Network-I

Version 1.4.0

The Network-I package contains the following main programs:

niftap	Captures network packets to a log file, and/or records traffic rates.
nifpan	Analyses niftap log files, and displays packet contents.
nifwin	Graphically displays bandwidth usage in real-time, on local and remote network interfaces.
nifretx	Analyses Network-I log files, and reports TCP retransmissions.
nifxref	Processes Network-I log files captured on two different systems, to correlate different views of the same traffic.
nifmerge	Merges multiple niftap log files together, to produce a single log file, in which all packets are sorted by timestamp.
nif_import	Converts foreign log files (eg. Snoop and Tcpdump) into Network-I format so that nifpan can be used to analyse them.

Collectively, these programs provide a variety of features:

• Verification of checksums (IP, ICMP, IGMP, TCP, UDP).
• Display packet contents in varying levels of detail, from one-line summaries to exhaustive detail, and dump contents of unrecognised protocols or fields in tabular form, to let user do a manual inspection.
• Full display and analysis of protocols layered above TCP and UDP, as well.
• Track traffic rates continuously, in both packets/second and bytes/second. The sampling interval is configurable, and can be as small as one second (if you want to see bandwidth consumption), or higher (if you're only interested in broad variations, at different times of the day, or total traffic volumes).
• Simultaneously monitor more than one interface on a multi-homed host (eg. a Unix server which is also acting as a router between two networks), and merge the resultant niftap log files together, using nifmerge, before viewing the combined log file with nifpan.
  This allows related events on multiple interfaces to be viewed along a single timeline. Most other sniffers would create a separate capture file for each interface, making it very difficult to correlate related events.
  It also allows the individual traffic flows seen by each host on a LAN switch to be combined into a coherent view.
  
• Instead of laboriously ploughing through nifpan's output to spot TCP retransmissions, nifretx can be used to automatically flag them, and at the end, it reports on the total number of retransmissions in each connection recorded in the log file.
• Use two instances of niftap to capture the same packet exchange on both the participating hosts, and then use nifxref to correlate the transmission of each packet on the sending host with its reception on the other host (and vice versa). This makes it much easier to spot lost, corrupted and retransmitted packets, as well as highlighting the transit delays.
• Filter out uninteresting packets, with a powerful filtering language, that supports arbitrary Boolean expressions.
• Distinguish between incoming and outgoing traffic, eg. you can separately monitor the traffic into your web servers, and the outbound web traffic (ie. your own staff, browsing the web).
• In-kernel packet filtering and buffering, for optimum performance (Solaris version only).
• Kernel packet buffers are mapped to user memory for optimum performance, such that packets can be read and filtered without the overhead of an I/O system-call (Linux versions only).
• Network-I does not require an unwieldy GUI interface. It can be run quickly and conveniently from any terminal or workstation, and its output viewed through any text editor.

Manual

Downloads