🚀 go-pugleaf

In article <25514@boulder.Colorado.EDU>, pleticha@mpad.span.nasa.gov (Dennis Pleticha/MDSSC-ESD @ (713) 283-4207) writes:
> 
> I've noticed that the interfaces statics from our cisco don't correlate well 
> with those of the Network General Sniffer hanging off the same interface.  
> In particulare collisions, framing errors, runts, and CRC errors reported by
> the cisco router is orders of magnitude greater than those of the Sniffer! 
> Who do I believe and/or should I be concerned?

My experience with the Sniffer is that it is a good protocol analyzer, but a
so-so network analyzer. I also use an HP analyzer and it shows far more errors
and such than the Sniffer. Because the Sniffer uses a more or less standard
interface, it can't seem to see some types of errors. The HP has a fully custom
interface and seem to catch EVERYTHING. (But it's not much of a protocol
analyzer.)

I suspect that the counts on the cisco are correct.

					R. Kevin Oberman
					Lawrence Livermore National Laboratory
					Internet: oberman@icdc.llnl.gov
   					(415) 422-6955

Disclaimer: Don't take this too seriously. I just like to improve my typing
and probably don't really know anything useful about anything.

>My experience with the Sniffer is that it is a good protocol analyzer, but a
>so-so network analyzer. I also use an HP analyzer and it shows far more errors
>and such than the Sniffer. Because the Sniffer uses a more or less standard
>interface, it can't seem to see some types of errors. The HP has a fully custom
>interface and seem to catch EVERYTHING. (But it's not much of a protocol
>analyzer.)

We did some investigation into the very same situation.  What we found out
is that the cisco's can increment multiple error counters on one error.  Take
collisions for instence, collisions can result in multiple increments of
runts, collisions etc.  

As far as the HP4972, it is a very good product but does not catch everything.
There are some runt filters that when activated can fillter out information   
that you may what to see.  My recommendation is read through the manual and
deactivate the runt filtering capabilities and take a closer look.  

As far as the HP4972 not being a very good protocol analyzer, you need to 
puchase the approprate software to run on the analyzer to get better results.
Contact HP for ordering information.

Mike,
HP

In article <14050007@hpccc.HP.COM>, doerfler@hpccc.HP.COM (Mike Doerfler) writes:
 
> As far as the HP4972 not being a very good protocol analyzer, you need to 
> puchase the approprate software to run on the analyzer to get better results.
> Contact HP for ordering information.
 
Even with the appropriate software it still is no Sniffer. But because of the
super HP hardware there are things in protocol analysis that the HP can do that
the Sniffer can't.

Another HP employee recently posted a detailed list of the pros and cons of both
systems to comp.dcom.lans. They agreed pretty closely with my opinions. I plan
to keep one of each.

					Kevin