressively as a proactive risk management package, as well as an asset manager and network vulnerability scanner.

First Look: Colasoft Capsa network analyser

Dave Bailey — 2008-11-03T15:33:00.000Z

Dave Bailey, vnunet.com, Monday 3 November 2008 at 15:33:00

Enterprise-grade package offers network troubleshooting and automatic diagnosis features

Launched last month, Colasoft's Capsa network analyser is an enterprise-grade professional network analysis package that captures real-time network traffic and performs protocol analysis and decoding.

Colasoft is also touting the automatic diagnosis and troubleshooting features of its software.

The network packet analysis market is currently a crowded one, with systems ranging from free open source products like Wireshark, to high-end systems from better known vendors such as Network Instruments with its Observer package. Observer can also run on high-end hardware able to store and forensically analyse terabytes of captured network packet data.

Colasoft Capsa 6.9 is certified for Internet Explorer 5.5 but can use more recent versions of the browser. It will run on 32-bit systems including Windows 2000 Professional (SP4 minimum), XP Professional (SP2 minimum), Vista and Windows Server 2003.

Windows XP, Vista and WS 2003 64-bit systems are also supported, but not currently Windows Server 2008. Network support extends from 10/100Mbit/s systems to gigabit connectivity, and has microsecond timestamp capability.

Aside from some GUI reporting options being enhanced, new in this version is the ability to decode Cisco's Inter-Switch Link protocol, which keeps virtual LAN information consistent as traffic negotiates switches and routers. Support for the Fibre Channel over Ethernet protocol has also been included.

Before installing the product, users need to check how their networks are set up. A straight connection can be used if hubs are deployed, but port mirroring needs setting up with managed switches. If specific segments need to be looked at, firms may need to deploy a test access port.

We installed Capsa 6.9 Enterprise Edition on a variety of systems including hardware running Windows XP, Vista and Windows Server operating systems. We could attach to hubs and managed switches with port mirroring enabled, and also take a specific feed off a router through a test access port.

We could quickly capture and filter network traffic and use the diagnosis analyser to check different network layers. For instance, we could check for application layer problems like DNS server errors, and troubleshoot simple mail transport protocol problems.

The GUI is powerful and simple to negotiate, and a few clicks is all that's required to pull network traffic off just about any interface and perform quite detailed analysis.

In conclusion, Capsa is a comprehensive package for network analysis, but users requiring high-end features, like the ability to analyse 10 Gigabit Ethernet connections in real time, may need to look at more expensive systems with dedicated hardware.

We'll be taking a more detailed look at this package later.