Sams Teach Yourself MCSE Windows NT Server 4 in 14 Days
(Publisher: Macmillan Computer Publishing)
Author(s): David Schaer, et al
ISBN: 0672311283
Publication Date: 12/15/97

Because graphic displays are resource-intensive, use alerts to monitor objects when possible. You also may run numerous instances of Performance Monitor where each one is dedicated to monitoring one object. This lets you individualize sampling parameters per object.

Finally, consider monitoring each computer locally. This removes the cost of the increase in network traffic.

When optimizing your parameters for Performance Monitor, make only one change at a time, and evaluate its effect before making more changes.

10.4. Network Monitor

A protocol, or packet, analyzer is a tool you would use to capture and analyze network traffic. One such tool is Microsoft’s Network Monitor, which is available in two versions.

The simple version, which is included with Windows NT Server 4.0, is capable of capturing either the addresses of packets moving to and from the computer running Network Monitor or broadcast packets.

The full version, which comes with Microsoft Systems Management Server, can capture all data on the local subnet. The full version has additional capabilities, such as the capability to capture and edit data remotely and to resend captured data.

The full version of Network Monitor no longer requires that the network adapter card run in promiscuous mode under Windows NT 4.0. This is a feature of NDIS 4.0.

10.4.1. Installation of Network Monitor

There are two components of Network Monitor, the Network Monitor Application and the Network Monitor Agent. The Network Monitor Application displays and saves captured data.

You must install the Network Monitor Agent, which allows for the capture of data on remote subnets, on the computer that will capture data. It also provides the Network Segment object in Performance Monitor.

You install both of these components via the Network Applet under Services.

Capturing Data

When you start Network Monitor, you see the Capture window shown in Figure 10.17.

This display has four sections:

•  Graph pane. In the upper-left is a window that shows a horizontal bar graph of current activity.

•  Session Statistics. Under the Graph pane is a summary of the conversations that have occurred during this session.

•  Total Statistics. On the right is a summary of network traffic as a whole.

•  Station Statistics. On the bottom is a summary of network traffic, including multicast and broadcast traffic, that the host either initiated or received.

Figure 10.17.  The Network Monitor Capture window is divided into four sections.

Before starting the capture, you might want to limit the amount of data that is captured by applying a filter, as shown in Figure 10.18. You can filter data by protocol or by address.

Figure 10.18.  You can set a filter’s configuration in Network Monitor. Set the filter to ANY to capture all data.

Displaying Data

You can display data immediately after you have captured it or display data that you previously saved. You can apply a display filter to view only the data you consider pertinent. Figure 10.19 shows a captured file.

Figure 10.19.  You can view captured data in Network Monitor. The frames display in the order in which you captured them.

The display comprises three frames:

•  The Summary pane is located on the top and lists all frames for the current view. Select a frame here to display the details in the other two frames.

•  The Detail pane shows the protocol information for the frame you have selected. If the frame contains more than one protocol, the Detail pane shows the outermost one first.

•  The Hexadecimal pane on the bottom shows the contents of the frame.

10.5. Additional System Monitoring Utilities

The Performance Monitor requires at least a minimal amount of configuration in order to provide statistics. Microsoft provides additional utilities, such as Task Manager and Process Viewer, to present the most commonly requested statistics without configuration requirements.

10.5.1. Task Manager

Activate Task Manager by pressing Crtl+Alt+Del and then selecting Task Manager, or simply click the task bar with the right mouse button. From within Task Manager, you can track applications, processes, and system performance.

Applications

Applications are synonymous with tasks. You can use the Task Manager to view the active applications, as shown in Figure 10.20.

Figure 10.20.  The Task Manager shows four active applications.

You can use the Task Manager to switch between tasks, end a non-responsive task, or launch a new task.

Processes

The Task Manager also can report the Process ID (PID), CPU utilization, and memory utilization for each individual process, as shown in Figure 10.21.

A high number reported for the System Idle Process is an indication that the system has processor time available.

Performance

Select the performance tab in the Task Manager to view, in both text and graphics, several of the most common counters, including CPU and memory utilization, as shown in Figure 10.22.

Figure 10.21.  You may stop individual processes from the Task Manager.

Figure 10.22.  The Task Manager presents much valuable information in that it provides you with a quick snapshot of how your system is functioning.