3Com Traffix Transcend Traffix Manager User manual

®
http://www.3com.com/
Transcend® Traffix™ Manager
User Guide
Software version 3.0 for Windows NT®
Part No. 09-1825-000
Published August 1999

3Com Corporation
5400 Bayfront Plaza
Santa Clara, California
95052-8145
Copyright © 1999 3Com Technologies. All rights reserved. No part of this documentation may be reproduced
in any form or by any means or used to make any derivative work (such as translation, transformation, or
adaptation) without written permission from 3Com Technologies.
3Com Technologies reserves the right to revise this documentation and to make changes in content from time
to time without obligation on the part of 3Com Technologies to provide notification of such revision or
change.
3Com Technologies provides this documentation without warranty, term, or condition of any kind, either
implied or expressed, including, but not limited to, the implied warranties, terms or conditions of
merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or
changes in the product(s) and/or the program(s) described in this documentation at any time.
If there is any software on removable media described in this documentation, it is furnished under a license
agreement included with the product as a separate document, in the hard copy documentation, or on the
removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy,
please contact 3Com and a copy will be provided to you.
UNITED STATES GOVERNMENT LEGEND
If you are a United States government agency, then this documentation and the software described herein are
provided to you subject to the following:
All technical data and computer software are commercial in nature and developed solely at private expense.
Software is delivered as “Commercial Computer Software” as defined in DFARS 252.227-7014 (June 1995) or
as a “commercial item” as defined in FAR 2.101(a) and as such is provided with only such rights as are
provided in 3Com’s standard commercial license for the Software. Technical data is provided with limited rights
only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable.
You agree not to remove or deface any portion of any legend provided on any licensed program or
documentation contained in, or delivered to you in conjunction with, this User Guide.
Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not
be registered in other countries.
3Com, the 3Com logo, LANsentry, SmartAgent and Transcend are registered trademarks of
3Com Corporation. Traffix is a trademark of 3Com Corporation. 3Com Facts is a service mark of 3Com
Corporation.
Adobe and Acrobat are registered trademarks of Adobe Systems Incorporated. HP and OpenView are
registered trademarks of Hewlett-Packard Company. AIX and IBM are registered trademarks of International
Business Machines Corporation. Notes is a registered trademark of Lotus. Netbios is a trademark of Micro
Computer Systems Inc. Microsoft, Visual Basic, Visual C++, Windows, and Windows NT are registered
trademarks of Microsoft Corporation. Java and SunNet Manager are trademarks of Sun Microsystems. Solaris
is a registered trademark of Sun Microsystems. UNIX is a registered trademark of X/Open Company, Ltd. in the
United States and other countries.
All other company and product names may be trademarks of the respective companies with which they are
associated.
Guide written by Emma Cuthbert. Edited by Patrina Law.

CONTENTS
ABOUT THIS GUIDE
How To Use The Traffix Manager Documentation 11
Conventions 13
Terminology Used in this Guide 14
Related Documentation 14
Documents 14
Web Sites 14
Documentation Comments 15
Year 2000 Compliance 16
PART IGETTING STARTED WITH TRAFFIX MANAGER
1TRAFFIX MANAGER OVERVIEW
What to Read First 19
Features of Traffix Manager 20
How Does Traffix Manager Work? 21
Strategy for New Users 23
2LAUNCHING TRAFFIX MANAGER FOR THE FIRST TIME
Installing RMON Agents on Your Network 25
Launching the Traffix Manager Server 26
Launching the Traffix Manager Client 26
Stopping Traffix Manager 28
About the Main Window 28
Grouping of Objects 29
Main Window Reference 29

PART II HOW TRAFFIX MANAGER WORKS
3COLLECTING DATA
How Traffix Manager Processes Collected Data 35
RMON Overview 37
Remote Monitoring 37
RMON-2 Standard 37
How Traffix Manager Discovers Network Devices Using RMON-2 38
4GROUPING NETWORK DEVICES IN THE MAP
Overview 39
Attributes 40
Predefined Attributes 40
Groupings 42
Predefined Groupings 43
Creating and Assigning Attributes 44
Creating Groups and Ordering Attributes 45
PART III RUNNING TRAFFIX MANAGER
5LAUNCHING TRAFFIX MANAGER AFTER THE FIRST TIME
Launching the Traffix Manager Server 49
Launching a Traffix Manager Client 49
Client Access Levels 50
6CONFIGURING AGENTS FOR DATA COLLECTION
Supported RMON Agents and Interfaces 51
Finding Agents for Data Collection 52
Configuring RMON-1 and RMON-2 Data Sources 52
Downloading Agent Firmware 54
Setting Operational Mode on 3Com Standalone RMON-2 Agents 54

7DISPLAYING NETWORK TRAFFIC IN THE MAIN WINDOW
Loading Network Traffic Data 57
Working with Objects in the Main Window 58
Displaying Object Information 58
Searching for Objects 59
Selecting and Deselecting Objects 59
Locating Objects in the Map 59
Displaying Network Traffic Data 59
Displaying Connections Between Objects 60
Displaying Connections To and From Objects 60
Combining To and From and Between 61
Removing and Hiding Traffic 61
Protocols, Applications and Favorites 61
Protocol Tools 62
User-defined Protocols 62
Device Aggregation 64
8DISPLAYING TRAFFIC IN GRAPHS
Overview 65
Using the Graph Panel 66
Using the Launch Graph Dialog Box 67
Graph Settings 69
9USING EVENT RULES
Overview 71
Predefined Event Rules 72
Examples of Event Rules 73
Security Event Rules 73
Traffic Event Rules 74
Configuring Event Rules 75
Refining Event Rules 76
Using Event Rules 77
Monitoring Your Network as a Whole 77
Monitoring Servers 78
Monitoring WAN Links and Backbone Links 79
Implementing Business Policies 80

10 VIEWING EVENTS
Overview 81
Viewing Events 82
Filtering Events 83
Summarizing Events 84
Output of Events 84
Viewing and Managing Selected Events 85
Deleting Events 85
Ignoring Devices or Connections 85
Displaying an Event in the Map 85
Displaying an Event in the Launch Graph Dialog Box 85
Forwarding Events as SNMP Traps 86
Integrating Traffix Manager SNMP Traps with HP OpenView 86
11 OVERVIEW OF REPORTING
Overview 89
Types of Report 89
Report Instances 90
Output 90
Periods Covered by Reports 90
Managing Reports 92
Creating, Editing and Deleting Reports 93
Scheduling Reports 94
Rescheduling Reports and Running Ad Hoc Reports 94
Managing Raw Data and Report Output 94
Setting Output Options 95
Viewing HTML Output 95
Monitoring Report Generation and Output 96
Setting the Lifetime of Raw Report Data 96
Setting Global Report Options 96
Strategy for Reporting 97
Getting Started 97
How Long Does it Take to Generate Reports? 97
Tips and Hints 97
Effects of Grouping on Reports 98

12 REPORT TYPES
Report Templates 99
Activity Reports 99
Top N Reports 99
Connection Activity Report 100
Device Activity Report 101
Group Activity Report 102
Segment Activity Report 103
Top N Connections Report 105
Top N Devices Report 107
Top N Groups Report 109
Top N Segments Report 110
PART IV APPENDICES AND INDEX
ATROUBLESHOOTING TRAFFIX MANAGER
Troubleshooting Traffix Manager 115
Troubleshooting Reports 116
Diagnosing Reporting Problems 116
BDATABASE MANAGEMENT USING TRAFFIX CONTROL PANEL
Overview of Traffix Control Panel 121
Overview of Database Applications 122
Database Setup 122
Database Maintenance 123
Subnets Editor 125
Attribute Lookup 125
DHCP Setup 125
Startup Options 125
Default DNS Domain 126
Upgrading Traffix Manager 2.0 126
Before Deinstalling 126
Deinstalling Traffix Manager 2.0 127
Program Groups and Start Menu Entries 127

CAGGREGATING DEVICES
Overview 129
Default Aggregation 129
Specifying an Aggregation Policy 130
DUSING THE SUBNETSDB FILE
Using the SubnetsDB File 133
How Subnet Grouping Works 135
EAUTOMATIC ATTRIBUTE ASSIGNMENT
Overview 137
Contents of the User-defined Attributes Configuration File 138
File Format 139
Performing Attribute Assignment 140
Using the fileattrs Program 140
Configuration File Format 140
Running fileattrs 141
How fileattrs Works 141
Using the dblookup Program 142
Lookup Database Structure 142
Default Values 143
Access Database 143
Excel Worksheet 144
Excel Workbook 144
Running dblookup 144
How dblookup Works 144
Writing your own program 145
Structure of an Attribute Lookup Program 145
Writing and Building Your Own Attribute Lookup Program 147
Testing Attribute Lookup Programs 149
FSUPPORTED RMON-2 DEVICES
3Com Agents 151
Supported Interface Types 151

GCONFIGURING 3COM STANDALONE RMON-2 AGENTS
Downloading Firmware to 3Com Standalone Agents 153
Setting the Operational Mode on 3Com Standalone RMON-2
Agents 154
HDHCP
How Traffix Manager Monitors DHCP Devices 157
What Effect Do DHCP Devices Have On The Map? 157
IUSING RMON-1 AGENTS
Monitoring Network Segments Using RMON-1 Agents 159
JRMON AND SNMP TABLES RETRIEVAL
SNMP Tables used by Traffix Manager 161
KTECHNICAL SUPPORT
Online Technical Services 163
World Wide Web Site 163
3Com Knowledgebase Web Services 163
3Com FTP Site 164
3Com Bulletin Board Service 164
3Com Facts Automated Fax Service 165
Support from Your Network Supplier 165
Support from 3Com 165
Returning Products for Repair 167
GLOSSARY
INDEX
3COM CORPORATION LIMITED WARRANTY

ABOUT THIS GUIDE
This guide describes Transcend® Traffix™Manager version 3.0 for
Windows NT. This application gathers, displays and analyzes
enterprise-wide network traffic.
Procedural information on how to perform all tasks using Traffix
Manager, as well as context-sensitive information about each dialog box,
is provided in the online help.
This guide is intended for network administrators. It assumes a working
knowledge of local area network (LAN) operations.
If the information in the release notes shipped with this product differs
from the information in this guide, follow the instructions in the release
notes.
Most user guides and release notes are available in Adobe Acrobat
Reader Portable Document Format (PDF) or HTML on the 3Com
World Wide Web site:
http://support.3com.com/infodeli/tools/netmgt/
How To Use The
Traffix Manager
Documentation
Table 1 shows where to find information in the Traffix Manager User
Guide and Online Help.
Table 1 Where to find specific information
If you are looking for Turn to
An overview of Traffix Manager, describing the main features of the application and how it
works, and providing a strategy for new users to get started with the application. Chapter 1
Procedures for launching Traffix Manager the first time you use it. Chapter 2
A description of all menu options in the main window. Chapter 2
(continued)

12 ABOUT THIS GUIDE
An overview of the RMON-1 and RMON-2 standards, and an introduction to how Traffix
Manager uses RMON-2 agents to collect data from your network. Chapter 3
Information on grouping devices to create views of your network in the Map. Chapter 4
Procedures for launching Traffix Manager after the first time. Chapter 5
Information on configuring RMON-1 and RMON-2 agents to collect network traffic data. Chapter 6
A guide to working with objects in the main window and to finding and selecting objects in the
Map and Object List. Chapter 7
Information on focusing the views of your network in the Map by filtering the protocols
displayed. Chapter 7
Information on setting up user-defined protocols on compatible agents. Chapter 7
Information on displaying network traffic in graphs and manipulating the graph display. Chapter 8
Information on setting up rules to trigger events when the traffic on your network changes. Chapter 9
Information on viewing events in the Event List, in the Map and in graphs. Chapter 10
A description of Traffix Manager’s reporting tools, information on creating and scheduling
reports and a reporting strategy for new users. Chapter 11
A description of the different types of report produced by Traffix Manager and a guide to
interpreting the charts in generated reports. Chapter 12
Procedures for troubleshooting Traffix Manager process and agent problems. Appendix A
Procedures for troubleshooting reporting problems. Appendix A
Procedures for managing the Traffix Manager database using the Traffix Control Panel. Appendix B
Procedures for aggregating traffic and filtering data. Appendix C
Information on grouping the devices on your network by subnet. Appendix D
Procedures for setting up automatic assignment of attributes to network devices, including
examples of user programs. Appendix E
A list of the RMON-2 interface types supported by Traffix Manager. Appendix F
Procedures for downloading firmware to standalone agents. Appendix G
Procedures for setting the operational mode on 3Com standalone RMON-2 agents. Appendix G
Information on using the TFTP server. Appendix G
Information on the effect DHCP devices have on the Map. Appendix H
Information on monitoring segments of your network using RMON-1 only. Appendix I
A list of the RMON tables which are retrieved by Traffix Manager. Appendix J
3Com technical support information. Appendix K
Detailed procedural information on how to perform all tasks using Traffix Manager. Online Help
Context-sensitive information about each application dialog box, describing functions and fields. Online Help
(continued)
Table 1 Where to find specific information (continued)
If you are looking for Turn to

Conventions 13
Conventions Table 2 and Table 3 list conventions that are used throughout this guide.
Information about what’s new in this release of Traffix Manager. Release Notes
A list of known problems in this release of Traffix Manager. Release Notes
Table 1 Where to find specific information (continued)
If you are looking for Turn to
Table 2 Notice Icons
Icon Notice Type Description
Information note Information that describes important features or
instructions
Caution Information that alerts you to potential loss of data or
potential damage to an application, system, or device
Table 3 Text Conventions
Convention Description
Screen displays This typeface represents information as it appears on the
screen.
Syntax The word “syntax” means that you must evaluate the syntax
provided and then supply the appropriate values for the
placeholders that appear in angle brackets. Example:
To enable RIPIP, use the following syntax:
SETDefault !<port> -RIPIP CONTrol =
Listen
In this example, you must supply a port number for <port>.
Commands The word “command” means that you must enter the
command exactly as shown and then press Return or Enter.
Commands appear in bold. Example:
To remove the IP address, enter the following command:
SETDefault !0 -IP NETaddr = 0.0.0.0
The words “enter”
and “type” When you see the word “enter” in this guide, you must type something, and then press Return or Enter. Do not press
Return or Enter when an instruction simply says “type.”
Keyboard key names If you must press two or more keys simultaneously, the key
names are linked with a plus sign (+). Example:
Press Ctrl+Alt+Del
(continued)

14 ABOUT THIS GUIDE
Terminology Used
in this Guide Refer to the Glossary at the end of this User Guide for definitions of
terms. Terms which are defined in the Glossary are italicized at their first
use in the User Guide.
Related
Documentation The following documents and Web sites contain useful networking
information.
Documents ■Transcend Traffix Manager Release Notes and Installation Instructions
■3Com Firmware documentation
■Transcend Traffix Manager Database Schema at
http://support.3com.com/infodeli/tools/netmgt/traffix/
family.htm
■Transcend Management Software Network Troubleshooting Guide at
http://support.3com.com/infodeli/tools/netmgt/tncsunix/
family.htm
Web Sites RMON-1/RMON-2
RMON-1 and RMON-2 Backgrounder:
http://www.3com.com/nsc/501305.html
RMON-1 Request for Comment:
http://www.it.kth.se/docs/rfc/rfcs/rfc1757.txt
RMON-2 Request for Comment:
http://www.it.kth.se/docs/rfc/rfcs/rfc2021.txt
Words in italics Italics are used to:
■Emphasize a point.
■Denote a new term at the place where it is defined in the
text.
■Identify menu names, menu commands, and software
button names. Examples:
From the Help menu, select Contents.
Click OK.
Table 3 Text Conventions (continued)
Convention Description

Documentation Comments 15
RMON-2 Protocol Identifiers:
http://www.it.kth.se/docs/rfc/rfcs/rfc2074.txt
Miscellaneous
List of third-party agents which are supported by Traffix Manager:
http://www.3com.com/network_management/probe_interop
Links to network management information:
http://snmp.cs.utwente.nl
Internet Engineering Task Force home page:
http://www.ietf.cnri.reston.va.us
Network Management Resource Database:
http://www.cforc.com/cwk/net-manage.cgi
Documentation
Comments Your suggestions are very important to us. They will help make our
documentation more useful to you. Please e-mail comments about this
document to 3Com at:
[e-mail]
Please include the following information when commenting:
■Document title
■Document part number (on the title page)
■Page number (if appropriate)
Example:
■Traffix Manager 3.0 User Guide
■Part Number 09-1825-000
■Page 25
Do not use this e-mail address for technical support questions. For
information about contacting 3Com technical support, see Appendix K.

16 ABOUT THIS GUIDE
Year 2000
Compliance For information on Year 2000 compliance and 3Com products, visit the
3Com Year 2000 Web page:
http://www.3com.com/products/yr2000.html

IGETTING STARTED WITH TRAFFIX
MANAGER
Chapter 1 Traffix Manager Overview
Chapter 2 Launching Traffix Manager for the First Time

1TRAFFIX MANAGER OVERVIEW
This chapter introduces you to Traffix™ Manager.
It contains the following sections:
■What to Read First
■Features of Traffix Manager
■How Does Traffix Manager Work?
■Strategy for New Users
What to Read First Chapters 1–5 contain a conceptual overview of the processes you need to
follow in order to get to the stage where Traffix Manager is displaying
network traffic data for analysis. Read these chapters to understand:
■How Traffix Manager can facilitate network monitoring and
administration.
■How to start using Traffix Manager.
■How to launch Traffix Manager, for the first time and subsequently.
■What you will see displayed in the main window when you launch
Traffix Manager.
■How Traffix Manager works and how to use it to collect data from
your network.
From Chapter 6 onwards, the guide contains concepts for tailoring Traffix
Manager to the requirements of your own network.
The appendices at the end of the guide contain troubleshooting
information, reference information and instructions for tasks you only
need to perform occasionally.

20 CHAPTER 1: TRAFFIX MANAGER OVERVIEW
The Traffix Manager online help contains detailed procedural information
on how to perform all tasks, and information about each application
dialog box.
The Traffix Manager Release Notes contain installation information, and a
list of known problems with this release.
Features of Traffix
Manager Traffix Manager collects and displays information about the application
traffic on your network, allowing you to understand who is using your
network, and how it is being used. This helps you move from reacting to
changes in network traffic to anticipating the ways that applications use
the network.
Traffix Manager provides the following features for network monitoring:
■Graphical display of network traffic — The graphical display of
traffic patterns shows how applications are being used on your
network. Traffix Manager begins with a high-level, logical view of
network traffic to show overall connections between groups of
devices. You can then zoom in to see more detailed information about
conversations, servers and other devices on the network. You can
access historical information to help you make informed decisions
regarding resource utilization, capacity planning and network growth.
■Generation of traffic events — Once data collection from your
network has begun, you can build up a picture of typical network
usage. You can then specify rules to monitor unusual events on your
network, such as unauthorized access or devices which are using an
abnormal amount of bandwidth. When these rules are triggered,
Traffix Manager generates events. This is especially useful if you do not
have time to monitor the network continuously but want to view a log
of the events generated over a specified period.
■Fully automated reporting tools — The reporting tools allow you
to generate color reports automatically to provide information about
your network. For example, you can create reports on the busiest
segments and devices, or on web usage. Traffix Manager reports can
be produced in HTML format and viewed through a web browser, as
well as professional printed color reports and CSV files for other tools
such as Microsoft Excel.
■Client/server architecture — You can run multiple and remote
clients against a single server.