Network-I

Version 1.4.7

The Network-I suite contains the following main programs:

niftap	Network Interface Tap - Captures network packets to a log file, and/or records traffic rates.
nifpan	Network Interface Packet Analyser - Analyses niftap log files, and displays packet contents.
nifwin	Graphically displays bandwidth usage in real-time, on local and remote network interfaces.
nifretx	Analyses Network-I log files, and reports TCP retransmissions.
nifxref	Processes Network-I log files captured on two different systems, to cross-reference different views of the same traffic.
nifmerge	Merges multiple niftap log files together, to produce a single log file, in which all packets are sorted by timestamp.
nif_import	Converts foreign log files (eg. Tcpdump and Snoop) into Network-I format so that nifpan can be used to analyse them.

Collectively, these programs provide a variety of features:

Verification of checksums (IP, ICMP, IGMP, TCP, UDP).
Display packet contents in varying levels of detail, from one-line summaries to exhaustive detail, and dump contents of unrecognised protocols or fields in tabular form, to let user do a manual inspection.
Full display and analysis of protocols layered above TCP and UDP, as well.
Track traffic rates continuously, in both packets/second and bytes/second. The sampling interval is configurable, and can be as small as one second (if you want to see bandwidth consumption), or higher (if you're only interested in broad variations, at different times of the day, or total traffic volumes).
Simultaneously monitor more than one interface on a multi-homed host (eg. a Unix server which is also acting as a router between two networks), and merge the resultant niftap log files together, using nifmerge, before viewing the combined log file with nifpan.
This allows related events on multiple interfaces to be viewed along a single timeline. Most other sniffers would create a separate capture file for each interface, making it very difficult to correlate related events.
It also allows the individual traffic flows seen by each host on a LAN switch to be combined into a coherent view.
Instead of laboriously ploughing through nifpan's output to spot TCP retransmissions, nifretx can be used to automatically flag them, and at the end, it reports on the total number of retransmissions in each connection recorded in the log file.
Use two instances of niftap to capture the same packet exchange on both the participating hosts, and then use nifxref to correlate the transmission of each packet on the sending host with its reception on the other host (and vice versa). This makes it much easier to spot lost, corrupted and retransmitted packets, as well as highlighting the transit delays.
Filter out uninteresting packets, with a powerful filtering language, that supports arbitrary Boolean expressions.
Distinguish between incoming and outgoing traffic, eg. you can separately monitor the traffic into your web servers, and the outbound web traffic (ie. your own staff, browsing the web).
In-kernel packet filtering and buffering for optimum performance, without the overhead of I/O system calls.
Network-I does not require an unwieldy GUI interface. It can be run quickly and conveniently from any terminal or workstation, and its output viewed through any text editor.

Network-I can still be useful, when used in concert with other facilities that might appear to make it unecessary, eg. web servers are capable of logging all hits, and you can then work out how many hits you got over a period of one day, one week etc. What they cannot do is report the peaks reached by web traffic, in terms of packets or bytes per second. Network-I can, enabling you to tell if any elements of your network are saturated at peak times, and need more bandwidth.
Additionally, web servers only report their own statistics. If you are running several of them, Network-I can be used to obtain a more comprehensive view of the total web traffic.

Manual

Downloads

Network-I Top

Network-I

Manual Downloads

Manual

Downloads