Path: utzoo!attcan!uunet!ns-mx!iowasp.physics.uiowa.edu!maverick.ksu.ksu.edu!rutgers!ub!boulder!daemon
From: imp@osa.com (Charles T. Lukaszewski)
Newsgroups: comp.dcom.sys.cisco
Subject: Re:  Inaccurate interface statistics/Sniffer
Message-ID: <25609@boulder.Colorado.EDU>
Date: 4 Sep 90 10:13:13 GMT
Sender: news@boulder.Colorado.EDU
Lines: 37

In our experience, the symptoms you describe may derive from one of
both of a combination of two factors.  There may be others.

We have done extensive testing of every major protocol analyzer on the
market and have found the Sniffer to be somewhat inaccurate, sometimes by
substantial amounts, in its current form.  In particular, when the
results of a Sniffer analysis are compared to the interface statistics
of certain computers (VAXes, DG Aviion & Sun tested to date), they do not
match, often by an order of magnitude.  This affects most protocol
analyzers to one degree or another.  We've found the Hewlett-Packard
4972 to be accurate almost 100% of the time, and is an excellent
benchmark for the Sniffer, if you can get your hands on one.  Network
General itself uses the 4972 to test the Sniffer.

If you have twisted-pair ethernet, this may be another source of
discrepancy.  There is a problem in many vendors (at least ODS &
Synoptics - we're still checking Cabletron & David Systems) implementations of
collision handling under 10BaseT.  As there is no distinct collision
detect line under 10BaseT as there is in an AUI cable (10BaseT has
only Transmit & Receive lines), collisions must be communicated to
individual stations through a transmission of a special preamble.
Depending on your network design, that preamble can be transmitted to
the rest of the network.

We have documented this behavior at several client sites, and it seems to
affect Cisco routers more than any other kind of network device.
Specifically, while just about every other network device or node will
ignore the preamble as network "junk", the cisco picks it up as a
network error.  The solution is to place a filtering bridge between
the Cisco(s) and any twisted-pair equipment.  Ciscos should *not* be
directly connected to either ODS or Synoptics hubs if you wish to
avoid this situation.

_______________________________________________________________________________
Chuck Lukaszewski                imp@osa.com                       612 525-0000
Managing Partner & Chairman                       Open Systems Architects, Inc.
 "Who needs a disclaimer? I liked the opinions so much, I bought the company."