
              NOVELL TECHNICAL INFORMATION DOCUMENT

TITLE:              Frequent Questions about LANalyzer for Windows
DOCUMENT ID:        TID200014
DOCUMENT REVISION:  B
DATE:               05NOV93
ALERT STATUS:       Yellow
INFORMATION TYPE:   Issue
README FOR:         NA

NOVELL PRODUCT and VERSION:
LANalyzer for Windows 2.0

ABSTRACT:

This file contains the most frequently asked questions and answers about the
LANalyzer for Windows 2.0 product.

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

DISCLAIMER
THE ORIGIN OF THIS INFORMATION MAY BE INTERNAL OR EXTERNAL TO NOVELL.  NOVELL
MAKES EVERY EFFORT WITHIN ITS MEANS TO VERIFY THIS INFORMATION.  HOWEVER, THE
INFORMATION PROVIDED IN THIS DOCUMENT IS FOR YOUR INFORMATION ONLY.  NOVELL
MAKES NO EXPLICIT OR IMPLIED CLAIMS TO THE VALIDITY OF THIS INFORMATION.
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA


ISSUE

This document contains information on the most frequently asked questions
about LANalyzer for Windows 2.0:

Q:Does LANalyzer for Windows work with a "True Blue" IBM 8-bit 16/4 Token
Ring board?

A:No.  These IBM boards use the TROPIC chipset and there is a limitation on
the chipset that won't allow it to go into promiscuous mode, which is
required by LANalyzer for Windows.

Q:What does Promiscuous Mode mean?

A:This is the mode in which the network interface card (NIC) receives and
passes on all packets that arrive.  The LANalyzer for Windows network
analyzer monitors network traffic by configuring its NIC to receive every
packet on the network.

Q:What boards are supported with the ODI drivers shipped with LANalyzer for
Windows?

A:3Com
3C503  Etherlink II
3C505  Etherlink + Ethernet
3C523  Etherlink/MC
Cabletron
E20
E21
E2HUB
EXOS
HP MC Adapter/16 Ethernet
HP PC Adapter/8,16,16+ Ethernet
IBM PS/2 Ethernet
LANalyzer Ethernet Board
Madge Smart 16/4 (Token Ring)
NE1000
NE1500T
NE2
NE2_32
NE2000
NE2100
NE3200
SMC Ethercard Plus

Q:Is it possible to configure the LANalyzer for Windows to see through the
server/router?

A:No.  LANalyzer for Windows will only see the packets on the segment that it
is attached to.  (If activity from another segment is transmitted onto the
segment with the LANalyzer for Windows, you will see that activity.)  To see
another segment, you must move the LANalyzer for Windows to that segment. 
However, this functionality is available with NetWare Management System (NMS)
2.0.

Q:Can LANalyzer for Windows decode IBM NetBIOS traffic?

A:No.  It will not decode the IBM NetBIOS packets; however, it will present
you with the MAC-layer header information and a raw hex dump of the rest of
the packet.  It will be included in the utilization, packet rate, error
graphs, and the Station Monitor.

Q:What is the complete list of protocols that LANalyzer for Windows will
decode?

A:NetWare
IPX/SPX
NCP
RIP
SAP

TCP/IP
TCP/IP
SNMP
OSPF

AppleTalk
ATP
AFP
RTMP
ZIP

Q:Are there any patches available on NetWire for LANalyzer for Windows?

A:Yes, there two different patches.  The LZW40.EXE patch gives you NetWare
4.0 decodes, and the LZW143.ZIP file contains the current certified
promiscuous mode ODI drivers for LANalyzer for Windows 2.0.

Q:Does LANalyzer for Windows work with OS/2?

A:No.

Q:Is it a requirement to load APPLE.EXE?

A:No; however, you will lose Apple support if it is not loaded.

Q:Is it a requirement to load NETX?

A:No; however, without it, you lose NetWare name gathering.

Q:Can you give a brief explanation of Server Monitoring?

A:When LANalyzer for Windows is started, server monitoring broadcasts a "Get
Nearest File Server" packet.  For a file server to respond, the file server
must have parameter set to respond to the broadcast request:

          "SET RespondToNearestFileServer = ON"

Also, a known limitation is on NetWare SFT III servers in that they do not
seem to want to respond to the broadcast request, and the SET command is not
supported for some reason.
     
All the servers that respond to this broadcast will be added to the "Server
Monitor" screen.  Not all servers always respond.  For whatever reason, some
might fail to respond every time.  Novell believes that this is due to the
server being busy and that responding to the packet is a low priority.  This
will explain why servers sometimes get in the list and others do not, and it
seems to change.

Now, you have a list of servers to poll.  The idea is to go down the list of
servers, one at a time, and send them a packet.  If they respond, server
monitoring moves on to the next server until it reaches the end of the list. 
Then, it starts over at the top of the list.  One server from the list is
polled ever 15 seconds or so.

If a server fails to respond to the poll, it goes into a "retry" mode. 
Server monitoring tries more frequently to poll the server (every 2 seconds
or so) for three or so tries.  If the server has not replied to even one of
the polls, server monitoring calls it down and send an alarm.  Then server
monitoring just moves on to the next server. When it cycles around the list
again, it still tries the down server to see if it is back up.

After several times through the list, server monitoring "rebuilds" the list. 
The idea here is to get rid of servers that are down for a long time or have
been moved to another segment.  It also picks up new servers that were just
added or came on line since server monitoring started.  The rebuild process
is basically, a throw out the old list and start over with the broadcast
procedure.  Unfortunately the side effects of all this are that servers can
tend to "come and go" from the list.  There is no way to "Fix" or "Set" the
list to poll.  You can only determine the servers you want or do not want.

The easiest way to see this algorithm in action is to set up a capture filter
between "This Workstation" and "ANY."  Let server monitoring run for an hour
or so.  Then "Post Filter" on NetWare SAPs.  You do this by double clicking
on the SAP layer in the decode, and it will appear as follows:

=========== Service Advertising Protocol =============

Router polling is exactly the same except that NetWare RIP packets are used
in place of SAP packets.




y