Bake-Off: 3 Network Management Solutions Put To The Test

Knowledge is power; intelligence on network traffic is critical to making any decisions about the network. Vendors have combined network monitoring tools, packet sniffers and network probes to create suites that can observe and manage network traffic. The products also add network troubleshooting capabilities.

For this review, CRN Test Center engineers compiled a list of network management products that would be suitable for small-to-midsize businesses, looking for offerings that included troubleshooting tools, network topology mapping and management capabilities. Engineers then excluded appliances to narrow the list to a handful of software applications. The final three products compared here are AdRem Software's NetCrunch 4.3, Ipswitch's WhatsUp Gold Premium v11 and SolarWinds' LANSurveyor 10, which the company picked up in its acquisition in May of Neon Software.

Engineers tested the products on a mixed network consisting of four Linux servers, one Microsoft Windows 2003 server, two workstations running Windows 2000 and XP, one networked Hewlett-Packard printer and two Cisco Systems Linksys switches. Toward the end of the test, an Apple MacBook was connected to the network for the software tools to discover and add to their databases. The Linux servers handled a variety of Web functions, including mail and firewall. The Windows 2003 server had Microsoft SQL Server installed.

Engineers rated each software package on the following criteria: features, ease of deployment, scalability, support and integration capabilities.

Next: Ipswitch WhatsUp Gold Premium v11 Ipswitch WhatsUp Gold Premium v11
WhatsUp Gold Premium v11 earned a first-place finish for its robust features, strong troubleshooting capabilities and comprehensive reports. Engineers were particularly impressed with its feature set, price/performance and integration capabilities, giving it top marks across those three categories.

Ipswitch launched its most recent version of the product earlier this year. The application offers an intuitive interface and a high level of customization for its features. WhatsUp Gold Premium combines many network-management features and trending databases with extensive packet intelligence, supporting SNMP 1/2/3 and WMI devices.

WhatsUp Gold was simple to install. The AJAX-based Web interface is clean and easy to access. WhatsUp Gold also comes with its own Web server that allows anyone on the network to log in and see how attached devices are performing. This feature allows for remote administration. The interface can be customized in a series of dashboards, providing specific information to different users. The dashboard's customizability is important, as users can determine what content they want to see when they log in. Administrators may be interested only in broad status information while help desk consultants would need specific machine and device details.

WhatsUp Gold categorizes monitoring into three types: active, performance and passive. Active monitoring merely checks if the device or service is running. Performance monitoring looks at utilization levels for CPU, disk, interface and memory, as well as ping latency. Passive monitoring waits for events such as SNMP traps or an entry in a Windows event log.

Engineers asked WhatsUp Gold to scan the network using ping to auto-discover devices within a specified range of IP addresses. Multiple subnets were specified. Engineers also specified to search using all active monitors, including DNS, FTP, HTTP, HTTPS, IMAP4, ping, POP3, SMTP, Radius, SNMP and Telnet. All the performance monitors were selected. With these parameters, WhatsUp Gold took an hour to auto-discover 11 devices (compared with 5 minutes at most for LANSurveyor and NetCrunch), but the wealth of information gathered made the wait worthwhile. Instead of running the scan with a broad IP range with a lot of vacant addresses, the tool also could have been run several times separately on each subnet to find all the devices.

While engineers set WhatsUp Gold to scan an IP range, it also can auto-discover devices in other ways, such as using IP addresses from a HOSTS file, obtaining data from an SNMP-enabled router, or by looking at computers in the Windows Network Neighborhood. Devices and virtual machines can be added manually by IP address.

WhatsUp Gold correctly detected all the devices and generated a network map. Detected devices can be categorized into groups for a less-cluttered visual map. Engineers particularly liked the pre-programmed views such as showing only Windows devices, devices that are currently down or devices that have no credentials (WMI or SNMP). These views make looking at a large network easier. Solution providers also can customize views to show only machines with high CPU usage or low free hard-drive space. Double-clicking on the device icon pulls up a more detailed information page on the device. Any information WhatsUp Gold couldn't gather can be manually entered.

WhatsUp Gold accesses and communicates with other devices on the network via SNMP and Windows authentication methods. This makes it easy to access both Linux and Windows machines. The application can store a series of different credentials to try, so Test Center engineers didn't have to manually log in to each machine.

The package's alert system is very robust, proactively displaying a pop-up message, sending a text or e-mail message, running an application or playing a sound. The messages can be adjusted based on how critical the problem it is. A device down for 5 minutes may just pop up a message, but if it remains down for 10 minutes, the software may send a text message. However, the alerts are not very granular in detail. Engineers noted that in WhatsUp Gold's world, "down" doesn't always mean "not running." Down refers to whatever threshold is being measured for the alert. In the case of an alert for a server hitting 90 percent CPU utilization for more than 5 minutes, 90 percent utilization is in the down state. If the CPU utilization alert is triggered, WhatsUp Gold records the device as being down even if everything else is running perfectly.

As part of its troubleshooting toolkit, WhatsUp Gold also can automatically restart services such as Microsoft Exchange and SQL Server if a problem occurs.

WhatsUp Gold comes with more than 50 pre-defined reports and offers hundreds of customizable reports. The reports help identify traffic trends, which is especially important as more and more organizations deploy packet- and bandwidth-sensitive applications such as VoIP. Engineers were able to drill down into network traffic flow to diagnose performance and to examine unauthorized traffic thanks to the extensive packet data captured in the database.

WhatsUp Gold Premium v11 is priced based on the number of monitored devices, from as few as 100 devices to more than 500 devices. The other version, WhatsUp Gold Standard, does not monitor Microsoft Exchange, SQL Server or WMI applications.

There's no fee to join Ipswitch's three-tier partner program, but it requires an annual revenue commitment and technical certification. Ipswitch gives leads to partners and offers pre-sales, post-sales and technical support.

Next: SolarWinds LANSurveyor 10 SolarWinds LANSurveyor 10
LANSurveyor 10 placed a very close second to WhatsUp Gold. It scored equally high on features and scalability but couldn't match WhatsUp Gold in reports. However, LANSurveyor 10 offers small and midsize businesses a simple and easy-to-use interface jam-packed with enterprise-level management features.

With its acquisition of Neon Software, the company added the network management tool LANSurveyor 10 to its product offerings. While SolarWinds has seen most of its momentum in the managed-services market, LANSurveyor strengthens its network management portfolio and enhances its scalability. LANSurveyor complements Orion, SolarWinds' suite of Windows-based network monitoring, discovery and management software.

Engineers were pleased to see the latest version of LANSurveyor retained the automatic network maps, asset management reports and remote administration functionality that distinguished the product in previous versions.

Deployment went smoothly. As soon as the software was installed, engineers were able to create a basic network map. LANSurveyor uses NetBIOS, SNMP and ICMP (ping) for device auto-recovery. In a dialog box, engineers entered the range of IP addresses to scan. All the devices, even the switches, were correctly discovered within minutes. In the same dialog box, engineers were able to specify multiple ranges of different subnets to scan. LANSurveyor found machines on different subnets and generated a large map with each distinct subnet's components connected properly. To make the large map easier to view, filters were applied to see Layer 1, 2 or 3 components, and to hide small subnets.

LANSurveyor deploys client probes, called Responders, to collect asset information such as the names of all installed software packages and the kinds of installed hardware, including chips, memory and hard drives.

While WhatsUp Gold edged out LANSurveyor by collecting data without relying on probes, LANSurveyor uses them well. Responders are deployed directly from LANSurveyor; no visits to each individual machine are required. Authentication boxes pop up when they are deployed.

The LANSurveyor Responders can be purchased as an optional add-on. The product can get basic operating-system information, along with machine name and IP address. The Responders flesh out the details, such as how many hard drives there are, their size and free space available. On the software side, Responders can discover installed fonts and what programs are installed in the Startup folder. Most of the reporting takes advantage of the data collected by these deployed Responders. The asset information is all stored in a database repository, making it easy to implement a configuration management database strategy. While SolarWinds said Responders also can collect information on Linux and Apple Macintosh devices, engineers only tested them on Windows devices.

LANSurveyor offers troubleshooting and vulnerability assessment through its Continuous Scan feature. This monitoring tool identifies rogue nodes across an entire network. The scans can be scheduled, and several criteria can be selected to determine when a node has changed its configuration and is considered a rogue. The options include looking at the SIP or NetBIOS names, the Timbuktu Screen-Sharing Name or changes in the device's MAC address. This feature also logs information about node connections in a Session Log to document network usage, threats and system availability. Once a rogue is detected, LANSurveyor can disable the device's network access and isolate it.

The TCP Port Monitor examines the availability of application and services for up to 20 different nodes. For the various nodes, HTTP, FTP, SMTP, POP3, HTTPS, Telnet and DNS can be monitored. Statistics and detailed information about each TCP server are available.

The remote administration features differentiate LANSurveyor from its peers. Once the probes are deployed, the software can send a variety of commands to other computers on the network. Along with the basics such as sending out system messages or forcing a shutdown and restart, LANSurveyor can launch an application remotely, copy a file or folder to a specific destination, change a password, or even synchronize all the clocks. Remote distribution makes it easy to push out a script, a patch or a new software package onto all the machines in the network.

For even more thorough remote administration, LANSurveyor also comes with the open-source VNC remote-control viewer application. PCs running VNC can be remotely accessed from inside the LANSurveyor interface for any manual tweaking the remote administration features do not cover.

There are several pre-defined reports in this package for software and hardware inventories. LANsurveyor's comprehensive reporting capabilities are also important for organizations struggling to meet the asset management requirements of regulations such as HIPAA, Sarbanes-Oxley, Gramm-Leach-Bliley and PCI.

LANSurveyor makes data easy to share. With a click of the mouse, engineers exported the network map to Microsoft Visio for editing and distribution. All the reports also can be exported to Microsoft Excel for further data analysis and sharing. LANSurveyor maps also can be integrated with Orion.

LANsurveyor is available as a Standard edition and as an Enterprise Bundle. Both versions can map an entire WAN with an unlimited number of nodes. Partners are categorized on sales volume and order frequency. The average margin is 30 percent. Pre- and post-sales support, joint customer calls, and toll-free technical support are available. Training is offered by phone and on the Web. Following the Neon Software acquisition, SolarWinds is in the process of integrating its channel program to support Neon partners.

Next: AdRem NetCrunch 4.3 AdRem NetCrunch 4.3
AdRem Software's NetCrunch 4.3 did something neither of its peers did: It automatically discovered the two VMware virtual servers that were on the Windows XP workstation. Test Center engineers had forgotten the presence of the virtual servers and were both surprised and impressed to see them detected by NetCrunch.

Overall, NetCrunch turned in solid performance and would satisfy the management needs of most small-to-midsize businesses, especially those running primarily Windows servers. NetCrunch delivers in the areas that are most critical to network management, such as device discovery, resource monitoring, events and alerts, trending and diagnostics. Engineers noted, however, that while the product works with non-Windows systems and SNMP devices, some tweaking was required to match the level of information that is automatically available for Windows machines. Fortunately, NetCrunch's template editor is easy to use.

Developing templates to manage non-Windows platforms could be a place for solution providers to add value and show expertise.

Engineers installed NetCrunch 4.3 Premium XE instead of NetCrunch Premium. The more scalable XE package is intended for complex monitoring on networks with several hundred nodes. Like its peers, it can map the network topology and collect bandwidth data. NetCrunch creates an "atlas" of all known networks and nodes. The atlas can be created automatically using predefined requirements or by specifying the types of devices to include. Engineers defined and ran a series of IP scans to populate the atlas database and viewed the dynamic "map" views.

Like its peers, NetCrunch uses sequential ICMP ping messages, SNMP 1, 2 and 3 queries, NetBIOS and WMI lookups to auto-detect devices. Along with the aforementioned VMware servers, NetCrunch also can discover devices registered in Novell eDirectory servers. Wizards help define more complicated scans and allow specific IP addresses to be added manually.

Engineers were able to look at graphical representations of bandwidth usage for each Linux and Windows machine on the network, as well as perform traceroutes. Engineers polled services, event logs and system hardware information on the Windows machines. NetCrunch uses ping to measure availability to monitor a handful of TCP services. It also can read a variety of performance data from SNMP and WMI queries, as well as listen for incoming SNMP traps and SYSLOG messages. The graphs are single-element charts but are adequate for most management needs. Reports can be generated from performance readings and graphs to show current and long-term trends.

NetCrunch includes a set of basic tools for troubleshooting, such as traceroute, MIB and WMI browsers, and DNS debuggers. It can pop up messages on the management console or send text or e-mail alerts under specified conditions. Like LANSurveyor, NetCrunch can shutdown or restart a machine remotely, but it takes its remote abilities one step further: It can manipulate Windows services as well, so problematic services can be restarted without rebooting the entire machine. NetCrunch also can be configured to log in to a remote system over SSH and upload and run a custom script.

Like Ipswitch's WhatsUp Gold, NetCrunch supports role-definable accounts on its Web-based management interface. So while the application and its data-collection engine runs only on Windows, users can log in from other consoles to manage the network.

Next: The Bottom Line Bottom Line
To stay on top of network and system performance, administrators must be able to gauge the health of the network devices and services by monitoring status and performance. They also need a system to perform automated actions, such as notifying staff of the outage or restarting the downed system, when a critical network resource goes down.

With its strong feature set driven by its customizable dashboards and trending reports, Ipswitch edged out rivals with on the strength of its reporting capabilities. SolarWinds is a close second as LANSurveyor continues to set the standard for ease of network mapping, remote administration, and asset management, though it lost some ground due to its reliance on client probes. Engineers will watch how the company integrates LANSurveyor with Orion going forward. AdRem Software does well with its features but is just not powerful enough to match the other two more mature packages.

Each contender reviewed here has comprehensive partner programs. Solution providers will receive plenty of channel support from all three, though SolarWinds is still working to integrate the Neon Software channel.

Solution providers using any of these software packages will find additional revenue opportunities. For example, partners with asset management support contracts can take advantage of the reporting functionality to track and manage installed applications and devices. Remote-access tools could be used as part of network support activities, where files need to be deployed to each machine or traffic data collected from each device. Finally, trend reporting on network activity can supplement support contracts.

All-in-all, solution providers looking for a powerful network management solution that offers strong features, an ability to handle small and large networks, and integration capabilities with other solutions, should consider Ipswitch WhatsUp Gold Premium.