Talk:L2 - Ethernet layer: Difference between revisions

From Allegro Network Multimeter Manual
Jump to navigation Jump to search
Access restrictions were established for this page. If you see this message, you have no access to this page.
(Blanked the page)
Tag: Blanking
 
Line 1: Line 1:
==''' MAC module '''==


The MAC module operates on layer 2 of the network stack. It stores information about all MAC addresses. For every address, the corresponding network traffic is accounted, the used protocols and their individual traffic.
The communication MAC peers are stored as well as the traffic between both MAC addresses.
<br>
<big>'''Web interface'''</big>   
<br>
'''MAC list'''
The button row allows for enabling and disabling specific columns so that only the relevant information fit onto the display.
By clicking on “Counters (combined)” the table toggles between sent and received bytes and packets displayed in either one column or in separate columns for sorting purposes.
The list contains all MAC addresses seen by the system. For each address, the table contains the following information:
* MAC
The MAC address with additional information like the NIC vendor or detected OS.
The address can be clicked to reach the detailed page for additional information for that specific MAC address.
* NIC vendor
The NIC vendor name as specified in the IEEE OUI assignment. http://standards-oui.ieee.
org/oui.txt.
Be aware that some MAC addresses are defined globally and do not belong to any vendor like broadcast or multicast addresses.
* Detected OS:
A list of all detected OS that are mapped behind this MAC address. The OS is detected by Host specific Layer 7 patterns. This information can be used to search or identify specific systems.
Be aware that routing and NAT allows more than one OS behind one MAC address.
* DHCP host name
The DHCP name is passively extracted from the dhcp request. It can be used to identify specific system with the DHCP name like printers etc.
* First (recent) activity
This columns shows the first time when this MAC showed activity for the first time or after a long time of inactivity.
* Last activity
The last activity is the last time a packet have been received or send by the MAC address.
* Packets and Bytes
This is the number of packets and bytes, received by the MAC address as a red arrow down, and the sent bytes as a green arrow up.
* Packets/s and Bits/s
These two numbers describe the current throughput of this MAC address, for down- and up-link.
* MAC peer count
Number of MAC addresses which have sent or received packets from this MAC address. The counter is increased at the first packet between 2 MAC addresses. It is decreased after the no activity between 2 MACs for the global timeout.
* Active IP count
Number of IPs mapped behind this IP address. The counter is increased at the first packet for an MAC/IP pair. It is decreased after the no activity for a MAC/IP pair 2 MACs for the global timeout.
This number can be very high for routers, NAT gateways or similar as they can map millions of IPs to one MAC address.
* Open connections
The numbers described the number of currently open connections and the maximum number of connections open (simultaneously ).
* Graph
The column shows the history graph of the traffic for each MAC address. It shows the timestamp on the x-axis and the bytes on the y-axis. The resolution can be changed by using the control buttons on the top of the web page.
* Capture traffic
It is possible to download the traffic of a MAC address by clicking on the capture button.
The captured packets are not stored on the system but they are directly sent over the HTTP connection to the user’s computer.
To stop capture, click again on the capture button or go to the [[1-_Generic_modules(Teil_1)#Capture_module|Capture module]] page in the generic section and stop the corresponding download.
<br>
When multiple pages are available, there will be a control field for switching pages.
The MAC search bar allows to enter MAC addresses or names to see only those element for which the entered string is part of the IP address, NIC Vendor name, the operating system or DHCP host name. Also, complex filter expressions are possible, if the string starts with an open parenthesis “(“. See [[9-_Live_filtering_of_tables|Live filtering of tables]] for a detailed description about how to use this feature.
The columns can be sorted also, for example to easily spot the MAC addresses with the most bytes, or the highest current throughput.
'''Detailed MAC Statistics'''
For each MAC address, a more detailed view can be opened by clicking on the corresponding MAC address on the list of all MAC addresses.
The header line contains buttons to return the main MAC view, to download traffic for this specific MAC address, access this documentation, and to delete the statistics for only this MAC address.
'''Overview'''
The overview tab contains graphs for both packets and bytes of the MAC address. The tables below show raw data for the current throughput and the total packets/bytes processed, also split for IPv4, IPv6, and non-IP packets.
The next rows contain additional statistics about the MAC. The number of IP addresses seen behind that MAC address leads to the Active IPs tab, while the MAC peers number leads to the MAC peers tab.
The open connection row contains a graph showing the history of the number of open connections. As for any graph in the web interface, the resolution can be changed with the time buttons at the top of the page.
'''Layer 3 Protocols'''
The Layer 3 protocols tab list all MAC protocols seen for this MAC address with parameters like bytes and packets.
The First packet time is the time of the very first packet that has been identified as the corresponding protocol for this MAC address.
Analogously, the Last packet time is the time when the last packet has been seen for the protocol.
The graph shows the complete history of that protocol for the MAC address.
The capture button allows for capturing traffic for the MAC and protocol combination.
'''Layer 7 Protocols'''
The Layer 7 protocols tab list all DPI protocols seen for this MAC address with parameters like bytes and packets.
The First packet time is the time of the very first packet that has been identified as the corresponding DPI protocol for this MAC address.
Analogously, the Last packet time is the time when the last packet has been seen for the protocol.
The graph shows the complete history of that protocol for the MAC address. The capture button allows for capturing traffic for the MAC and protocol combination.
The protocol name in the first column can be clicked to reach the [[7-_L7_-_Application(Teil_1)#L7_module|L7 module]] for that protocol.
'''Active IPs'''
The Active IPs tab lists all IP addresses that has been seen behind the MAC address.
For routers the list usually contains a lot of IP addresses (like all external IP addresses), while for internal MAC addresses of client computers, the list usually contains only one or a few IP addresses. Multiple addresses may happen if IPs are dynamically assigned to client computers.
The table contains all known alternative names from different sources such as DHCP or DNS resolving.
The first and last packet time describes the time when the IP appeared first for this MAC address, and has been used last.
These values allow for identifying which IP address might be in use at the moment.
The capture button allows for download traffic for the MAC and IP address combination.
'''MAC peers''' 
The table contains all MAC addresses the current MAC address has sent packets to or received packets from.
The vendor and DHCP name is shown (if available) helping identifying the system behind that MAC address.
The usual traffic statistics are shown including a history graph.
The capture button allows for capturing traffic between those two MAC addresses only. 
'''Peer countries'''
Similar to the MAC peers, the countries tab lists all countries to which the current MAC addresses has sent packets to (or received packets from).
The country is identified based on the IP addresses seen for the MAC peers.
The capture button allows for capturing traffic for the current MAC address and the selected country for any possible peer.
'''Outer VLANs'''
The Outer VLANs tab lists all outer VLAN tags seen for the MAC address, also showing the amount of traffic for
which no VLAN tag has been used.
The tab contains the usual traffic statistics including a history graph.
The capture button allows for capturing traffic for the MAC and outer VLAN combination.
'''Outer MPLS'''
The Outer MPLS tab lists all outer MPLS labels seen for the MAC address, also showing the amount of traffic for which no MPLS label has been used.
The tab contains the usual traffic statistics including a history graph.
The capture button allows for capturing traffic for the MAC and outer MPLS combination.
'''Resetting statistics''' 
The stored data about each MAC can be removed by clicking on the trashcan button on the top right of the MAC statistics web page.
=='''QoS module'''==
The Quality of Service module processes and displays traffic with QoS tags for IP DSCP on layer 3 and VLAN PCP and MPLS TC on layer 2.
For every tag the corresponding network traffic is accounted and a list of IP addresses for which the QoS tag has been seen is available 
'''Layer 2 QoS'''
For layer 2 VLAN priority code points and MPLS traffic classes are analysed and displayed in a table with traffic counters, a history graph of traffic over time and a PCAP button that certain QoS tag.
'''VLAN priority code point''' 
VLAN priority code point (PCP) values are displayed as defined by IEEE 802.1Q-2005.
{| class="wikitable sortable"
|-
!  PCP !!  Priority  !! Short name !! Description
|-         
| 1 || 0 (lowest) ||  BK || Background
|-
| 0 || 1 (default) || BE || Best effort
|-
| 2 || 2 || EE || Excellent effort
|-
| 3 || 3 || CA || Critical applications
|-
| 4 || 4 || VI || Video, < 100 ms latency and jitter
|-
| 5 || 5 || VO || Voice, < 10 ms latency and jitter
|-
| 6 || 6 || IC || Internetwork control
|-
| 7 || 7 (highest) || NC || Network control
|}
'''MPLS traffic class'''
MPLS traffic class (TC) values are displayed as a number only. The TC value is intended to be flexible according to RFC5462.
The old name of that field was EXP (experimental).
'''Layer 3 QoS'''
For layer 3 IP differentiated services codepoint (DSCP) are displayed in a table with traffic counters, a history graph of traffic over time and a PCAP button for that certain DSCP value.
DSCP values are displayed as defined by RFC4594.
{| class="wikitable sortable"
|-
!  Service class name !!  DSCP name  !!  DSCP value 
|-         
| Network Control || CS6 ||  48
|-
| Telephony || EF ||  46
|-
| Voice Admit  || VOICE-ADMIT || 44
|-
| Signaling || CS5 ||  40
|-
| Multimedia Conferencing || AF41, AF42, AF43 ||  34, 36, 38
|-
| Real-Time Interactive || CS4 ||  32
|-
| Multimedia Streaming || AF31, AF32, AF33 ||  26, 28, 30
|-
| Broadcast Video || CS3 || 24
|-
| Low-Latency Data  || AF21, AF22, AF23 ||  18, 20, 22
|-
| OAM  || CS2 ||  16
|-
|  High-Throughput Data || AF11, AF12, AF13 ||  10, 12, 14
|-
| Standard  || DF (CS0) || 0
|-
| Low-Priority Data  || CS1 || 8
|}
Additionally legacy Type of Service values as defined by RFC791 and RFC1349 are displayed if DSCP is not used.
Consider following DSCP and Type of Service compatibility map.
{| class="wikitable sortable"
|-
!  ToS value !!  ToS Precedence  !! ToS Delay flag!! ToS Throughput flag !! ToS Reliability flag!! DSCP value !! DSCP name
|-         
| 0 || Routine || 0  || 0 || 0 || 0 || Standard 
|-
| 4 || Routine || 0  || 0 || 1 || 1 || Standard
|-
| 8 || Routine || 0  || 1 || 0 || 2 || Standard
|-
| 12 || Routine || 0  || 1 || 1 || 3 || Standard
|-
| 16 || Routine || 1  || 0 || 0 || 4 ||  Standard
|-
| 32 || Priority || 0  || 0 || 0 || 8 || CS1
|-
| 40 || Priority || 0  || 1 || 0 || 10 || AF11
|-
| 48 || Priority || 1  || 0 || 0 || 12 || AF12
|-
| 56 || Priority || 1  || 1 || 0 || 14 || AF13
|-
| 64 || Immediate || 0  || 0 || 0 || 16 || CS2
|-
| 72 || Immediate || 0  || 1 || 0 || 18 || AF21
|-
| 80 || Immediate || 1  || 0 || 0 || 20 || AF22
|-
| 88 || Immediate || 1  || 1 || 0 || 22 || AF23
|-
| 96 || Flash || 0  || 0 || 0 || 24 || CS3
|-
| 104 || Flash || 0  || 1 || 0 || 26 || AF31
|-
| 112 || Flash || 1  || 0 || 0 || 28 || AF32
|-
| 120 || Flash || 1  || 1 || 0 || 30 || AF33
|-
| 128 || Flash Override|| 0  || 0 || 0 || 32 || CS4
|-
| 136 || Flash Override|| 0  || 1 || 0 || 34 || AF41
|-
| 144 || Flash Override|| 1  || 0 || 0 || 36 || AF42
|-
| 152 || Flash Override|| 1  || 1 || 0 || 38 || AF43
|-
| 160 || Critical || 0  || 0 || 0 || 40 || CS5
|-
| 176 || Critical || 1  || 0 || 0 || 44 || Voice Admit
|-
| 184 || Critical || 1  || 1 || 0 || 46 || EF
|-
| 192 || Internetwork Control || 0  || 0 || 0 || 48 || CS6
|-
| 224 || Network Control || 0  || 0 || 0 || 56 || CS7
|}
'''QoS details''' 
By clicking on a QoS tag a details page with all seen IPs for that certain QoS tag is displayed. The traffic of the certain IP for that certain QoS tag is shown.
==''' Packet size module'''== 
The packet size module operates on layer 2 of the network stack. It stores information about the size of every packet and provides a size distribution among several groups of a certain range of size.
Size of the packet is calculated on layer 2 with trailing CRC (as on the wire). For instance for Ethernet MTU of 1500 Byte, the maximal size of a packet is 1518 Byte (Ethernet frame size 1500 Byte + 18 Byte header and frame checksum), or 1522 Byte (when VLAN is being used).
'''Web interface''' 
Statistics are available for the whole traffic as well as for TCP and UDP only.
'''Packets''' 
The packet size distribution for the groups of a packet size range is shown as a table and a pie chart.
The history chart displays changes over time. In live view mode, the total count of packets is displayed. If an interval is selected, only the packets of the interval are taken into account.
'''Average packet size over time'''
The packet size minimum, maximum and average size are displayed as a table and as a history chart. In live view mode, the min/max/average of all packets is displayed. If an interval is selected, only the min/max/average of that interval is being shown.
=='''ARP module '''==
The Address Resolution Protocol (ARP) is used on layer 2 to track which hardware (MAC address) uses which IP address.
The ARP module monitors requests and replies and builds a database of all known MAC and IP addresses and their correlation.
It also accounts possible spoofing alerts, when some computer send or reply with wrong MAC addresses, or multiple computers answer with the same IP.
Those events may indicate some problem within the network, due to misconfiguration or an attack. 
<big>'''Web interface'''</big> 
'''Overview 
The overview tab shows the number of all ARP requests seen, and the number of replies. The history graph shows the number over time. As usual, zooming can be applied to view a larger time window.
'''MAC addresses''' 
The MAC address tables shows for each MAC address the last assigned IP address, that is the IP address that have announced by the corresponding MAC address.
The time when this IP address has been announced is shown as well.
The table includes the alternative names from other sources (such as DHCP, DNS, SSL, HTTP, etc) of the last IP.
The column Different IPs seen lists all IPs that have been announced by the MAC address at some point in time.
Many devices will just have a single IP, but when dynamic IP assignment is done (via DHCP or other methods), multiple IP addresses happen as well.
The column # mismatching MACs contains a counter about the number of possible conflicts in requests or replies.
The counter increases when there is a mismatch of MAC addresses used in requests or replies, that is a different MAC address has been announced as sender than the actual packet was sent by. The value should always be zero.
Otherwise it indicates that a devices sends ARP request with a forged sender address.
'''IP addresses'''
The IP addresses tab views the reverse direction, showing the MAC addresses used for each IP address.
The table includes the alternative names from other sources (such as DHCP, DNS, SSL, HTTP, etc).
The column Latest MAC and Time of latest MAC shows the latest MAC address that have announced to own the corresponding IP address, and the time of that announcement.
The Different MACs seen column lists all MAC addresses that have announced to own the IP address at some point in time.
Often an IP address is used by a device exclusively, but when dynamic IP assignment is used (via DHCP or other methods), multiple hardware devices may use the same IP address. This does not indicate a problem within the network.
The # multiple MAC collisions column shows a counter of possible conflicts in IP usage. The counter is increased when multiple hardware devices announce to own the same IP address within a short amount of time.
This may indicate some problem if those devices really use the same IP address. It may happen due to misconfiguration if two devices has the same fixed IP. It may also happen to due an attack happening, if an attacking devices wants to mimic another device.
=='''VLAN module '''==
The VLAN statistics shows information about all seen VLANs. IEEE 802.1Q VLAN and IEEE 802.1ad Q-in-Q are supported.
The module displays traffic counter for each VLAN seen on the network. Additionally, statistics about traffic without any VLAN tag is always shown.
 
<big>'''Web interface'''</big>
'''Outer VLAN''' 
This tab shows statistics about VLANs and traffic outside of any VLAN.
The displayed outer VLAN tag is the IEEE 802.1Q VLAN tag. In the context of IEEE 802.1ad Q-in-Q it is the one closest to the Ethernet header, sometimes also known as S-TAG (Service tag).
The statistics include the total amount bytes and packets for that particular VLAN as well as the current through put.
A history graph is available to show bytes and packets counter changed over time. As usual, the resolution can be changed using the top buttons to any interval.
It is also possible to capture traffic for a specific VLAN tag by clicking on the corresponding button in the last column.
'''VLAN Q-in-Q'''
This tab shows statistics about IEEE 802.1ad Q-in-Q VLANs.
The displayed outer VLAN tag is the one closest to the Ethernet header, sometimes also known as S-TAG (Service tag).
The inner VLAN tag is the one closest to the payload of the Ethernet frame, sometimes also known as C-TAG(Customer tag).
The Allegro Network Multimeter supports two stacked VLAN tags.
The statistics include the total amount bytes and packets for that particular inner VLAN tag as well as the current throughput.
A history graph shows bytes and packets counter changed over time.
To capture traffic for a specific inner VLAN tag, a PCAP button is available.
==''' MAC protocols module'''== 
The MAC protocols module operates on layer 2 of the network stack. It stores information about all MAC protocols.
For every protocol, the corresponding network traffic is accounted. 
<big>'''Web interface'''</big> 
'''Overview''' 
The overview shows common MAC protcols such as IPv4, IPv6, ARP and whether VLAN tags are set together with the corresponding traffic.
A pie chart visualises the distribution of traffic and the history chart shows time based traffic per protocol.
In live view the total amount of bytes is displayed. If an interval is selected, only the traffic from this interval is being shown.
'''MAC protocol list''' 
The MAC protocol list shows all protocols with the corresponding traffic. The list may be ordered by selecting the proper column.
'''PCAP '''
It is possible to download the traffic of a MAC protocol by clicking on the download button. The captured packets are not stored on the system but they are directly sent over the HTTP connection to your computer.
To stop capture, click on the same button again (which turned to a STOP symbol), or go to the capture traffic page in the generic section and stop the corresponding download.
=='''STP module'''==
The STP module processes STP traffic and stores the history of all seen Root Bridges including information about these. 
'''Current STP configuration:''' 
The first table shows the specification of the current configuration. That is the information derivated from the lastseen STP packet.
If there are two specifications competing (for example the root bridge), the entries may jitter.
'''Root bridge MAC:''' 
This is the MAC adress of the current root bridge, also called root bridge system id.
This is not necessarily the MAC adress you use to connect too the managment interface of the bridge/switch, but probably pretty similar to this one.
'''Root Bridge Priority:'''
This is a priority value (default ist 0x8000), of the (root) switch/bridge that can be set by the user.
The switch/bridge with the lowest priority value becomes root bridge. If the priority values of two switches are the same, the MAC adresses will be compared. 
'''Designated bridge MAC:'''
This is the MAC adress of the bridge that announced respectively forwarded the current configuration.
If the last packet crossed no other switches after it has been sent from the root bridge, this MAC adress is the same as the root bridge MAC.
'''Designated bridge Priority'''
This is a priority value (default ist 0x8000), of the (designated) switch/bridge that can be set by the user.
The switch/bridge with the lowest priority value becomes root bridge.
If the priority values of two switches are the same, the MAC adresses will be compared.
'''Seen STP packets:'''
This is the number of all seen STP packets.
 
'''Costs for root path:'''
This are the costs to reach the root bridge.
The costs from one switch/bridge to another can be defined in the interface of the switch/bridge.
'''Message age:'''
A generated STP frame starts with Message age 0. Every time this frame crosses a bridge the age is increased by 1.
'''Max age:''' 
This is the maximum message age until a sent STP packet is discarded respectively invalid.
'''Time between config messages (Hello Time):''' 
This specifies how often configuration messages (also called BPDU frames) are sent.
'''Forward delay:'''
This is the time that is spent in the listening and learning state.
'''Share of STP with this root port:'''
This is the percentaged share of STP traffic with this root port. I.e. that is the quotient of the number of STP packets with the root port of this configuration divded by the number of all seen STP packets.
'''STP version:'''
This is the version STP version that was used in the last seen STP packet. Common versions are: 0 - STP (Spanning Tree Protocol) 2 - RSTP (Rapid Spanning Tree Protocol)
'''Root bridge history:'''
This table contains the MAC adress of all seen root bridges including their last configuration and the last time they were anounced as root bridge in an accounted packet.
=='''MPLS module'''==
The MPLS module shows information about all seen MPLS labels (single label and double stacked).
'''Outer MPLS'''
This tab lists all seen MPLS labels and shows traffic counters and a history graph. A PCAP button allows for capturing specific traffic with this MPLS label.
Traffic that does not contain a MPLS label is shown as “No label”.
For double stacked MPLS only the outer MPLS label is shown here together with the aggregated traffic for all MPLS having the same outer label.
'''Double stacked MPLS'''
In this tab all double stacked MPLS labels are shown. For a better overview also traffic that had only an outer MPLS label is shown.
The inner label in this case is displayed as “no label”.
A PCAP button allows for capturing specific traffic with this MPLS label stack.
=='''LLDP module'''== 
The LLDP module extracts information from LLDP messages (Link Layer Discovery Protocol) and correlates thisinformation to the respective MAC and IP addresses.
''' Web interface '''
There are two tabs: one tab for IPs and one tab for MACs. Each tab shows a list of the addresses for which LLDP information was seen along with some information that was provided for the address.
The columns displayed are as follows:
* IP or MAC: Depending on the selected tab this column shows either the IP address or the MAC address for which the LDAP information in this row was transmitted. A click on the address will open the detailed statistics for that address.
* Alternative names: Names for the address that were gathered from other data sources (DNS, DHCP, etc.) or custom defined names are displayed in this column.
* Last updated: Shows the time when the information was last updated by decoding a LLDP packet.
* System name: The name of the system as transmitted in the LLDP packet.
* System description: The description string for the system as transmitted in the LLDP packet.
* Port name: The port name as transmitted in the LLDP packet.
The search bar allows to filter for a specific IP/MAC address, names or for LLDP information in the table.
==''' Burst analysis'''== 
The burst analysis module measures throughput per interface or MAC address and displays utilization graphs for fast recognition of bursts.
'''Measurement'''
The burst analysis module measures throughput for every interface in a 1 ms interval. Measurement is always done on layer 1, the packet length accounting setting is ignored.
'''Web interface'''
The web interface shows a tab with an interface list. Additionally there is a tab with up to five MAC addresses that can be added and removed.
For every interface or MAC address a graph is shown which displays utilization values. Utilization values are stacked on eachother and sum up 100%.
A tooltip shows all utilization values for the desired time slot.
In Live view mode a bar is shown per second, thus if e.g. the “Utilization 100%” value is at 3%, the link was completely busy for a total of 3% of the measurement intervals in that second.
For back-in-time intervals or when a larger interval is displayed, the duration of a bar is longer and the utilization values are aggregated accordingly.
The duration can be found out by clicking on the triangle icon next to the graph.
The utilization values are counted exclusively. E.g. “Utilization >= 99%” shows the amount of time when the link had an utilization of greater or equal 99% but lesser than 100%. Those utilizations are counted seperately and shown as “Utilization 100%”.
The sliders on top of the graphs allow for displaying or hiding several utilization values. These settings are stored per user.
Together with the interface throughput incidents you can easily see when bursts occured and how long they lasted.
'''Utilization 100% configuration'''
Next to the graph the configured “Utilization 100%” threshold is shown and can be configured by clicking on the change link.
For interfaces either the link speed or any other Mbit/s value can be used. For MAC addresses the tx and rx thresholds can be configured.
The traffic’s bandwidth will be shown as “Utilization >> 100%” if it is larger than 105% of the configuration value.

Latest revision as of 14:49, 29 April 2020

Retrieved from "https://allegro-packets.com/wiki/index.php?title=Talk:L2_-_Ethernet_layer&oldid=2456"