Peter,
> Is it possible, (and has anyone attempted) to monitor these
> bad- packet counts, and record "virtual bad packets" in the ethereal
> data stream when bad data is detected?
I do all the time, but I don't use Ethereal to do it. I use MRTG and I poll
MIB II variables such as
ifInNUcastPkts, ifInDiscards, ifInErrors,
ifOutUcastPkts,
ifOutDiscards, ifOutErrors, ifOutQLen,
I also poll CPU, memory, byte and frame counts and any other performance
metric I think could be important. Only when I see something interesting in
the MRTG graphs do I use Ethereal to get more detail.
Start off by looking at the management information provided by your
switches, routers, hubs and servers.
- Are all your NICs correctly guessing or explicitly configured at the right
speed, half/full duplex, MTU etc?
- Do you know what "normal" is for your LAN (eg collisions are normal on a
hub but may indicate a problem on a switch)?
- Have you configured and are you receiving SNMP Traps when thresholds are
breached?
I wrote a little rant about this earlier that might be useful.
http://www.ethereal.com/lists/ethereal-users/200302/msg00031.html
Having said that, Ethereal does offer some very useful display filters terms
such as ip.checksum_bad, ip.fragment.error, tcp.segment.error etc.
HTH
Cheers
Alistair
-----------------------------------------------------------------------
Registered Office:
Marks & Spencer p.l.c
Michael House, Baker Street,
London, W1U 8EP
Registered No. 214436 in England and Wales.
Telephone (020) 7935 4422
Facsimile (020) 7487 2670
www.marksandspencer.com
Please note that electronic mail may be monitored.
This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.
The registered office of Marks and Spencer Financial Services PLC, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB.