McAfee GUARD DOG 2 Installationsanleitung PDF herunterladen (Seite 21)

McAfee

IntruShield

IPS System IntruShield Best Practices

Special Topics: Best Practices Working on performance issues

Working on performance issues

Most performance issues are related to switch port configuration, duplex mismatches,

link up/down situations, and data link errors.

Sniffer trace

A Sniffer details packet transfer, and thus a Sniffer trace analysis can help pinpoint

switch and IntruShield performance or connectivity issues when the issues persist after

you have exhausted the other suggestions in this document. Sniffer trace analysis

reveals every packet on the wire and pinpoints the exact problem.

Note that it may be important to obtain several Sniffer traces from different ports on

different switches, and that it is useful to monitor (“span”) ports rather than spanning

VLANs when troubleshooting switch connectivity issues.

Understanding data link errors

Many performance issues may be related to data link errors. Excessive errors usually

indicate a problem. For more on this topic, see also Ensuring connectivity between the

sensor and other network devices on page 5.

Half-duplex setting

When operating with a duplex setting of half-duplex, some data link errors such as FCS,

alignment, runts, and collisions are normal. Generally, a one percent ratio of errors to

total traffic is acceptable for half-duplex connections. If the ratio of errors to input

packets is greater than two or three percent, performance degradation may be

noticeable.

In half-duplex environments, it is possible for both the switch and the connected device

to sense the wire and transmit at exactly the same time, resulting in a collision.

Collisions can cause runts, FCS, and alignment errors, which are caused when the

frame is not completely copied to the wire, resulting in fragmented frames.

Full-duplex setting

When operating at full-duplex, FCS, cyclic redundancy checks (CRC), alignment errors,

and runt counters should be minimal. If the link is operating at full-duplex, the collision

counter is not active. If the FCS, CRC, alignment, or runt counters are incrementing,

check for a duplex mismatch. Duplex mismatch is a situation in which the switch is

operating at full-duplex and the connected device is operating at half-duplex, or vice

versa. The result of a duplex mismatch is extremely slow performance, intermittent

connectivity, and loss of connection. Other possible causes of data link errors at

full-duplex are bad cables, a faulty switch port, or software or hardware issues.

1 2 ... 16 17 18 19 20 21 22 23 24 25

Keine Kommentare

McAfee GUARD DOG 2 Installationsanleitung Seite 21