Tutorials

Are there any tutorials to help me get started?

Yes - there are tutorials to assist you in learning how to use the facilities available via the autoAnalyzer tree branch. They are accessible from the Help facility and from the Codima Website.

Click here to access the sign in page for the Tutorials:-

• http://www.codimatech.com/support_tutorials.php

The tutorials are titled :-

• How to capture, filter and save frames
• How to view Live traffic trends

Can I install Toolbox on a Virtual Machine?

Yes, a supported operating system would need to be run inside the Virtual Machine. You also need to ensure that you have allocated sufficient disk space and memory to run the toolbox application. Failure to do this can cause operational problems.

Click here for details covering supported operating system, disk space and memory requirements.

• Host Platform requirements

Can I run the Toolbox as a Windows Service?

No, the Codima Toolbox won't run as service. If you do this you can't see the interface to interact with so you have to be logged in. Users can make the Toolbox start at windows startup by putting the shortcut to it in the startup programs folder.

If users are running Codima tools that need 24/7 operation, then you must run the application continuously and not log out.

Can I use a Host Platform with a 64bit Operating System?

What operating Systems can I use on the Host Platform?

The Codima Toolbox will operate on platforms running the following Operating Systems

Toolbox includes WinPCap drivers (used for frame capture) that support 64bit Operating systems.

Can I install the Codima Toolbox on the same host platform as the Codima Spider?

You can either install a Codima Spider Server or a Codima Toolbox. However you can have a Codima Toolbox with Web Access, that can act as a Codima Spider Server but still allow access on the Host Platform to the tools in the Codima Toolbox.

Configuration - Network Adapters (System Module)

Ensuring that the Host system is correctly deployed to enable it to undertake active operations and to passively monitor the network traffic may require you to configure the network adapters assigned to the Host platform.

A standard Toolbox for example can operate with three Network Adapters simultaneous, each one being configured for connection to a specific port on the Host Platform. For deployment guidance, see :-

• Codima Toolbox Deployment Guide

The system will default to configure the most suitable network adapter for use on port 1 (analysis) and port 3 (comms) - the same adapter will be set for both ports. 

What are the Host Platform requirements?

• How much memory do I need to install?
• How much disk space do I need?

Click here to access information on the Platform requirements for the Codima Toolbox

• Platform requirements for the Tools in the Codima Toolbox.

What Network Adapters are supported?

The system uses the WinPCap Packet Driver. 

Microsoft® Windows® XP/2003 Server : the packet driver works correctly on Ethernet networks. Codima has not currently identified any 802.2 or 802.3 Network Adapters that do not work with the Toolbox.

However there are issues with Wireless Network Adapters.

Licensing

How are the tools licensed?

All the Codima Toolboxes are require licenses, the license files cover the following :-

1. Toolbox License (File name = LICENSE.TXT)

The Toolbox License controls the following:- 

• Tool structure, e.g., which tree branches can be accessed

• Discovery Device limits, e.g., 50 Managed Devices (applies when user has access to autoAnalyzer and autoMap tree branches)

• VoIP phone limits, e.g., 100 SIP Phones (applies when user has access to autoAnalyzer and autoVoIP tree branches)

• Expiry date

• MAC Address used to machine lock the software

• Discovery Engine Version, e.g., 3.0-CDE

• Software Release Version, e.g., 5.00 0001

• The Demonstration/Evaluation status

• PAYG status, i.e., user has a standard license or a PAYG license

Alternatively if you are using a demonstration system, you can make use of the automated facility to request a license upgrade, this facility automatically finds your MAC address.

Display showing interface used to request license upgrades:-

 

Deployment

Can I undertake dual port analysis (monitor more than one port simultaneously with the same system)?

Click below to obtain your copy of the Codima Toolbox Deployment Guide.

• Codima Toolbox Deployment Guide

How do I monitor a full duplex connection?

Click below to obtain your copy of the Codima Toolbox Deployment Guide. This includes information on monitoring full duplex connections.

• Codima Toolbox Deployment Guide

- Portable tool

How do I clean the Toolbox to move onto a new Network?

Applies when using the Toolbox as a portable tool.

There are a number of files that need to be deleted when you are using the Toolbox as a portable tool or connecting a demonstration system to multiple networks 

Scalability

How far back can I store network/device statistics and how much disk space would I need ?

This is a complex question as there are many variables involved - some of which are network specific.

Key points

1. Each Toolbox* needs to allocates disk space for multiple History database files for storing different sets of statistics - There are 30 database files in total - size range can be from 8MB to 1048MB for each file. So for maximum storage you can set for an individual database file to 1048Mb. The file will wrap when full, so you always have the last 1048Mb worth of statistics.

*When monitoring large networks, you may need to use multiple Toolboxes to extend the domain monitored by the Protocol Analysis and Passive Analysis tools. For detailed information, see FAQs - Remote Manager

2. Codima uses a proprietary high speed statistics storage system which allows it to collect bulk high resolution statistics e.g., minimum of 40 statistics for 500 devices in typically a few milliseconds on standard Host Platform.

3. For lower resolution statistics (network/device statistics based on 15 minute intervals) - we can not give an exact figure, but typically a single Toolbox can undertake months of tracking, before the file wraps. It is all dependant on the range and volume of statistics being tracked.

See Help entries titled:-

• Node History Manager

• Protocol History Manager

4. For high resolution statistics (15 second intervals) - we can not give an exact figure, but typically a single Toolbox can undertake several days/possibly weeks of tracking, before the file wraps. It is all dependant on the range and volume of statistics being tracked.

See Help entries titled:-

• Node History Manager

• Protocol History Manager

5. You also have daily, weekly, monthly report facilities that will take information from history databases and create Word Reports. The report creation takes place at end of day, week, and/or month - allowing you to continually have trend report covering network/device statistics.

It is not possible to provide a figure for the amount of space needed to store these word reports - that is subject to report size and report range activated. So for long term usage would recommend checking free disk space on a regular basis and removing older reports to make room for new ones. After running reports on the network for a couple of months, the user would get an idea of how much disk space a months worth of reports takes up.

For more information, see FAQ :-

• What kind of reports are available?

What are the Benefits of using the Protocol Analysis tool?

• Real time analysis.

  • When bottlenecks are found you have a tool that can be deployed to see exactly what is happening on the wire – provides a Real time decode with field specific help.

• Expert Analysis

  • You have a Protocol Expert System that provides an Expert analysis of capture frames and pre-saved frame files. It can be used to focus on important activities and look for patterns.

• Extensive post and pre capture filtering capabilities.

  • You can easily set frame filters to capture and view protocol dialogs.

  • You can apply negative filters, to exclude frames that are not needed for troubleshooting.

  • You also have specialist functions for text based protocols like SIP, FTP and HTTP, that include floating text searches.

  • Enabling a string of text to be matched without the need to know where the text is located in the frame.

• You can create reference frame files to improve your understanding of protocol operations, making troubleshooting easier.

  • For example you can create Reference files that contain the protocol dialogs associated with login, close down, loading an application, running a print job. The Reference frame files can be compared with frame files obtained when problems are encountered. You can compare them for anomalies. Then use them as evidence when escalating problems.

  • If there are changes in your network software version you can also review the reference files to learn how the upgrade effects an operation.

For more information review the Features and Benefits Video Tutorial for the Tools in all Codima Toolbox:-

Click here to access the sign in page for the Tutorials:-

• http://www.codimatech.com/support_tutorials.php

or click here to obtain a copy of the Codima Toolbox Features and Benefits list.

What are the Benefits of using the Passive Analysis tool?

• Real time analysis.

  • When bottlenecks are found you have a tool that can be deployed to show traffic patterns.

  • Traffic pattern analysis can highlight vulnerabilities on your network.

  • Traffic patterns analysis can show patterns such as on line gaming activities and identify participants.

• Independent analysis.

  • The tool is analysing the traffic monitored on the wire, it is not dependant on getting information from devices, which can be effected by network problems or by performance problems.

• Evidence at your finger tips - Reports covering the history of traffic patterns gathered using passive analysis can be automatically produced or produced on demand for selected time periods. They will enable you answer questions such as:-

  • Who is using the most bandwidth?

  • Who is using the largest/smallest frames?

  • Which Protocols are using the most bandwidth?

  • Who is sending ICMP?

  • Who is using SNMP?

  • Who is browsing the Web the most?

  • Which Protocols are using the largest/smallest frame sizes?

  • Which Applications are using the most bandwidth?

  • What priority ranges are being used on the network?

  • Which Protocols have the highest priority routing?

  • Which Nodes have the highest priority routing?

  • What size of frames are being prioritised?

• You can be proactive : Major changes in the traffic and error patterns monitored by the Passive Analysis tool can be reported via the Global Alarm System.

  • The Global Alarm System uses multiple alarm reporting methods (SNMP traps, emails, SMS text messages) and has an embedded email client that is independent of the Networks own email facilities.

For more information review the Features and Benefits Video Tutorial for the Tools in all Codima Toolbox:-

Click here to access the sign in page for the Tutorials:-

• http://www.codimatech.com/support_tutorials.php

Created by monitoring the frames on the Segment and using the name discovery facility.

Created using the Codima Discovery Engine to gather topology information and Microsoft® Office Visio® to present results.

What are the Benefits of using the Global Alarm System?

• You can be proactive : Automatic notification of threshold breaches.

• You have multiple alarm reporting methods.

  • Ensuring that you can integrate the tool with your operating practices, for example if you have an SNMP Management system, the alarms can be reported to it as SNMP Traps or if your engineers prefer email notifications or SMS text messages, then alarms can be reported that way.

• You have controlled Alarm Reporting

  • Flood control ensures you are not overloaded with alarm reports - can avoid generating an alarm report for very short lived events and stop the same alarm condition being logged too many times.

  • Email and SMS Alarm report frequency is controlled - multiple alarms reports are included in single Emails/SMS Messages.

• You have predefined alarm thresholds on key events - ensuring system works out of the box.

• You have an embedded email client – independent of the Networks own email facilities, so will be able to report on any failures associated with the platform hosting the Networks email client.
   

Can I have alarm reports automatically emailed to me?

Can I set SNMP Traps?

Can I set threshold alarms?

Yes. This tool uses a Global Alarm System to log and report Threshold alarms. The Global Alarm System can be set up to apply one or more of the following actions

• Log the alarm report
• Send out an SNMP Trap when a threshold value is breached (goes above threshold setting) or when a value drops (goes below threshold setting).
• Send a notification email or SMS text message when a threshold value is breached (goes above threshold setting) or when a value drops (goes below threshold setting).
 

For detailed information on this facility, see Help entries titled

• How to email alarm reports

• How to set SNMP Traps

• How to set alarm thresholds

• How to configure Email Client

What kind of Statistics Reports are available?

There are a number of different types of Statistic Reports, they include :-

• HTML Reports created using information in History Charts.

• Pre defined Statistics Reports - accessible via the Reports Manager tree branch, these reports can be produced as HTML Reports or scheduled as daily, weekly, monthly Word reports.

The Remote facilities provide remote viewing and control. A Remote Manager is used to view and in some cases control the Remote systems, These remote systems can be:-

It is also possible to access and control probes from an external site.

Display showing the Remote Manager and Probe deployment - Remote Managers in this example have no access to tools locally:-

- SNMP Management Systems

Can I integrate with SNMP Managers?

Yes, this is done by accessing the fully integrated SNMP Module. This module can add value to an already installed SNMP Manager, in a number of ways. Including the following:-

EXTEND MANAGERS RANGE TO COVER NON-SNMP NODES/TRAFFIC

• Issue Traps to the Manager in respect of problems associated with Non-SNMP Compliant Nodes, immediately extending the SNMP Managers range.
• Issue Traps in respect of all the Traffic/Errors on a Segment. (i.e., monitoring actual real time loading and errors, not the loading/error information obtained from SNMP compliant nodes), providing the manager with a complete/impartial view of the segments traffic.

This will use information obtained from Passive Analysis of the Network.

Traps can be issued to multiple SNMP Managements systems, for full information, see Help entry titled:- How to set SNMP Traps

The SNMP Manager must have compiled the Codima MIB. The MIB {Enterprise.226} is included in the file set installed with the Codima Toolbox.

..:\Program Files\Codima\Express\SNMP\CODIMA-EXPRESS-MIBs\

How do I get a copy of the Codima MIB, so that my SNMP Management system can read the traps it receives?

Codima MIBs are installed with the Toolbox

- C:\Program Files\Codima\Express\snmp\Codima Mibs. 

These are the MIBs that need to be compiled by the third-party SNMP Management system.

Can I have a check list to cover what is needed to successfully operate the functions accessible via the autoAnalyzer tree branch?

Yes, click below to obtain Check list:- 

• Passive Analysis/Protocol Analysis : Check list - for facilities accessible via the autoAnalyzer Tree branch

Click below to obtain a hard copy of the evidence requirements for the Toolbox.

• Evidence Requirements

The process of testing with Microsoft® patches is an ongoing one, latest level tested is as follows :-