Learning Center
Plans & pricing Sign in
Sign Out

Troubleshooting Ethernet


  • pg 1

                     Troubleshooting Methodologies
Sniffer University
                                     Section Objectives

                     Upon completion of this section, you will be able to:
                     • Recognize and isolate failures in the network using the Sniffer
                       Pro Network Analyzer
                     • Examine Monitor Statistics to determine whether there are
Sniffer University

                     • Use the Expert symptoms and diagnoses to get the details
                     • Gather Monitor statistics for trend analysis and baselining
                                Capturing Error Frames

                     • You must use NAI-supported adapters with
                       enhanced drivers to observe and capture
                       physical error frames
                       – NAI-21140UC
                         • Adaptec (Cogent) ANA-6911A/TX PCI
                         • Adaptec (Cogent) ANA-6911A/TXC PCI
Sniffer University

                       – Xircom CBE-10/100 BTX CardBus
                       – Xircom CBE2-10/100 BTX CardBus
                        Analyzing the Ethernet Physical Layer

                     • Frame Corruption
                       –   Collisions
                       –   Propagation delay
                       –   Reflected signals
                       –   Electrical noise
Sniffer University

                       –   Hardware failure
                     • With any of these problems, users will see
                       decreased performance due to multiple
                       frame retransmissions
                                    Some Guidelines

                     • More than one bad frame per Mbyte of data deserves
                     • Any unexplained change in the baseline deserves
Sniffer University

                     • More than 1% Error Rate deserves attention
                                        Fast Transmit Adapters
                          • Some adapters start transmitting before the entire
                            frame has arrived in their transmit buffer
                             – If the remainder of the frame has not arrived when the
                               first part is on the wire, it just quits transmitting, leaving
                               the short incomplete frame on the wire
                             – Since it has no CRC, the Sniffer calculates the CRC based
                               on the last 4 bytes and shows a CRC error
                             – The adapter waits for carrier to drop and 96 bit times to
Sniffer University

                               elapse before it sends the complete frame
                                                          Partial frame on the wire       Error!
                          Frame from
                                                                   Complete frame on the wire
                          upper layer
                          • Do not count these incomplete bad CRC frames in the
                     +4     1 bad frame /MB calculation
                                    Troubleshooting Tip

                     • It is always easier to identify what is wrong if one knows
                       how it is supposed to work
                     • One recommendation would be to capture an example of
                       “how it looks” when the network is working
                     • Save the captured data to a file
                     • When the network stops working, capture another
Sniffer University

                       snapshot and compare the working scenario with the non-
                       working scenario
                     • Then simply identify what is different between the two
                                            Divide and Conquer
                          • All speeds of half-duplex Ethernet are contention-
                          • Because of its nature, we are still troubleshooting
                            Ethernet with the “Binary Search” method
                          • Divide the domain in half. Which half does the
                            problem follow?
                            – This is still valid for star networks
                          • We could always use a network map!
Sniffer University


                                  Exercise: Hubports

                     Turn to the lab section to
                     complete this exercise.
                     Use the diagram on the
                     next page for reference
Sniffer University
                                    Exercise: Hubports Continued

                                       Network Diagram
                     10BASE-T Hub                                   • The user’s PC was
                                                                        replaced by a Sniffer.
                                                                        The same cable
                                    Hubport1: known good port
                                                                        connecting the PC
                                    Hubport2: suspect port              was used
                                    NetWare client: Novell~FAA
Sniffer University

                                                                    •   Another Sniffer is
                                    NetWare file server: 3Com~704       plugged into a known
                                                                        good port. Both
                                                                        Sniffers were
                                    NetWare client: 3Com~F91            simultaneously
                                       Legal Collisions
                     • Collision occurs within the first 512 bits (64 bytes) of
                     • Preamble collisions have no recoverable frame data
                     • Typical collisions occur within the first 48 bytes of
                     • Sniffer Pro Analyzer needs to see 96 bits to capture
                       the frame, otherwise it just increments the collision
Sniffer University

                       – This includes the preamble and the first bytes of the
                         destination address
                       – 64 bits of Preamble 32 bits of the destination address
                     • Networks up to 37% sustained utilization are often
                       very “clean”
                                       Normal Collisions
                     • Preamble collisions are not captured
                     • Local coax collisions do not have AAs or 55s in the data
                     • Remote collisions show AAs and 55s in the data field
                       inserted by the repeater
                     • They may be labeled collision fragments or runts
Sniffer University

                     Preamble D Addr S Addr Tp/Ln Headers      Data        CRC
                       8         6     6      2   varies      varies        4
                                            Late Collisions
                     • On coax, the signal becomes much more negative
                       when the collision occurs. The squelch filter drops this
                       signal, so you see good data then nothing.
                     • On UTP repeated sections, look for evidence of jam
                       from the repeater after 6010 bytes
                       –   Either aa aa aa aa... or 55 55 55 55 …
                       –   101010101010 is aa aa aa, 010101010101 is 55 55 55
                       –   64 byte minimum minus the 4 byte CRC
                       –   6010 = 3D16
Sniffer University

                                            Late Collisions
                     Preamble D Addr S Addr Tp/Ln Headers           Data        CRC
                       8         6      6      2   varies           varies      4
                               Rogue Nodes or Bad Hubs
                     • Rogue nodes with “hearing problems” may think the
                       wire is quiet when they send their frame in the middle
                       of someone else’s frame
                     • Bad hubs can also cause late collisions
                     • Calculate the math pertaining to network size
                       – If collisions are occurring well beyond where they should be,
                         suspect a rogue node or bad hub
Sniffer University
                                 Propagation Delay Problems

                     • Propagation delay is part of normal communications
                       – Example: a signal sent from the Moon takes 1.29 seconds to
                         reach Earth
                     • Excessive propagation delay causes corruption
                     • Corruption is random
                       – Size of corrupted frame is random
                       – Victim (source) is random, but skewed by participation
Sniffer University

                     • Corruption typically occurs before the 64th byte
                       – This is NOT an absolute rule
                     • Cause: Cable is too long, or out of spec, or there are
                       too many repeaters or hubs
                       – The faster technologies have shorter cable specifications and
                         require high quality cables, old legacy cables may have been
                         overlooked and are still in use
                                          Excessive Propagation Delay

                     • Users at end of topology may have more problems than
                       other users
                     • Sniffer Pro Analyzer sees:
                       –   “Physical errors” symptoms or diagnoses
                       –   Damaged frames (CRC errors)
                       –   Only a few runts (many frames will be legal minimum length)
                       –   Collision counter will be high if cable is too long
Sniffer University

                            • May not be high if collisions are across a repeater
                     • Examine frames for “Collision data” visible at end of
                       – aa aa aa… or 55 55 55...
                                       Signal Reflection Problems
                          • These problems occur on all media, but are not seen
                            in UTP frames because the adapter does not see
                            them. They are easy to detect on coax.
                          • Corruption is non-random
                            – Frames are corrupted by their own reflected preamble
                          • A victim node’s frame will typically be corrupted at
                            the same offset
                            – Corruption often occurs prior to the 32nd byte (3210 = 1F16)
                            – Collision data may be visible
Sniffer University

                          • If signal reflection is suspected, the best way to
                            examine it is to examine the coax segments with a
                            Time Domain Reflectometer (TDR)
                                                      Sniffer Pro       CRC errors-
                            Transmit                                    collision data

                                     Electrical Noise Problems
                          • Users see intermittent disconnections and problems
                            connecting to network services
                          • Sniffer Pro Analyzer sees:
                            – “Physical errors” symptoms or diagnoses
                            – Damaged frames resulting in CRC errors
                            – The frames are the “right” size but have incorrect data,
                              maybe only one or a few bits got changed
                            – Not many more runts or collisions than baseline
                          • Cause:
Sniffer University

                            – Radio Frequency Interference (RFI)
                            – Electromagnetic Interference (EMI)
                            – Poor quality cabling not meant for high speed data
                                                                         Sniffer Pro
                                                                        CRC errors
                               Troubleshooting Electrical Noise

                     • Corruption is random
                     • No collision data is visible
                       – This is an absolute!
                     • Noise typically has no effect on frame length
                     • Worst case scenario:
                       – If the damaged frame is greater than 64 bytes, it will
Sniffer University

                         appear as a CRC or Alignment in the status field
                       – If the damaged frame is less than 64 bytes, it will appear
                         as a Runt or Fragment in the status field
                       – Noise disrupts the clock; adapter thinks the frame ended
                                  Hardware Problems / Issues
                     • Corruption can look like all the other types of physical
                     • Typical evidence is too many bytes
                       – Much more than 8 bytes of corrupted data
                           • Corrupted data may resemble preamble sequence of AAs and
                     • Could be a jabbering transceiver or NIC
                       – The 802.3 specification states that a transceiver should
                         contain a self-interrupt capability to inhibit a station from
Sniffer University

                         sending for more than 150 milliseconds. The Ethernet V1 and
                         V2 specifications did not have this feature
                     • A managed hub will autopartition the port out quickly
                       – An unmanaged hub waits until it misbehaves for .25 to .75 s
                       – The port LED will flash and Sniffer shows chronic errors
                                 Jabbering NIC

                     • Lots of
                       ones or
                       seem to
                       go on
Sniffer University
                                     Sniffer Pro Ethernet Error Analysis
                     Sniffer Label   Frame Size            Error patterns                        Probable Causes

                     #Collision      64 bytes or greater N/A (Truncated)           Representative of late collisions on coaxial media.
                                                                                   Frames will be truncated. Causes include
                                                                                   propagation delay or faulty hardware.
                     Alignment       <64 bytes          Look for 8 to 12 bytes     Alignment errors with the AA/55 pattern are most
                                                        of AAAAs or 5555s.         often caused by normal collisions on UTP cable.
                     # Alignment     >64 bytes
                                                        If not there, or greater   The data pattern is caused by the repeater jam
                                                        amount, see                signal. If data length is greater than 64 bytes on
                                                        comments.                  any damaged frame, include propagation delay and
                                                                                   hardware as causes. If the AA/55 pattern exceeds
                                                                                   12 bytes, a jabbering NIC or repeater is most likely.
                     CRC             >64 bytes          No specific pattern.       Most commonly caused by noise or hardware,
                                                                                   especially damaged or improperly installed wiring.
                     Runt            <64 bytes          May contain the        Runts have the same causes as Alignments.
                                                        AA/55 pattern, usually
Sniffer University

                                                        from 8 – 12 bytes.

                     Fragment        <64 bytes          May contain the        Fragments are defined as Runts with an invalid
                                                        AA/55 pattern, usually CRC. Handle the same as Alignments.
                                                        from 8 – 12 bytes.
                     Jabber          May be any size.   Greater than 12 bytes      The cause is hardware, usually a NIC or repeater.
                                     The pattern is     of AAs or 55s.
                     Oversize        >1514 bytes        Pattern will include       Hardware has failed and is streaming data.
                                                        lots of AAs and 55s.       Managed hubs may permanently partition node
                                                                                   streaming for more than 150ms; unmanaged hubs
                                                                                   may not.
                          Exercise: More Problems

                     Turn to the lab section
                     to complete this exercise
Sniffer University
                                  Most Hubs Bit Jam on a Collision
                         • Per 802.3: If a collision is detected on any of the ports
                           to which the repeater (hub) is transmitting, the
                           repeater transmits a 96 bit Jam, such that the first 62
                           bits transmitted are a pattern of alternate 1s and 0s.
                            – The 96 bits is 12 bytes if 55 or AA, 4 from source
                              collider, 4 from destination collider, and 4 bytes
                              from the hub
Sniffer University

                                              Sniffer Pro Analyzer
Sniffer University
                     Hub Jam Signatures

                                 Look for AAAAAAs
                                 or 55555555s in
                                 the hex window
                                   Analyzing Collisions and Hub Jam
                                                        Sniffer Pro 2 sees
                                                        a partial frame
                                                        with jam bits

                         Sniffer Pro 1
                         sees a partial
                         frame with
                         jam bits
                                                                             Sniffer Pro 3
Sniffer University

                                                                             sees a partial
                                                                             frame with jam
                                          1-A collision
                                             occurs here
                                          2-The hub
                                            propagates jam
                                            signals out to                              Jam
                                            all devices                                 Repeaters

                            Frame Type Interoperability Problems

                     • User sees:
                       – Inability to connect to specific network services
                     • Sniffer Pro Analyzer sees:
                       – No more error frames than usual
                     • Examine frames to see:
                       – If the user’s system is using Ethernet frame format and the
                         network service IEEE 802.3 frame format (or vice versa)
Sniffer University

                       – If the user’s system is using SNAP frame format while the
                         network service is not (or vice versa)
                     • Cause:
                       – Driver software configured incorrectly
                       – Some implementations support only Ethernet or only IEEE
                               Check Dashboard Statistics

                     • Look here for indications of high utilization and errors
Sniffer University
                                Monitor Dashboard Details
                     • Use the Dashboard Detail counters to find physical
Sniffer University
                             Dashboard Error Timeline
                     • Click on the Network and Detail Error sections to see
                       a graphic representation of Ethernet physical errors
Sniffer University

                              Track Errors with History Samples

                     • Run these
                       and save
                       the data as
                       a .CSV file
                     • Open in
                       Excel or a
Sniffer University

                                Create a Multiple History Report
                     • Include the errors you need to see
Sniffer University

                     • Collect the data, then save to a file to import into a
                       spreadsheet or reporting program
                               Check Utilization In Global Stats

                     • Remember, for best performance, utilization should be
                       below 37% sustained utilization to be considered
Sniffer University
                     Look at the Expert’s DLC Layer

                         Who’s the
Sniffer University

                     Is this really the
                       culprit, or is it
                      just impacted?

                        Check the
                      Symptoms and
                                Troubleshooting Exercises

                     Your instructor will choose the
                     exercises to meet class needs.
                     Turn to the lab section to
                     complete the selected exercises.
                        • Test Your Skill
                        • Errors
                        • Ethernet Physical Errors
Sniffer University

                        • Evaluating Hub Jams
                     If you complete them early, try
                     another one. Come back to them
                     when you get back to work and
                     need review.

                     • Use a bottom-up process for troubleshooting Ethernet
                       network problems
                     • Work on the crises first, then spend time doing
                       proactive monitoring to look for areas where
                       performance is degrading and make appropriate
Sniffer University

                     • Eventually, the crises should be fewer and the
                       proactive preventive work will take on more
                     • Use the clues in the Sniffer Pro Monitor, Expert and
                       Decode screens to help you determine the cause of
                       frame damage
Sniffer University   4-37

To top