Abstract This paper describes the design of a network monitor that captures connections information in a network. The real‐time performance requirement makes the design significantly more challenging than that of a simple monitor that only counts packet types. Although we developed the monitor for DECnet, most of the lessons we learned are protocol‐independent and are thus applicable to designing such a monitor for a different protocol. In addition to reviewing the functionality, we report a first‐cut performance evaluation of the monitor software. We also describe some of our early experiences in using the monitor and review some current applications of the monitor in the areas of network configuration planning and performance management.

This paper is a study based on measurements of network activities of a major site of Digital's world-wide corporate network. The study yields two kinds of results: (1) DECnet protocol performance information and (2) DECnet session statistics. Protocol performance is measured in terms of the various network overhead (non-data) packets in routing, transport and session layers. From these protocol performance data, we are able to review how effective various network protocol optimizations are; for example the on/off flow control scheme and the delayed acknowledgement scheme in the transport protocol. DECnet session statistics characterizes the workload in such a large network. The attributes of a session include the user who started it, the application invoked, the distance between the user and the application, the time span, the number of packets and bytes in each direction, and the various reasons if a session is not successfully established. Based on a large sample of such sessions, we generate distributions based on various attributes of sessions; for example the application mix, the visit count distribution and various packet number and size distributions.