Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > tools : taxonomy : measurement : summaries.xml
Internet Tool Summaries
This section provides more detailed tool descriptions and pointers to more information, including its location, authors/contacts, cost i f known, and comments about features, limitations, and underlying asssumptions. For example, ICMP-based tools may reflect different performanc e than those based on TCP or other data packets. For some tools we include a review with the description. If we know of an existing tool revie w (notably of commercial tools), we provide a link to it.

jump down to Other measurement tool related links


Ping

Ping Classic
URL:ftp://ftp.arl.mil/pub/ping.shar
Contact: ARL (was BRL) (ftp@arl.mil)
Cost: free
Measures: availability, latency, packet loss.
Mechanism: ICMP ECHO/REPLY
Usage:High
Comments: URL is for original, written by Mike Muuss, No current maintainer (and no real need of one, it is so stable).

Review:
Success:Perhaps most commonly used tool.
Usability:Excellent.
Quirks: Wide variety of installed versions. Creates frustration when some versions need a certain option (e.g., -s) to do what other versions do by default.
Userbase Summary:Most Unix, all Windows 95/NT hosts.
Stability:High, no major bugs since 1990.
Comparison:Classic for reachability/latency assessment. But its simplicity arises from its limited functionality; users seeking sophisticated information need more sophisticated tool.

Nikhef ping
URL:ftp://ftp.nikhef.nl/pub/network/ping.tar.Z
Contact:Eric Wassenaar
Cost: free
Mechanism: ICMP ECHO/REPLY
Platforms: HP/HPUX, SGI/IRIX, IBM/AIX, SUN/SunOS, SUN/Solaris, DEC/Ultrix,DEC/Alpha, Apollo/DomainOS, NeXT/MACH, BSDI/4.4BSD, SCO/ODT3, SCO/OS5, Linux; BIND 4.9.{5,4,3,2}, BIND 4.8.{3,2}

This is one of many 'ping' variants extant. Eric Wassenaar reports making the following changes from 'normal' ping:
o Redesign for proper flood and cisco style ping handling.
o Packet loss now properly reported in all modes.
o Support for LSRR in addition to RR option.
o Quick ping without normal output, quit when target is alive.
o Option to probe all addresses of multi-homed destinations.
o Support pinging to broadcast address.
o Portability hooks for easy installation on various platforms.
o Recognize various new ICMP packet types and subcodes.
o Recognize bounce messages to our own ping requests.
o Round-trip time reporting in fractional milliseconds.
o Display rtt standard deviation in statistics summary.
o Cache DNS lookups to minimize DNS queries.
o Auto-adjust timeout period to cope with slow links.

fping
URL:ftp://ftp.stanford.edu/pub/packages/fping/
Descriptionhttp://www.stanford.edu/~schemers/docs/fping/fping.html
Contact: Roland Schemers (schemers@slapshot.stanford.edu)
Cost: free
Ping optimized for measuring many hosts in parallel.
Mechanism:same as ping
Comments:different output (more script-parsable) format than stock ping.

pingplotter
URL:http://web.raex.com/~peteness/pingplotter/
Contact: Pete Ness (peteness@raex.com)
Mechanism:ping, traceroute
Cost:@@
Description: A ping/traceroute plotting program. Allows the setting of time interval, colors, etc. Graphs each hop individually and allows one to determine if there are any "ping" hop-by-hop instabalities. All hops are tested at the same time using multithreading of W95. The graphs show a line graph indicating min/max and avg of ping tests over the sampling period. An invaluable tool for debugging performance problems.

gnuplotping
URL:http://ircache.nlanr.net/~wessels/Software/
Contact: Duane Wessels (wessels@nlanr.net)
Mechanism:ping
Cost: free
Pings multiple hosts in parallel, with graphical display (gnuplot) of delay distribution.

Imeter (formerly Lachesis)
URL:ftp://ftp.intel.com/pub/ietf/ippm/Imeter-1.1.tar.gz
Paper:ftp://ftp.intel.com/pub/papers/lachesis.ps
Contact: Jeff Sedayao (sedayao@argus.intel.com),
Kotaro Akita ( http://www.princeton.edu/~kakita/)
Cost: free
Mechanism: ping
Imeter is a series of scripts that supports collection, analysis, and web-displayed graphs of long-term ping data. It was originally written to measure ISP service.
Related Work: Also see Timeit, which was written by the same group but measures long-term web performance instead of long-term ping performance.

Other Availability/Latency Tests

echoping
URL:ftp://ftp.internatif.org/pub/unix/echoping
Contact: Stephane Bortzmeyer (bortzmeyer@pasteur.fr)
Echoping is a utility for measuring TCP/UDP latency by sending to an arbitrary (default 'echo') port. It includes support for testing HTTP query latency.

wwping
URL:http://www2.gol.com/users/jonathon/wwping.html
Contact: Jonathon Fletcher (jonathon@pobox.com)
Web page that checks web server availability via CGI query.

Hop by Hop characterization

Traceroute classic
URL:ftp://ftp.ee.lbl.gov/traceroute.tar.Z
Contact:traceroute@ee.lbl.gov
Mechanism: UDP w/limited TTL, ICMP Time Exceeded.
Directs a packet to each router along a path without actually knowing the path, by setting the IP TTL field from 1 to n until the ultimate destination is reached. Upon receiving a packet with and expired (0) TTL, the hop generates an ICMP Time Exceeded response back to the source, thus identifying the hop and its round trip delay. Each UDP packet is sent to a probably-unused port, so when the destination receives the packet it responds with ICMP Port Unreachable.
Platforms: unix, Win95/NT. bundled with many OSes.
Use: Typically used to debug routing problems.
Output: Reports the name/address of each hop along the path to a specified host, and reports latency, reachability, and packet loss data from the source to each hop.
Review:
Success: Most commonly used tool for debugging Internet routing problems.
Usability: Strong, though requires some networking understanding to interpret properly.
Has difficulty with routers not following canonical model for IP TTL responses. Since it is unidirectional, it fails to provide information on route asymmetry.
Stability: High
Comparison: Note that pathchar and traceroute have different goals. Traceroute runs much faster, making it preferable for most route debugging, but traceroute's 3pkts/hop model limits the information on the link and router characteristics sought by pathchar.

Nikhef traceroute
URL:ftp://ftp.nikhef.nl/pub/network/traceroute/
Contact: Eric Wassenaar (e07@nikhef.nl)
Cost: free
Mechanism: UDP, ICMP
Platforms: HP/HPUX, SGI/IRIX, IBM/AIX, SUN/SunOS, SUN/Solaris, DEC/Ultrix, DEC/Alpha, Apollo/DomainOS, NeXT/MACH, BSDI/4.4BSD, SCO/ODT3, SCO/OS5, Linux; BIND 4.9.{5,4,3,2}, BIND 4.8.{3,2}
Comments: Like ping, there are many traceroute variants. Like with the Nikhef ping variant, there are a number of minor changes from 'normal' traceroute. Eric Wassenaar reports making the following changes:

o Optional ttl reporting, o Support LSRR option, to show the route between arbitrary destinations.
o Improved timeout handling during icmp packet catching.
o Option to probe all addresses of multi-homed destinations.
o Option to disable fragmentation and perform MTU discovery.
o Recognize various new icmp packet types.
o Round-trip time reporting in fractional milliseconds.
o Option to display the Autonomous System number for each hop.
no maybe we should add this? o Option to display the network name for each hop.
o Configurable default options via environment variables.
o Optional setting of initial ttl to skip first hops.
o Optional min/avg/max rtt statistics summary for each hop.
o Include standard deviation in rtt statistics summary.
o Cache nameserver lookups to minimize DNS queries.

www.mkimball.org/mtr.html Mtr
URL:http://www.mkimball.org/mtr.html

Contact: Matt Kimball (mkimball@xmission.com r> Cost: free
Mechanism: UDP, ICMP
Platforms: Unix Comments: Nice interface; lots of potential

Traceroute servers
Yahoo URL: http://www.yahoo.com/Computers_and_Internet/Software/Communications_and_Networking/Networking/Utilities/Traceroute/
Mechanism: traceroute
Web-based servers that run traceroutes from the server host. Growing popularity and prevalence.

pathchar
URL:ftp://ftp.ee.lbl.gov/pathchar/
Contact:pathchar@ee.lbl.gov
Cost: free
Comments: ICMP
Estimates performance characteristics of each node along a path from a source to destination. Leverages the ICMP protocol's Time Exceeded response to packets whose TTL has expired. Sending a series of UDP packets of various sizes to each hop, pathchar uses knowledge about earlier hops and the round trip time distribution to this hop to assess incremental bandwidth, latency, loss, and queue characteristics across this link. A draft web page describing the tool is at http://www.caida.org/tools/taxonomy/content/pathchar/
Review:
Success: Does reasonable job of simple layer 3 paths of 10Mbps Ethernet speed or below, of which there are unforunately a decreasing proportion of interest in the operational wide-area Internet. VJ's slides (avaiable at URL above and highly recommended reading) discuss implementation difficulties, including culling out signal from the noise inherent in RTT measurements, difficulties whose magnitude increases with higher bandwidths and presence of 'hidden hops' (e.g., bridges, ATM, V.42). Essentially, although pathchar is able to derive a great deal of information about each link, the underlying algorithms are currently strongly vulnerable to experimental error and misleading information, sometimes yielding substantially incorrect results. It is a tool/approach with immense potential for improvement, and the Internet could badly use its evolution/development.
Usability: Easy to run, but can take literally days to complete execution. Sometimes difficult to interpret output, as accurately doing so requires understanding underlying mechanism of the tool as well as those of the Internet in general.
Stability: Still in alpha test, and thus somewhat buggy. No source code available, so hard to improve it.
Userbase: Small.
Cross-References:Bing also derives bandwidth numbers by contrasting round trip times of different-sized packets.

OTTool
URL:ftp://ftp.neon.com/pub/goodies/OTTool.sea.hqx
Contact: Neon Software (http://www.neon.com)
Cost: free
Mechanism: UDP to unused port / ICMP error response
Platforms: Mac
Cost: free
Output: synopsis of AppleTalk and IP configuration parameters within Apple Computer's Open Transport networking architecture. Allows IP DNS queries, devices pinging, traceroute, IP address range scanning.

WhatRoute
URL:http://crash.ihug.co.nz/~bryanc
Contact: Bryan Christianson (bryanc@ihug.co.nz)
Cost: free
Mechanism: UDP to unused port / ICMP error response
Platforms: Mac
WhatRoute is a freeware traceroute app for MacOS. In addition to traceroute, the software will perform ping, finger, whois and nslookup functions. It will also operate as a TELNET server so that WhatRoute commands can be initiated from a remote host. The newest version includes a screen giving a tree view of the network based on the results of the traceroutes. InterMapper is able to make use of WhatRoute.

GeoBoy
URL:http://www.ndg.com.au/products/gb/
Contact:NDG (http://www.ndg.com.au)
Cost: $20.00US
Mechanism: a geographical tracing tool capable of tracing and displaying routes taken by traffic traversing the Internet. Allows the user to locate Internet delays and traffic congestion.
Platforms: Windows 95/NT
Output: graphical display on a 2D map or 3D globe of route to host, with various textual info provided also.

VisualRoute
URL:http://www.visualroute.com/
Contact:Datametrics Systems Corporation (http://www.visualroute.com/company.html)
Cost: $24.00US
Mechanism:"a visual, fast, and integrated ping, whois, and traceroute program that automatically analyzes connectivity problems, displaying the results on a World map."
(analysis appears to consist of noting where packets appear to be dropping, and checking for a reply from port 80)
Platforms: Windows 95/98/NT 4
Output: table of information on each hop along the path to the destination, including a small graph of the time delay, as well as graphical display on a 2D world map of route to host. textual analysis provided also.
NOTE: demo of tool available from a java-enabled web browser, at http://www.visualroute.com/demo.html.

Internet Throughput

TReno
URL:http://www.psc.edu/networking/treno_info.html )
Contact: Matt Mathis (mathis@psc.edu), Jamshid Mahdavi (mahdavi@psc.edu)
Cost: free
Mechanism: UDP to unused port / ICMP error response; optionally ICMP ECHO/REPLY instead.
TReno is a TCP internet throughput measurement tool based on a user-level implementation of a TCP-like protocol. This allows it to measure throughput independent of the TCP implemention of end hosts and serve as a useful platform for prototyping TCP changes. TReno is associated with the IPPM formal metrics effort (see http://www.psc.edu/~mathis/ippm).
Review
Success: TReno works well for what it was designed for: deciding how much bandwidth a process would get if it were running over a completely up-to-date version of TCP on the Internet. It is also quite useful for debugging modifications to TCP.
Stability: The tool works in most circumstances. It produces artificially slow figures when sending packets to machines with ICMP rate limitations (Solaris, Linux, probably others).
Usability: It is easy to run: no 'server' is required, and it only requires a single argument of the machine to run the test to. However, the output can be difficult to interpret.
Disclaimer: TReno's authors are associated with Caida.

bing
URL:http://spengler.econ.duke.edu/~ferizs/bing.html
Contact:Pierre Beyssac
Cost: free
Measures: Link bandwidth, with minimal injected traffic.
Mechanism: ICMP ECHO/REPLY, compare RTTs for various packet sizes.
Comments: Somewhat experimental: we were unable to get accurate bandwidth results from our brief experiments. The more recently released pathchar represents a more sophisticated usage of the same principle, with considerably more probes to each hop along the path; however, pathchar's bandwidth figures are not much more trustworthy than bing's. Bing differs from another piece of work with a similar aim, bprobe, in that bprobe uses packet-pair techniques instead of packet size / RTT comparison.

{b|c}probe
URL:http://www.cs.bu.edu/students/grads/carter/tools/Tools.html
Contact: Bob Carter (carter@cs.bu.edu)
Cost: free
Platforms: SGI
Mechanism: Uses packet-pair analysis from sending pair of ICMP echo packets.
Comments: Bprobe and cprobe use packet dispersion techniques to measure network bandwidth with minor impact on the network. Bprobe measures the maximum bandwidth of the bottleneck link of a route by sending a pair of packets and measuring the interarrival time between their return. Cprobe measures the amount of bandwidth available against competing traffic by sending a short stream of packets and watching how far the packets are separated upon return. This latter measure reflects bandwidth available to protocols lacking congestion control; see treno for an attempt at measuring "fair" bandwidth. Bprobe differs from another piece of work with a similar aim, bing, in that bing uses packet size / RTT comparisons instead of packet-pair techniques.

Internet Service Monitoring

Timeit
URL:ftp://ftp.va.pubnix.com/pub/uunet/timeit-2.1.tar.gz
Contact: Jeff Sedayao (sedayao@argus.intel.com),
Cindy Bickerstaff (cindyb@sousa.sc.intel.com),
Kotaro Akita ( http://www.princeton.edu/~kakita/)
Cost: free
Measures: web server reachability, performance Mechanism: HTTP GET to predefined list of web servers.
Review:
Success: Simple and useful tool for monitoring web server performance. Since web queries are a large portion of current Internet workloads, careful server selection could provide some broader indication of Internet performance.
Usability: Easy setup and maintence, but output format only appropriate for script-parsing (not human-compatible)
Stability: Good.
Other Considerations: Not very scalable: if many Internet sites ran this tool, the resulting measurement traffic would significantly increase load on popular servers. We recommend reducing query frequencies, perhaps 1/week, if the measurement goal can cope with low frequency.
Related Work: Also see Imeter, which was written by the same group but measures long-term ping performance instead of long-term web performance.

NetScore
URL:http://www.anacapa.com/
Contact: Anacapa Software (warrens@anacapa.com)
Cost: $100
Measures: Commercial service monitoring
Mechanism: Launches request to server once a minute, tracks and graphs response time, highlighting results above configured thresholds.

Keynote Perspective
URL:http://www.keynote.com/measures/backbones/backbones.html
Contact: Keynote (http://www.keynote.com)
Cost: Commercial, cost details on web page
Platforms:java
Measures: web service monitoring (see CAIDA review at www.caida.org/Tools/keywatch.html)
Mechanism: Keynote agents across the Internet periodically attempt to contact specified (tested) servers and relay performance results to Perspective Server software running at customer sites. The Server software places the data into an SQL database, to which customers can either send their own SQL queries, or use Keynote's analysis software, Perspective Desktop.
Review: (of demo copy of Perspective Desktop, available from Keynote's web server).
Features: Graphs various stored data about specified web server:
o Responsiveness (Good, Ok, Poor) per city (plotted on map) o Percentage of urban population in each reponsiveness category.
o Current one or two-day responsiveness by city, in bar chart or table format.
o Overall responsiveness by time of day, in graph or table format
o Alert indications
Success: It has the potential to say a great deal about web server performance from an end-user perspective.
User base: New product, small user base.
Usability: Demo copy was easy to use, at least on Perspective's prepicked set of servers. Probing a frequently varying set of servers would be difficult and expensive, but may not be an issue for many customers.
Stability: Improving. Still new and not fully debugged, but has improved since initial review; now at rev.1.3, which has added features and improved performance, including ability to compare graphs of multiple URLs.

goes here
URL:http://www.keynote.com/measures /backbones/backbones.html
Contact: (http://www.keynote.com)
Cost:
Platforms:
Measures, Mechanism, and Review:27 aug 97 review
Features:

Success:
User base:
Usability:
Stability:

SM-WEB and SM-SCENARIO
URL: http://www.servicemetrics.com/solutions/index.asp
Contact: (http://www.servicemetrics.com)
Cost:$$
Platforms:
Measures, Mechanism, and Review:27 aug 97 review
Features:

Success:
User base:
Usability:
Stability:

Systematic Pinging

NetStat
URL:http://netstat.net/
Contact:webmaster@netstat.net
Mechanism : ping

Review:
Success:
Usability:
Stability: Good.

Internet Weather for News hosts
URL:http://supercow.uoregon.edu/~uoweather/
Contact: Jon S. Stevens
Mechanism: ping

Review:An excellent ping service to over 150 major Usenet news servers throughout the world. Shows packet loss, RTT (min/avg/max) and a 24 hour (hour by hour status) for each Usenet news site. Does all checks from one place on the Internet
Success:
Usability:
Stability: Good.
URL:http://www.ripe.net/test-traffic
Contact:Henk Uijterwaal, henk@ripe.net
Mechanism : 1 way delays/loss between decicated test-boxes at ISP's

Review:
Success:
Usability:
Cost: free (though the number of test-boxes that we can install is limited). Stability: Good.

Internet Traffic Reports
URL:http://www.internettrafficreport.com
Contact: webmaster@InternetTrafficReport.com>
Mechanism: ping

Review: Yet another Internet Weather report. Provides 24hour and 7 day graph of Internet response time. Pings over 50 sites - with a heavy weighting for non-USA sites (50%) - something that Keynote ignores. Of moderate use to the busy sysadmin. Does all checks from one place on the Internet.
Success:
Usability:
Stability: Good.

Server monitor
URL:http://www.servermonitor.com
Contact: webmaster@servermonitor.com
Mechanism: HTTP

Review: Provide your server and this system will poll it every 15 minutes (24x7) and send you email alerts when your system stops answering. It can poll www, ftp, smtp, pop3, dns, telnet servers. An excellent free tool for those that don't have a local alert system set up yet. Does all checks from place on the Internet.
Success:
Usability:
Stability: Good.

MIDS Internet Weather Report
URL:http://www.mids.org/weather/
Contact:John Quarterman, Smoot Carl-Mitchell, Gretchen Phillips
Mechanism : ping
Earliest published Internet "weather" reports. Latency data from Austin, Texas to sites all over the world. Plots latencly distributions on mercator-projection maps across time. http://www3.mids.org/weather/pingstats/longterm/index.html shows data over long term, providing an interesting reflection of long-term Internet performance as steady improving.

Review:
Success: Admirably complete set of public data on wide-area Internet latency.
Usability: Reports crowded, difficult to read. Difficult to discern causes of latency variance, e.g., whether due to different paths/ISPs, or congestion (although it may not matter to most Internet users). Its use of only a single source for all the measurements (Austin, Texas) also limits utility.
Stability: Good.

Traceping
URL:http://www-nplvms.physics.ox.ac.uk/
Contact: John Macallister ( http://www-nplvms.physics.ox.ac.uk/www/traceping_author.html)
Cost:Available from the author by request
Mechanism: ping
Platforms: VMS
Traceping uses ping and traceroute to track packet loss rates to a variety of destinations. It is currently used to track performance between various mostly-international, mostly physics-related sites.

TRIUMF Network Statistics
URL:http://sitka.triumf.ca/
Contact: Andrew Daviel (http://sitka.triumf.ca/)
Mechanism: ping
TRIUMF regularly measures performance to various sites of interest, and visualizes results. Software implementing the pinging measurements and to draw some of the displayed graphs may be found at http://sitka.triumf.ca/net/pkt-loss-warning.tar.gz.

SLAC WAN Monitoring
URL:http://www.slac.stanford.edu/comp/net/wan-mon.html
Contact: Les Cottrell (http://www.slac.stanford.edu/owner/cottrell/),
Connie Logg (http://www.slac.stanford.edu/owner/cal/)
Mechanism: ping
SLAC regularly pings various sites of interest to gather latency/reachability information, and analysis results.
Review:
Success: Good monitoring of ESNET/SLAC-related sites. This and MIDS' Internet Weather Report seem shares with MIDS' the caveat that it is all from a single site.
Usability: Data carefully analyzed and well-presented.
Stability: Effort started in 1995, allows long-term trend analysis. (so what does it say then? what's happening in long-term, and what are the dependent parameters?)
Update 4/99: Currently have 18 monitoring sites in 10 countries.

ISP Measurement

ClearInk Weather Report
URL:http://www.internetweather.com/
Contact: Clear Ink (weather@internetweather.com)
Comments: ICMP
Tracks packet latency and loss from the Bay Area to various major ISPs, by periodically pinging various major ISP sites from the Clear Ink site in the Bay Area.
Review:
Success: ClearInk's weather report is useful for guessing in which major provider Internet problems may lie.
Usability: Like the MIDS weather report, it suffers from the disadvantages of only gathering data from a single site (located in the Bay Area). It has the additional limitation of only gathering data from a small number of sample hosts - one per major ISP.
Stability: Good.
Comparison: Surprisingly from the similar names, the ClearInk weather report actually performs a different function from the MIDS weather report, attempting to measure performance of the Internet core rather than the end-to-end performance that MIDS reports on. Inverse's reports are better for many purposes, but the ClearInk report is free and available in real time.

Inverse Internet Measurement Service
URL:http://www.inversenet.com/products/index.html
Contact: Inverse Network Technology (http://www.inversenet.com/)
Cost: Commercial, cost unknown
Measures: ISP benchmarking service (performance and reachability) from dialin perspective: call success rate, connection baud-rate, call failure rates, DNS, web, email performance/reliability.
Mechanism: Dials into ISP POPs in many spots scattered across US.
Comments Averages resulting performance profiles to create a national average across the most popular ISPs for comparison purposes.

TENnet's ISP weather service
URL:http://weather.ten.net/
Contact: Aaron Tavistock (aaron@ten.net)
Cost: results only free, code not provided.
Mechanism: ping
Latency/loss data for gaming machines, facilitate performance monitoring/comparison.
Comments: TEN notes caveat that data does not necessarily reflect ultimate ISP performance/quality.

Montreal Internet service providers
URL:http://megasun.bch.umontreal.ca/~burkep/sps2.html
Contact: Peter Burke Consulting ( http://megasun.bch.umontreal.ca/~burkep/)
Cost: results only free, code not provided.
Mechanism: ping
Latency/loss data for Montreal ISPs, to facilitate performance comparison.
Comments: Burke notes caveat that ISP service involves many more aspects than are reflected in this kind of data.

ORNL Internet Monitoring Activities
URL:http://www.ornl.gov/~hny/netmon.html
Contact: Gary Haney (hny@ornl.gov)
Mechanism: ping
ORNL also conducts a regular survey of latency and loss, but to fewer sites (ESnet-related only), and with less post-analysis.

National Internet Measurement Infrastructure (NIMI)
URL:http://www.psc.edu/networking/nimi/
Contact:Vern PaxsonJamshid Mahdavi
Mechanism: loosely NPD-based), but nascent effort, so still unclear

Surveyor, CSG effort
URL:http://www.advanced.org/csg-ippm/
Contact:Guy Almes
Mechanism: so far ping, but nascent effort, so still unclear

Internet Cloud Measurement

Network Probe Daemon
URL:http://nic.merit.edu/ipma/npd/
(not active anymore) Contact: Vern Paxson (vern@ee.lbl.gov)
Mechanism: traceroute, tcp test connection, tcpdump of that connection.
NPD was a prototype of an Internet measurement infrastructure. It was first used to gather traceroute measurements for characterizing end-to-end Internet routing, which Vern Paxson originally deployed for thesis research and Merit also supported for a while thereafter. Vern's Sigcom '96 paper discuss results of his study.
NPD also supported TCP bulk transfer measurements for characterizing end-to-end Internet packet dynamics. Vern's Sigcomm '97 paper discusses results from experience with this functionality of NPD.

NetNow
URL:http://nic.merit.edu/ipma/netnow/
Contact: Craig Labovitz (labovit@merit.edu)
NetNow measures delay and packet loss across components of Internet. Until recently, it was deployed to measure delay/loss between NAPs across various ISP backbones. Note that this tool and its testing and deployment is now part of the Merit IPMA project (see the next entry).

IPMA
URL:http://www.merit.edu/ipma
Contact: Merit IPMA Project (ipma@merit.edu)
The Merit IPMA project focuses on various statistics-collection activities, largely concerning ongoing Internet packet loss, routing, and latency.

Routing Arbiter statistics
URL:http://www.ra.net/
Contact: none
The portion of the Routing Arbiter's mission concerning gathering Internet statistics is now defunct. It is replaced by the Merit IPMA project (see the previous entry).

looking glass
URL:http://nitrous.digex.net
Contact: Ed Kern (ejk@digex.net)
Looking glass is a web page with a query interface to gather various router statistics from various spots, including Mae-East, Sprint-NAP, and Mae-West. It seems intended as a debugging tool.

Application Performance

Unidata IDD Latencies
URL:http://www.unidata.ucar.edu/funding/idd/StatsClient.html
Contact: Unidata (http://www.unidata.ucar.edu/)
Cost: Latency results are freely available.
Example of a monitoring system for a sophisticated Internet application. Track throughput to Unidata's weather data distribution service clients. Useful model for other developers of Internet data distribution systems. Graphs at http://www.unidata.ucar.edu/staff/chiz/latency/.

High Performance Measurement Tools

netperf
URL:http://www.cup.hp.com/netperf/NetperfPage.html
Contact: Rick Jones (raj@hpisrdq.cup.hp.com)
Cost: free
Platforms: Unix
Measures: Max TCP/IP latency and throughput Comments: Netperf is largely a LAN-oriented network performance benchmark. It measures throughput, minimal latency, TCP transaction speed (e.g., connection, request, response, disconnection), CPU utilization during test. It supports many transport mechanisms (TCP, UDP, Unix domain, DLPI, Fore ATM, HIPPI, XTI, others).
Includes database of past results reports over several years: http://www.cup.hp.com/netperf/numbers/NetperfBrowse.html.
Review:
Success: Perhaps most complete and realistic high-performance benchmark at this time.
Usability: Good. Most benchmarks of this sort require many options and identical server/client configuration. Netperf has well-chosen defaults, so the client side requires few options, while the server side requires no options and unobtrusively turns into a daemon. Argument syntax does sometimes seem slightly quirky.
Stability: Good, although some non-HP ports fail in odd ways (particularly on CPU utilization values).

ttcp
URL:ftp://ftp.arl.mil/pub/ttcp/ (includes many common variants)
Note: newer http://www.leo.org/~elmar/nttcp/, has enhancements, e.g., UDP mcast transfers. -- Elmar Bartel.)
Contact: ARL (was BRL) (ftp@arl.mil)
Cost: free
Platforms: Unix
Comments: free
Originally written to move files around, but became the classic throughput benchmark or load generator, with the addition of support for sourcing to/from /dev/null. Has spawned many variants, recent ones include support for UDP, data pattern generation, page alignment, and even alignment offset control.

nettest
URL:ftp://ftp.sgi.com/sgi/src/nettest
Contact:unknown
Cost: free
Platforms: Unix (especially Unicos)
Throughput benchmark written at Cray. It is currently unmaintained, and never achieved really wide usage.

NetSpec
URL:http://www.ittc.ukans.edu/Projects/AAI/products/netspec/
Contact:Roel Jonkman
Cost: Binaries are free.
Platforms: DEC Alpha, SunOS, Solaris, SGI, RS/6000 Netspec is a scripting language for writing throughput benchmarks. Facilitates writing benchmarks with complex communication and workload patterns. By contrast, most throughput benchmarks, such as netperf and ttcp, only allow for point-to-point communication with highly standardized workload of back-to-back single-sized packets. Only throughput benchmarks now; plans for other test, e.g., request-response and trace-driven benchmarks.

The Mbone

MTrace
URL:ftp://ftp.parc.xerox.com/pub/net-research/ipmulti/
Contact: Bill Fenner (fenner@parc.xerox.com)
Cost: free
Traces hop-by-hop to individual destinations in multicast groups, helps debug multicast routing problems, analogous to traceroute for unicast.
Review:
Success: Currently the most effective means of debugging mbone routing problems. Vat audio tool now incorporates mtrace support for launching it to other members of a vat conversation.
Usability: Non-trival to interpret; requires several arguements to run and yields fairly complex information.
Stability: Good, but often gives suspicious information, like its counterpart, traceroute. Is particularly specious with non-recent versions of mbone software used along traced path.

MultiMON
URL:ftp://debra.dgbt.doc.ca/pub/mbone/multimon/latest/
FTP:ftp://debra.dgbt.doc.ca/pub/mbone/multimon/latest
Contact: J. L. Robinson, (john@mars.dgrc.doc.ca),
J. A. Stewart (luigi@mars.dgrc.doc.ca)
Cost: free
Mechanism: tcpdump for packet collection
Comments: Session and traffic monitor for the mbone.

SNMP-based mrouted
URL:http://www.merit.edu/net-research/mbone/
Contact: Dave Thaler (thalerd@eecs.umich.edu)
Cost: free
Version of mrouted manageable by SNMP and supporting DVMRP MIB. Includes several associated multicast network management utilities.

mview
URL:http://www.merit.edu/~mbone/mviewdoc/Welcome.html
Contact: Dave Thaler (thalerd@eecs.umich.edu)
Cost: free
Mechanism: SNMP
Comments: SNMP-querier for SNMP-based mrouted described above.

Mbone visualization
URL:http://www.caida.org/Mbone/daily.html
Contact: CAIDA (info@caida.org)
Cost: free
Geographic visualization of current mbone tunnel topology, updated daily.

A Map of the Mbone
URL:http://www.cs.berkeley.edu/~elan/mbone.html
Contact: Elan Amir (elan@cs.berkeley.edu)
Cost: results are free
Measures: static map of the Mbone from August 1996.

Free Packet Collection Software

Argus
URL:ftp://ftp.sei.cmu.edu/pub/argus-1.5/
Contact:SEI Argus team
Cost: free
Packet storage and analysis environment, helps writing packet analysis programs based on a packetfilter paradigm. Like NLANR/Caida's flow processing suite, it is intended for general-purpose packet analysis. However, it lacks the flow abstraction that gives the NLANR flows suite and other flow-based analysis tools a great deal of their power, and is unhelpful in generating the distributions of statistics across flows that are so common in flow-based analysis.

tcpdump
URL:http://ee.lbl.gov/
Contact: LBNL (tcpdump@ee.lbl.gov)
Cost: free
Platforms: Unix
Review:
Success: Canonical portable packet collector, built using libpcap. Network researchers frequently use tcpdump in lieu of bundled packet collectors; some (e.g., Digital) even ship it as bundled packet dumper.
Usability: Requires reasonable understanding of networking to interpret. Output format easily and portably analyzed using awk, sed, and perl scripts.
Stability: Stable and mature.

libpcap
URL:http://ee.lbl.gov/
Contact: LBL (libpcap@ee.lbl.gov)
Cost: free
Platforms: Unix
Comments: Portable library for dumping packets, to serve as machine-independent layer packet collection mechanisms of different operating systems. Originally written as tcpdump internal portability code.
Review:
Success: Packet dumping programs that use it automatically enjoy a certain degree of portability. Makes useful packet dumping applications much easier to write.
Usability: For most purposes, the pcap interface interface seems well chosen. It is about as difficult as directly using any single vendor's packet dumping kernel facility, with a similar number of quirks, but using it means porting once rather than to each proprietary framework.
Stability: The authors state that the pcap interface is likely to change; indeed, the current version number is 0.3 (well below 1.0). But note that tcpdump, written on top of libpcap, is quite stable.

pcapture
URL:http://ee.lbl.gov/
Contact: LBL (pcapture@ee.lbl.gov)
Cost: free
Platforms: libpcap
Sample libpcap application to captures data to disk in the same manner as tcpdump's -w option. It is intended as example code for libpcap, not as a serious packet capture application.

Packetman
URL:http://www.cs.curtin.edu.au/~netman/etherman.html
Contact: Netman Group (http://www.cs.curtin.edu.au/~netman/)
Cost: binaries are free.
Platforms:unix, DOS
Comments: LAN-oriented packet dump program, part of Netman network monitoring toolset.

IPTraf
URL:http://cebu.mozcom.com/riker/iptraf/index.html
Contact: Gerard Paul Java
Cost: free under GNU2.0.
Platforms:Linux 2.0 and higher
Comments: curses-based IP LAN monitor that generates network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info node stats, IP checksum errors and other network-based information.
Review:
Success: compiled cleanly on slackware 3.4. Provides rich set of diagnostics, more post-processing perl scripts than, e.g., tcpdump.
Problems: Only runs on linux tcpdpriv
URL: http://ita.ee.lbl.gov/html/contrib/tcpdpriv.html
Summary: A program for eliminating confidential information from packets collected on a network interface (or, from trace files created using the -w argument to tcpdump). Currently only works on SunOS, Solaris, and FreeBSD systems. While it should port to other systems fairly easily, there have been problems reported. The software is copyrighted by Ipsilon Networks, Inc. (a "BSD-style" copyright)
Avail: free

Bundled Packet Collection Software

etherfind
Contact: Sun
Cost: binary bundled with SunOS.
Packet collector bundled with SunOS.

iptrace
Contact: IBM
Cost: binary bundled with AIX.
Iptrace is the packet collection program that comes with AIX.

netsnoop
Contact: SGI
Cost: binary bundled with Irix.
Packet collection program that comes with Irix.

snoop
Contact: Sun
Cost: binary bundled with Solaris.
Packet collection program that comes with Solaris.

Opensource Software Packet Analyzers

Ethereal
URL: http://ethereal.zing.org
Contact:Ethereal mailing lists)
Platforms: Unix (GNU)
Cost: free
Live data can be read from ehternet, FDDI, PPP, token-ring, X.25, or Clissical IP over ATM interfaces. Can read capture files from tcpdump (libpcap), NAI's Sniffer (uncompressed), Sniffer Pro, NetXray, snoop, Shomiti, AIX's iptrace, MS Network Monitor, Novell's LanAlyzer, RADCOM's WAN/LAN Analyzer, HP-UX nettl, and ISDN4BSD. Can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers. Ethereal can decompress gzipped capture files on the fly.

Commercial Software Packet Analyzers

Century LAN Analyzer
URL:http://www.shomiti.com/product.html
Contact: Shomiti Systems (http://www.shomiti.com/)
Platforms: Windows 95
Cost: $499
Includes related products, e.g., optional performance-enhancing hardware support.

EtherPeek
URL:http://www.aggroup.com/prodinfo/products.htmy
Contact: the ag group, inc. (http://www.aggroup.com/)
Platforms: Mac, Win95/NT
Cost: $995

LANSleuth
URL:http://www.ssinc.com/lansleuth/
Contact: SSI (http://www.ssinc.com/)
Platforms: Windows
Cost: $489 for basic pkg; $749 for token ring; $1495 for LANSleuth Commander + $250 per satellite.
Includes optional remote extension.

Monet
URL:http://www.mg-soft.si/monetla.html
Contact:MG-SOFT
Cost: $900-$1800
Platforms: DOS

Netxray and Webxray
URL:http://www.cinco.com
Contact: Cinco software (http://www.cinco.com/)
Cost: contact vendor
Platforms: Windows 95 and NT

Netminder Ethernet
URL:http://www.neon.com/NetMinder_Ethernet.html
Contact: Neon Software (http://www.neon.com/)
Cost: $795
Platforms: Mac

Observer
URL:http://www.netinst.com/pages/product_info.html
Contact:Network Instrument
Cost: $495; $795 for Analyst, $195 per Probe
Platforms: Windows
Comments: Another version, called Analyst/Probe, does remote packet monitoring.

Hardware Packet Analyzers

CellBlaster
URL:http://www.net2net.com/overview.html
Contact: Net2Net (http://www.net2net.com/)
Cost: Starts at $19,995.
ATM cell analyzer, can keep up with wire speed from various ATM link types, up to OC3. Has features of most high-end packet dumping hardware, including workload generation. Each one can measure either a single full-duplex or 2 single-duplex links; comes with either 16 or 64 MB of buffer memory. Offline analysis application runs on Windows and communicates with one or more CellBlasters via Ethernet port.

HP Internet Advisor
URL:http://www.tmo.hp.com/tmo/pia/InternetAdvisor/English/index.html
Contact: HP (http://www.hp.com/)
Cost: Varies by model.
Hewlett-Packard's line of packet analyzers.

Sniffer
URL:http://www.ngc.com/
Contact: Network General
Cost: Varies by model.
Likely most popular packet sniffing and analysis hardware.

Wandel and Goltermann packet analyzers
URL:http://www.wg.com/products/dataanal.html
Contact: Wandel and Goltermann (http://www.wg.com/)
Cost: Varies by model.
Packet analyzers and workload generators.

Flow Collectors

Coral, oc3mon
URL:http://www.nlanr.net/NA/Oc3mon/
Contact: NLANR (info@nlanr.net)
Cost: free
Platform:DOS/Fore ATM, FreeBSD2.2 planned
Coral (the OC3MON/OC12MON collection boxes and the higher level flow analysis software) collects ATM cells via an optical fiber tap, and reconstructs IP packets and then flow information from the cells (typically only the first cell in a given packet needed to get the entire TCP/IP header.). To optimize for packet header extraction, OC3MON used modified firmware for the Fore ATM i960 cards. Next version, OC12MON, will be using completely different cards to obtain higher speeds and expanded functionality (e.g., multiple cells of same packet)

NetFlow Interface
URL:http://www.cisco.com/warp/public/cc/cisco/mkt/ios/netflow/tech/napps_wp.htm
Contact:Cisco
Documented interface to Cisco routers that allows users to track flows statistics.

cflowd
URL:http://engr.ans.net/cflowd/
Contact: Daniel W. McRobb (dwm@ans.net),
John Hawkinson (jhawk@bbnplanet.net)
Cost: free
Platform: Cisco/Unix
Host program to collect/aggregate data from by Cisco routers' netflow flow-export facility.

Matt Petach has also provided some higher level scripts for processing netflow data in conjunction with cflowd: http://http://buckaroo.xo.com/CFLOWD/>

flow-*
URL:ftp://ftp.net.ohio-state.edu/users/maf/priv/flow.tar
Contact: Mark Fullmer (maf+@osu.edu)
Cost: free
Platforms: Unix
Programs to manipulate NetFlow accounting data:
flow-capture receives packets from routers, compresses them and writes them to files, does file maintenance to prevent disk from filling up. Compression allows large amounts of data being kept.
flow-cat, flow-stat, flow-filter etc.: analyze captured files.

NeTraMet
URL:http://www.auckland.ac.nz/net/Accounting/ntm.Release.note.html
Contact: Nevil Brownlee ( http://www.auckland.ac.nz/cc/People/NB.html)
Platforms: Unix, DOS
Cost: free
Flow monitoring/analysis for accounting purposes. Likely the most sophisticated free packet accounting tool available.

Collection Efforts

Internet Traffic Archive
URL:http://www.acm.org/sigcomm/ITA/
Contact:
Vern Paxson (vern@ee.lbl.gov),
Jeff Mogul (mogul@wrl.dec.com),
Peter Danzig (danzig@usc.edu),
Mike Schwartz (schwartz@home.net)
Archive of large traces of packets and other data of potential utility for analysis studies or other research. Includes tools to aid parsing and analysis.

insight into internet workloads
URL:http://www.nlanr.net/NA/
Contact: NLANR (info@nlanr.net)
Archive of some traces from FIX-west, with flow analyses, and associated tools.

DEC HTTP traces
URL: ftp://ftp.digital.com/pub/DEC/traces/proxy/webtraces.html
Contact:
Tom Kroeger (http://www.cse.ucsc.edu/~tmk/),
Jeff Mogul (mogul@wrl.dec.com),
Carlos Maltzahn ( http://www.cs.Colorado.edu/~carlosm/)
HTTP document traces from Digital's main web proxies.

Waikato ATM Cell Measurement Data Archive
URL:http://phoenix.cs.waikato.ac.nz/atm/darchive/
Contact: University of Waikato ATM Group ( http://phoenix.cs.waikato.ac.nz/atm/)
Archive of ATM cell traces measured on the New Zealand OPERA trial network. Includes related measurement tools.

Real-Time Traffic Monitors

Etherman
URL:http://www.cs.curtin.edu.au/~netman/etherman.html
Contact: Netman Group (http://www.cs.curtin.edu.au/~netman/)
Cost: Binary is free
Real-time monitor displaying connectivity of currently active flows across monitored network, by host, traffic volume, and protocol suite (e.g., TCP/IP, Banyan, Novell, etc.). Part of the Netman network monitoring toolset.

Interman
URL:http://www.cs.curtin.edu.au/~netman/interman.html
Contact: Netman Group (http://www.cs.curtin.edu.au/~netman/)
Cost: Binary is free
Real-time monitor displaying connectivity of currently active flows crossing the monitored network, by individual host, network, and protocol. Part of the Netman network monitoring toolset. @diff etherman? have you used it? can we find soeone who has and/or ask them for blurb?

NetMeter
URL:http://www.aggroup.com/prodinfo/netmonit/netmeter/netmeter.htmy
Contact: the ag group, inc. (http://www.aggroup.com)
Cost: $395
Platform: Mac
Real-time traffic monitor with flexible, multimedia display facilities. Shows variety of data in either various traditional graph or alert formats, in various audio formats, or even as QuickTime movie. Can use either ag group Satellites or SNMP data sources.
Review:http://www.macworld.com/pages/june.96/Reviews.2144.html

nfswatch
URL:ftp://coast.cs.purdue.edu/pub/tools/unix/nfswatch/nfswatch4.2.tar.gz
Contact: Dave Curry (davy@ecn.purdue.edu),
Jeff Mogul (mogul@wrl.dec.com)
Cost: free
Platform: Unix
Nfswatch is an NFS monitor; tracks current activity by promiscuously reading NFS packets from LAN interface.

Skyline/Satellite
URL:http://www.aggroup.com/prodinfo/netmonit/skyline/skyline.htmy
Contact: the ag group, inc. (http://www.aggroup.com)
Cost: $795 + ~$300 per Satellite
Platform: Mac
Traffic monitor for the Mac; can collect data from multiple segments, each watched by a different "Satellite."

TrafficWatch II
URL:Contact: Neon Software (http://www.neon.com)
Cost: $495
Platform: Mac
Traffic monitor for the Mac. Displays include traffic rates, protocol usage, error rates.

Offline Traffic Analysis Tools

tcptrace
URL:http://jarok.cs.ohiou.edu/software/tcptrace/tcptrace.html
Contact: Shawn Ostermann (ostermann@cs.ohiou.edu)
Platforms:unix
Cost: free
TCP flow analysis and plotting program, requires xplot to view graphs.

xplot
URL:ftp://mercury.lcs.mit.edu/pub/shep/xplot.tar.gz
Contact: Tim Shepard (shep@lcs.mit.edu)
Cost: free
Platforms: Unix
The xplot distribution contains a fairly conventional graphing/plotting tool (xplot itself), a script to turn tcpdump output into input for the plotting tool, and some sample code to generate commands to plot collected TCP data.

tracelook
URL:http://ita.ee.lbl.gov/html/contrib/tracelook.html
Contact: Greg Minshall (minshall@ipsilon.com)
Cost: free
Platform: Tcl/TK
Tcl/TK program to graphically view trace files from tcpdump -w output.

Statistics Collection

BBN/StatsWise
URL:http://www.bbn.com/offerings/statswise.html
Contact: Bob Brown (bbrown@bbn.com)
Cost: commercial, cost unknown
Analyzes statistics to generate performance reports, using data from either StatsWise itself or a common NMS (HP OpenView, Cabletron Spectrum, Sun Solstice, or IBM NetView).

ccci
URL:http://www.ccci.com/product/papers/pete/scripts/scripts.htm
Contact: Peter J. Welcher(pjw@ccci.com)
Cost: free
Platforms: Unix
Programs to manipulate netFlow accounting data:
@@n

CyberGauge
URL:http://www.neon.com/CyberGauge.html
Contact: Neon Software (http://www.neon.com/)
Cost: $139
Mechanism: SNMP
Platforms: Mac
Collects, displays, and archives SNMP throughput statistics.

mrtg
URL:http://www.caida.org/MRTG
Contact:
Tobias Oetiker ( http://www.ee.ethz.ch/~oetiker) Cost: free
Mechanism: SNMP
Platforms: Unix
Collects and graphs router SNMP statistics. Popular.

RRDtool
URL:http://www.ee.ethz.ch/~oetiker/webtools/RRDtool/
Contact:
Tobias Oetiker ( http://www.ee.ethz.ch/~oetiker) Cost: free
Mechanism: SNMP, others
Platforms: Unix
`Round Robin Database', back end to MRTG-NG, system to store and display time-series data (e.g. bandwidth, machine-room temperature, server load average). Stores data compactly, to render constant storage requirements over time. Presents useful graphs by processing the data to enforce a certain data density. Can be used either via simple wrapper scripts (from shell or Perl) or via frontends that poll network devices and put a friendly user interface on it.

NNStat
URL:ftp://gatekeeper.dec.com/pub/DEC/net/NNstat_3.3beta.tar.Z
Contact: Jeff Mogul (mogul@wrl.dec.com),
Amoss Shapira (amoss@cs.huji.ac.il)
Cost: free
Mechanism: Collects statistics by packet sampling from interface in promiscuous mode, tracks stats per user-specified script.
Platform: Unix

Scion
URL:http://www.merit.edu/~netscarf/
Contact: Merit NetSCARF Team (netscarf-team@merit.edu)
Cost: free
Platforms: Unix, Windows NT
Mechanism: SNMP
Product of Merit NetSCARF team. Collects and displays performance-related SNMP statistics.

TRENDsnmp+
URL:http://www.desktalk.com/trend.html
Contact: Desktalk Systems (http://www.desktalk.com)
Cost: $8000
Mechanism: SNMP, RMON, and NETscout RMON extensions.
Review:http://netman.cit.buffalo.edu/ProdNotes/TRENDsnmpNotes-jcmurphy.html Collects/analyzes SNMP and RMON data. SQL for data storage/queries.

Internet Measurement Visualization

Caidants
URL:http://www.caida.org/Caidants/
Contact: CAIDA (info@caida.org)
Cost: free
Various and sundry network visualization tools used in NLANR projects.

fishes
URL:http://www.caida.org/Viz/AllsWell/
Contact: CAIDA (info@caida.org)
Visualizes latency variance on routes to a specified set of hosts. As yet very experimental.

Squid web cache visualization
URL:http://ircache.nlanr.net/Cache/cacheviz.html
Contact: NLANR (info@nlanr.net)
Geographic visualization of NLANR cache hierarchy. Updated daily.

ASExplorer
URL:http://www.merit.edu/ipma/asexplorer/
Contact: Merit IPMA Project (ipma@merit.edu)
Dynamic map of AS interconnection.

pubnetmap
URL:http://www.jevans.com/pubnetmap.html
Contact: Dave Jevans (http://www.jevans.com)
Attempt to visualize links and latencies for the entire Internet. Necessarily extremely crowded.

Geotraceman
URL:http://www.cs.curtin.edu.au/~netman/geotraceman.html/
Contact: Netman Group ( http://www.cs.curtin.edu.au/~netman/ )
Comments: ICMP
Geographical visualization of traceroute output, i.e., illustrates the route a packet takes on a world globe. Part of the Netman network monitoring toolset.

Hostname to Lat/Long
URL:http://cello.cs.uiuc.edu/cgi-bin/slamm/ip2ll/
Contact: Matt Gardner (mjgardne@cs.uiuc.edu)
Cost: results free, source code unavailable
Web-based interactive database for converting hostnames to latitude and longitude of that host, either via geographical location information placed in DNS or by looking up the domain name to try to figure out the city it it is located in. Useful subroutine for Internet mappers.

Matrix Information & Directory Services
URL:http://www.mids.org/
Contact:John Quarterman & Co.
Cost: commercial consulting service, prices on web page and by negotiation.
Comments: Strong Internet cartography. In addition to Internet weather report, contains many interesting Internet maps.

Network Management Systems

Network management systems (NMS') are complex pieces of software that monitor various aspects of most devices on a network. Usually they are structured as multiple windows, screens, or applications in a large GUI-oriented framework, each of which monitors a different aspect of the managed network devices. All gather much of their data through SNMP, RMON, and related extensions.

Each NMS supports a different set of functionality, but in general, most support a large subset of the following:

  • Detecting, filtering, and passing error condition alerts on to network administrators.
  • Displaying maps of managed devices.
  • Periodically probing device reachability.
  • Network usage monitoring, in terms of packets and bytes.
  • Some user-specified SNMP MIB variable monitoring.
  • Enterprise support - the ability to scale to many hosts on many networks with minimal loss of usability. This is typically done through network hierarchies.

The most obvious classification of - what really makes the most difference to an NMS' overall design - seems to be by who wrote them - e.g., hardware vendor vs. independent software vendor vs. academia/gov't. The exception to that is that there seems to be an emerging class of interesting NMS' labeled network planning systems.

Free Network Management Systems

SiteScope
URL:http://www.freshtech.com/>
Reviewed by:Kevin Wooley
Contact:support@freshtech.com
Cost: for sale by Freshwater software, licensing fees vary.
main focus is web server probing, but also tests for DNS, mail, inetd, others. can also monitor remote CPU, and disk. good packaging, back end java w web front end. Nice user interface. Can set alarms to, e.g., page or email.

HNMS
URL:http://www.cosmic.uga.edu/pub/hnms.info.shtml
Contact: NASA COSMIC Tech Tranfer at UGA (http://www.cosmic.uga.edu/)
Cost: for sale by NASA.
Older NMS written by NASA, available for sale through the COSMIC technology transfer center at the University of Georgia.

Nocol
URL:ftp://ftp.navya.com/pub/vikas/nocol.tar.gz
Contact: Vikas Aggarwal (vikas@navya.com)
Cost: free
Platforms: Unix
Nocol is an old tty-based network management package.

Unavailability Alerting

The single application in category implements a specific subset of network management system functionality: periodically monitoring services and hosts for availability. When a service is found unavailable, the tool notifies a designated administrator. Not so much a network measurement tool as the others, but does embody a basic functionality found in most other larger monitoring packages.

Sysmon
URL:ftp://puck.nether.net/pub/jared
Contact: Jared Mauch (jared@puck.nether.net)
Cost: free
Platforms: Unix
Sysmon periodically attempts to contact various services, via TCP, or hosts, via 'ping,' to check availability. Upon failure, sysmon emails a note to an associated admin. Sysmon boasts a powerful, hierarchical configuration file format.

Network Planning Systems

There is not a widely-accepted trade press term for the systems listed in this section; we will use network planning system. While NMS's make information available to network managers, a network planning system rather addresses user-level needs. Because of the dependency of network planning systems on NMS-style monitoring, a great deal of overlap often exists between two classes of system, e.g., some NMS's include the network planning functionality.

Components of network planning systems may include modules for capacity management, to warn of impending bottlenecks, simulation subsystems, and to predict consequences of network changes. Network planning systems typically consist of a fairly expensive suite of tools, though the subsystems may be sold separately.

HP NetMetrix
URL:http://www.tmo.hp.com/tmo/ntd/products/products.html
Contact: Hewlett-Packard (http://www.hp.com/)
Cost: commercial, cost unknown
Mechanism: SNMP, RMON2
Hewlett-Packard's family of network planning packages.

NetMaker XA
URL:http://www.makesystems.com/tooltop.html
Contact: make systems (http://www.makesystems.com/)
Cost: commercial, cost unknown
NetMaker XA is a network management system that includes extensive network planning packages.

Netsys
URL:http://www.netsystech.com/
Contact: Netsys (info@netsystech.com/)
Cost: $4995+ for Connectivity Tools, $4995+ for Performance Tools, $1500 for Netsys Advisor
Platforms: SunOS, Solaris, AIX, HPUX
Mechanism: SNMP
Network planning package with integrated simulation functionality.

rancid
URL: http://www.shrubbery.net/rancid
Contact: rancid@shrubbery.net
Cost: free
Platforms: SunOS, Solaris, others?
Mechanism:Originally written by Hank Kilmer.

Independent Commercial Network Management Systems

These are network management systems sold by companies that are not primarily network hardware vendors.

Castle Rock SNMPc
URL:http://www.castlerock.com/
Contact: Castle Rock Computing (sales@castlerock.com)
Cost: $795
Platform: Windows
Mechanism: SNMP
Castle Rock's network management system.
Review:http://techweb.cmp.com/nc/713/713revSNMP.html

HelpSystems InterMapper
URL:https://www.helpsystems.com/products/network-monitoring-software/
Contact:InterMapper info
Cost: Free two-week trial. Starting at $550. See InterMapper pricing for details.
Platforms: Windows, Mac, Linux
Mechanism: SNMP
NMS from Dartmouth College for TCP/IP and AppleTalk.

NARUS Intelligence
URL: http://www.narus.com/solutions/intelligence.html
Contact:NARUS, Inc.Cost: commercial, cost unknown
Platforms: Linux-based (Intel and SPARC)
Mechanism: SNMP
Runs at full line speed (Gigabit Ethernet, OC3 and OC12 in production; OC48 in alpha). Complete system is designed to operate 24x7. Highly available, fault tolerant and completely distributed. Basic output is flow information. In addition, it is possible to add application specific information, to aggregate and correlate information from multiple analyzers, to apply business rules on the data, to define thresholds, etc.

Nebula
URL:http://www.linmor.com/products.html
Contact: Linmore Technologies (http://www.linmor.com/)
Cost: unknown

NetScout
URL:http://www.netscout.com/products/products.html
Contact:NetScout Systems
Mechanism: SNMP, RMON2, proprietary RMON enhancements
Cost: commercial, cost unknown
Particularly powerful probing capabilities, includes optional hardware probes that work with NETscout NMS through RMON2 and proprietary RMON enhancements. Some vendors have implemented at least some of NETscout's RMON enhancements. DS3 and OC3 ATM Probes. T1/E1, T3/E3, T1/D and E1/D Demarcation-point, Channelized T1/E1 WAN/Frame Relay Probes. Gigabit Ethernet, Multiparty Fast Ethernet, and Fast Ether Switched LAN Probes. Ethernet, Token Ring, and FDDI Shared LAN Probes.

Nebula
URL:http://www.linmo r.com/products.html
Contact: Linmore Technologies (htt p://www.linmor.com/)
Cost: unknown

NIKSUN, Inc.
URL:http: //www.niksun.com/products/
Contact:NIKSUN, Inc.
Mechanism:non-intrusive traffic flow recorders and analyzers
Cost: commercial, cost unknown
NetVCR, NetDetector, NetReport: FreeBSD-based, supports T1, E1(ppp and fr), v.35, HSSI, Ethernet(10/100), FDDI, ATM OC3 and OC12. Optimizations for capturing data in real-time.

Network Health
URL:http://www.concord.com/products.html
Contact: Concord Communications (Concord Communications)
Cost: $9995 for Router/Switch, $9995 for LAN/WAN, $14995 for Bay Dialogs, $8995 for Frame Relay, $6995 for Spectrum.

*PM
URL:http://www.dddv.com/products/products.html
Contact: 3DV (http://www.dddv.com/)
Cost: $5000 for RouterPM, $100-$1000/switch for SwitchPM, $50 per segment for HubPM. Mechanism: SNMP
Consists of multiple applications - RouterPM, HubPM,SwitchPM, and NetworkPM.

UltraDNS Services
URL:http://www.ultradns.com/
Contact: NeuStar, Inc. (NeuStar, Inc.)
Cost: $50-$500 monthly managed DNS, plus options

US Hardware-Specific Network Management Systems

These are network management systems sold by hardware vendors. Most of these support network devices from various vendors. Many even will work on multiple workstation platforms, though most were originally written to run specifically on the platform in question.

Vendors of both network hardware and NMS' often implement special proprietary MIBs only supported by that NMS and perhaps one or two other NMS'.

Solstice
URL:http://www.sun.com/products-n-solutions/sw/solstice/index.html
Contact: Sun (http://www.sun.com/sales-n-service/index.html)
Cost: commercial, cost unknown
Mechanism: SNMP
Sun's popular network management package, formerly called SunNet Manager.
Review:http://techweb.cmp.com/nc/713/713revSNMP.html

OpenView
URL:http://www.hp.com/go/openview>
Contact: HP (http://www.hp.com/openview/contacts.html)
Cost: $1000
Many network devices support it since it has been most popular open NMS for a while.
Review:http://techweb.cmp.com/nc/713/713revSNMP.html

NetView
URL:http://www.tivoli.com/products/netview/
Contact: Tivoli (info@tivoli.com) (now a part of IBM)
Cost: commercial, cost unknown

Spectrum
URL:http://www.ctron.com/spectrum/
Contact: Cabletron (http://www.ctron.com/Talk-to-Us.html)
Cost: commercial, cost unknown

ClearVISN
URL:http://www.networks.digital.com/dr/clearvisn/featuring.html
Contact: DEC Network Products ( http://www.networks.digital.com/ )
Cost: commercial, cost unknown
Mechanism:SNMP, RMON.

DECelm
URL:http://www.digital.com/info/mcc/
Contact: Digital Equipment Corporation
Cost: commercial, cost unknown
Platforms: VMS
VMS-based network management system targeted at DEC proprietary hardware, e.g., DECbridges, DEC FDDI concentrators.

European Hardware-Specific

ISM TransMaster
URL:http://www.ism.bull.net/ism/doc-down/brochure/networks/ismneta.htm
Contact: Bull ISM (http://www.ism.bull.net/)
Cost: commercial, cost unknown
Mechanism: SNMP, RMON
Comments: Supports DSA and SNA.

Sage/X
URL:http://www.perform.fr/products.htm#SAGE/X
Contact: Perform (http://www.perform.fr/)
Cost: $125 per managed device
Platforms: Unix (HP, RS/6000, BULL, SunOS, SOLARIS), Windows, DOS
Most of the products listed here only support datacom networking products. The SAGE/X network management system and a related family of products manages both telecom and datacom products.

Transview SNMP
URL:http://www.sni.de/public/mr/network/bookl_en/atvsnmp_en.htm
Contact: Siemens Nixdorf ( http://www.sni.de/public/mr/network/tvcnt_en.htm)
Cost: commercial, cost unknown
Mechanism: SNMP
Platforms: Siemens-Nixdorf


Other Links

This is a list of links to related pages not about individual measurement tools.

NLANR

Toolsets

Network management

Internet Visualization

  Last Modified: Tue Sep-6-2016 13:46:05 PDT
  Page URL: http://www.caida.org/tools/taxonomy/measurement/summaries.xml