W&G LinkView Pro v6.0

In the inner circles of network management, Wandel & Goltermann's products have long been considered some of the best. Although expensive and somewhat difficult-to-grasp, the company's products provide a wealth of detail and functionality simply unmatched by just about any other offerings. They provide analyzers for everything from Gigabit Ethernet to Synchronous Optical Network, or SONet, rings.

This trend continues with the company's new LinkView line of software-based network analyzers. The LinkView Pro 6.0 and WG Examine combo that I looked at offered some strong network-monitoring and decoding capabilities, although there were also some rough spots.

WG Examine is an additional component that will get you detailed application-level protocol decoding capabilities for $1,495. I found the LinkView Pro with WG Examine to be a powerful analysis duo.

Robust range of tools

Figure 1

The LinkView family shares a lot of traits -- all products provide fairly robust network-monitoring services. In particular, I found the historical graphing capability to be very useful: I could monitor the impact of different applications on my network in a somewhat real-time fashion. The products have alarms and event-based triggering capabilities, allowing you to start a capture when a certain condition (such as bandwidth utilization) is met.

Another interesting aspect of the LinkView line is the built-in node database. Whenever a new network station shows up on the wire, a database record is created that contains traffic summary information as it applies to that node. Summary information for total traffic, broadcasts, most-often-used protocol, etc., are stored with the database record, allowing you to view historical information about a particular network device.

Figure 2

LinkView Pro also has a protocol capture and decode service, although it isn't very robust. For detailed analysis, you need the WG Examine add-on decoder. With WG Examine, I could capture 802.1Q frames (a new IEEE specification for virtual LANs) and look at their contents. However, LinkView Pro's native decoder saw these packets as "Wellfleet" frames (802.1Q frames look like "Ethertype 8100," the old Wellfleet Ethertype).

Similarly, LinkView Pro doesn't provide for much in terms of application-level decodes. It will show some of the IP and transport-layer header information, but it won't show you what's inside an HTTP GET request, a POP3 command, or anything else like that. If you need to do application-level decoding, you will have to use WG Examine.

WG Examine contains more than 200 protocol decodes, including IPv6, SMB, NetWare Core Protocol, and most of the major Internet protocols. However, most notable among those missing from the decode list is LDAP. Also, WG Examine sometimes confused IMAP4 sessions with IMAP2 sessions.

Pricey for payoff

Considering that the LinkView Pro and WG Examine combo costs $1,495 -- $500 more than Shomiti Systems' Surveyor, Network Associates' NetXRay, and AG Group's EtherPeek -- I was surprised that the decoding capabilities weren't stronger, particularly in the base LinkView Pro package.

Still, LinkView Pro with WG Examine is a good analyzer, with strong network-monitoring capabilities, particularly when historical information is required. I don't like the fact that you have to buy both products to get detailed decoding capabilities, but the duo is a strong tool nonetheless.

This is a solid software-based network analysis combination, although it's more expensive than competitive products.

Written by Eric A. Hall.
Copyright © 1998 InfoWorld Media Group, Inc. Used with permission.