NetWatcher Documentation

Installing NetWatcher
Running NetWatcher

NetWatcher is a Windows program designed to monitor the health of your network and selected nodes you specify.

NetWatcher works by sending a probe to the nodes you specify at a time interval that you also specify. If any node is unreachable or slow, you can be notified by (1) the changing of the icon for that node in the NetWatcher window; (2) the changing of the NetWatcher icon in the system tray, and (3) optionally by a message box.

Installation

To install this program, follow these simple steps:

Get a copy of the installation zip file from http://home.pacbell.net/storygds/tools/netwatcher.zip.
Unzip the file using your favorite unzip utility (such as winzip).
Run setup.exe from the unzipped directory. (Winzip has a mechanism for combining this and the preceding step.)

NetWatcher is an MDI (Multiple Document Interface) application. This means it can display more than one NetWatcher document at one time. Each open document displays a window containing one entry for each node you have specified in that document. Each document represents a separate network. (See Monitoring Multiple Networks below for more information.)

Definitions of Terms

Before delving into the details of configuring and running NetWatcher let us define some terms used in this document:

Critical Node: A node that is between you and other nodes on the network. This is often a router. When a critical node is down, the nodes beyond it cannot be seen from your computer. Therefore, NetWatcher does not bother to probe nodes "beyond" a critical node that is down. You define a node as critical by setting the checkbox, "Don't probe additional nodes when this node is down." You specify a node as being beyond a critical node by giving that node a higher number in the "Probe Order" than the associated critical node. (Use the "Move up" and "Move down" commands on the "Node" menu to accomplish this.)
Key Node: A node that is used to determine whether the associated network is currently avaiable. This is primarily meaningful when you monitor multiple networks. When a key node is down, the associated network is considered down and is not included in the overall status displayed in the system tray. You specify a node as being a key node by setting the checkbox, "Don't include this network in overall status when this node is down."
Network: A collection of interconnected nodes. Each NetWatcher document represents one network.
Node: An individual addressable point in a network. A node is generally a computer or a router. Sometimes printers and other special devices can be network nodes as well. Every node is identified by a unique IP address. NetWatcher represents each node by an icon.
Probe: The action taken to determine if a node is reachable from the computer running NetWatcher. See Probing for more information.

Views

Each window can be configured to display nodes in one of the four standard Windows views:

Icon:
Small Icons:
List:
Report:

Meaning of Icons

In each of these views, NetWatcher indicates the status of each node by one of the following icons:

The node is reachable.
The node may have a problem. (One probe has timed out).
The node is reachable, but response is slow.
The node does not respond to probes or an error packet is received from the network in response to a probe. (When shown in the system tray, this icon means a critical node is down.)
The node's status is unknown. Either a critical node is down, so this node was not probed, or some other unexpected error occured while probing this node.

In addition to being used for individual nodes within a NetWatcher window, the above icons can also appear in the system tray. In that case, they represent the overall health of the network(s), as reflected in all nodes of all documents in an instance of NetWatcher. In general, the worst-case node's icon is shown in the system tray.

In addition to the above icons, the following icons can appear in the system tray:

All critical nodes are up, but one or more non-critical nodes are down.
There are no nodes to report (shown when there are no documents open, or all open documents are empty, or a probe is in progress).

The NetWatcher Menu

The NetWatcher menu, on the application's menu bar, contains the following general-purpose commands:

Probe all networks: This command will cause all nodes in all documents to be probed. (See Probing below for more information.)
Show Routing Table: This command displays the operating system's routing table. This is done by executing the system command "route print" and displaying the results in a separate window.
Show IP Configuration: This command displays the operating system's IP configuration. This is done by executing the system command "ipconfig /all" and displaying the results in a separate window.
Renew IP Configuration: This is useful for systems which obtain dynamic IP addresses from a DHCP server. This action is performed by executing the system command "ipconfig /renew" and displaying the results in a separate window.

The Network Menu

The Network menu, on the application's menu bar, contains the following commands related to the currently selected network (document):

Add...: This command lets you add a new node to the current document. (See Adding and Editing Node Data below for more information.)
Probe the current network: This command will cause all nodes in the current document to be probed. (See Probing below for more information.)
Set Probe Interval...: This will bring up a dialog box to let you specify how often a probe is to occur. You can also specify whether this setting is to be made permanent by storing it in the document file, or whether it is to be temporary for the current setting only. (I generally use a permanent setting of five minutes (the default). If there is a problem with a critical node, or a node I want to use, I set a shorter temporary setting, usually of one minute.)
Include network in status: When this item is checked, the current network's (document's) status will be included in the summary status icon in the system tray. This can be deselected manually from this menu or automatically when one or more key nodes in this network go down. (See Monitoring Multiple Networks below for more information.)

The Node Menu

This menu can be reached from the menu bar or by right-clicking on any icon in the NetWatcher menu, a menu will pop up with the following commands:

Delete

This will delete the selected node(s).

Include node in Status

This command is usually checked, meaning that the node's status is included in the process of deciding what icon to show in the system tray. You can use this command to toggle this checkbox off and on. When the checkbox is off, the status of this node will not be included in the summary status shown in the system tray. When you toggle this setting you will be asked how long you want the change in setting to last:

Until the node comes up: This allows you to exclude a node until it becomes available again. (This is only enabled if the node is currently down.)
For the rest of this session: The node will be excluded or included for the rest of the current session or until you change it again. This setting will not be stored in the Netwatcher document file.
Permanently: The node will be excluded or included for the rest of the current session or until you change it again. In addition, this setting will be stored in the Netwatcher document file.

Notify When Node Comes Up

When this item is checked, NetWatcher will pop up a message box when the selected node(s) become(s) reachable.

Probe

This will cause the selected node(s) to be probed. See Probing below for additional information.

Ping by IP Address

This will run the "ping" program for the selected node(s). The ping program will run in a separate window. The value passed to ping will be the IP address associated with the current node. Like probe, ping sends ICMP packets to the target node to determine its accessibility. The difference between probe and ping is that the probe function is done by the NetWatcher program, whereas ping is a separate program that is supplied with the operating system.

Ping by name

This will also run the "ping" program for the selected node(s). The ping program will run in a separate window. The value passed to ping will be the DNS name associated with the current node.

Trace route

This will run the "tracert" program for the selected node(s). This will show a list of the intermediate router nodes between the local machine and the selected node(s). Tracert will run in a separate window. The tracert program is supplied with the operating system.

Look up name

This will run the "nslookup" program for the selected node(s). This will show information from the DNS name server for the name associated with the specified node(s). Nslookup will run in a separate window. The nslookup program is supplied with the NT operating system. (It is not available on Windows 98.)

Who owns DNS name

This will run the "whois" program for the selected node(s). This will show detailed information about the organization or individual who registered the DNS name. Whois will run in a separate window. The whois program is supplied with NetWatcher.

Decode IP address

This will run the "IPDecoder" program for the selected node(s). This will tell which class of IP address is selected, and whether it is public or private. IPDecoder will run in a separate window. The IPDecoder program is supplied with NetWatcher.

List Ports

This will run the TestPorts program for the selected node(s). This will list all of the well-known ports that are listening at the selected node(s). TestPorts will run in a separate window. The TestPorts program is supplied with NetWatcher.

Move Up

This is used to alter the order in which nodes are probed. It will move the selected node(s) closer to the top of the list. You should order nodes such that critical nodes come before those nodes that depend on them.

Move Down

This is used to alter the order in which nodes are probed. It will move the selected node(s) closer to the bottom of the list. You should order nodes such that critical nodes come before those nodes that depend on them.

Properties...

This will allow you to examine and modify the data associated with the selected node(s). See Adding and editing node data below for additional information.

The System-tray Menu

NetWatcher installs itself in the Windows system tray (normally in the lower right corner of your screen). The icon shown indicates the overall health of your system, as described under Meaning of Icons above.

If you double-click the icon in the system tray, the NetWatcher window wll be restored (if it was hidden) and brought to the front. (When you close the window, it will be hidden and removed from the task bar.)

If you right-click on the icon in the system tray, you will bring up a context menu containing the following commands:

Show window: Like double clicking, this will restore the NetWatcher window and bring it to the front.
Probe: This will cause all nodes in the current NetWatcher document to be probed. (This is the same as the "probe" command on the "NetWatcher" menu.)
Exit: This will terminate the NetWatcher program.

Adding and Editing Node Data

Whenever you select "Add" from the "NetWatcher" menu or "Properties" from the Node menu, you will see a dialog box like this:

If you are adding a new node, then the input fields will either be blank or set to an initial default value. If you are editing an existing node, then the input fields will contain the current values for that node.

This dialog box contains the following data:

Name or IP Address

This field should contain the DNS name or IP address of the node. This is the value that is used to probe the node. (If you specify a DNS name, then the name is converted to an IP address for probing.)

Description

Here you can enter an arbitrary description of the node. This information is shown in the dialog box currently being described, as well as the report view. (See Views above for details.)

Timeout

This specifies the maximum number of seconds that NetWatcher will wait for a response to a probe. If the node does not respond in that time, then it will be considered unreachable. You can type in a value to the input box, or you can select the "Compute" button to its right. If you do the latter, then NetWatcher will determine the timeout value by trying various values and adding a "fudge factor" to the result.

Retries

This specifies the number of times NetWatcher will retry a probe. If a node does not respond to a consecutive number of probes specified by "retries" then the node will be considered "down".

Max. round trip time

This value specifies the number of milliseconds it should take from the time a probe is sent until the reponse is received. If the time exceeds the specified value, then the node will be considered "slow". You can either enter a value into the input field, or select the "compute" button. In the latter case, NetWatcher will do three probes and take the average of their round-trip times (plus a "fudge factor").

Display a dialog box when this node becomes unreachable

A node is considered unreachable and marked "down" when one of two things occurs:

It does not receive a response to a probe after the amount of time specified by "timeout", above, over the number of consecutive probes indicated by "retries", above.
An error packet is received from the network in response to the probe.

When one of these conditions occurs, you can select to receive a message box on the screen by checking this option. (You will not receive additional message boxes for subsequent failures when the node does not change its condition.)

Convert the domain name to an IP address for every probe

The domain name specified for a node must be translated to an IP address by sending a request to a DNS server before it can be probed. If this box is checked, then this lookup occurs every time a probe is done. If the box is unchecked, then the lookup occurs only once (when the NetWatcher document is first loaded, or when the node is added or edited). You should check this box for any nodes whose IP addresses are dynamically assigned. You might also check this box for at least one internet node to verify that the DNS server is working. You should leave this box unchecked for most or all other nodes to reduce processing and network overhead.

Don't probe additional nodes when this node is down

If you check this box, it means that the current node is on the path to subsequent nodes; if the current node is down then subsequent nodes will always be unreachable. Thus, if this node is considered unreachable, then NetWatcher will skip probing any subsequent nodes.

Don't include this network in overall status when this node is down

If you check this box, it means that this node is a gateway to other nodes in the network represented by the current document. If the specified node is down then the remaining nodes in the network will be unreachable. Checking this box means that you don't want the overall status in the system tray to indicate that this network is down. (See Monitorying Multiple Networks below for more information.)

Probing

Probing is at the heart of how NetWatcher determines the health of a node. NetWatcher probes a node by sending an ICMP (Internet Control Message Protocol) message to the target node. This can cause one of three results:

The node responds. This is the normal, healthy case.
An intermediate (router) node responds with an error packet, such as "network unreachable".
No response is received.

In addition to noting the type of response, NetWatcher keeps track of how long it takes for the response to be received from the target node.

A NetWatcher probe is invoked by one of six ways:

All nodes are probed automatically at timed intervals. You specify the time that should lapse between probes. (See the NetWatcher menu, above, for details.)
You select the "Probe" option of the "NetWatcher" menu. This causes all nodes in all networks to be probed.
You select the "Probe" option from the popup menu in the system tray. This is equivalent to the previous method.
You select the probe button on the tool bar. This is also equivalent to the second method.
You select the "Probe" option from the Network menu. This probes all nodes on the selected network (document).
You select the "Probe" option from the Node menu. This probes the selected node(s). Unlike the previous methods, this will cause the node to be probed, even if it follows a "critical" node that is down.)

History

A history is kept of all transitions of status for every node. This history can be displayed from the "History" command on the "View" menu. Once displayed, you can also save the history to a text file or clear its contents. There is a separate history kept for each network.

Monitoring Multiple Networks

Many people see a view of their network that is the same from day to day. For those people, having one NetWatcher document that contains all the network nodes of interest is sufficient.

Other people have changing views of the network. For example, one may have a laptop that plugs into one network at home and another at work. For these people NetWatcher supports multiple networks. Each network is described by a separate NetWatcher documents.

Because NetWatcher is an MDI (Mutliple Document Interface) program, it has always been possible to load multiple Netwatcher documents. Starting in version 7 of NetWatcher, there is expanded support for handling these networks in an integrated way. The new features for this purpose are:

You can put multiple document file names on the command line when starting NetWatcher.
You can specify whether a network is to be included in the network status icon in the system tray.
You can specify one or more key nodes in each network. If this key node is down, then the corresponding network is not included in the status symbol in the system tray as described above.

I added this additional multi-network support to facilitate my own situation where I have a VPN (Virtual Private Network) connection to my employer's internal network. When I am connected to the VPN I am blocked from seeing the other nodes of my home network. Of course, when I'm not connected to the VPN I can see my home network, but not my employer's network. In either case I can see Internet nodes.

Here's how I use NetWatcher's features to support my network environment:

I divided the nodes I'm interested into three categories:
- My employer's network
- The Internet
- My at-home network
Node 192.168.1.1 is a key node in my home network. If it is down, it means that my home network is not accessible--probably because I am connected to the VPN. I therefore don't want to include my home network in my overall network status:
Similarly, node 10.137.96.4 is a key router on my employer's network. If it's not reachable, I'm probably not connected to the VPN. I configured it the same way: if 10.137.96.4 is not reachable, my employer's network won't be included in the overall status.

There is no such node for the Internet. These nodes should always be visible and they will always be included in the summary status in the system tray.

Since my home and work networks are mutually exclusive, there will always be nodes unreachable in one or the other of them. Without NetWatcher's multiple-network features the status would always show outages.

Inventory

Installing the files from netwatcher.zip will place the following files into the directory you specify:

*.gif: These files are used with NetWatcher.html (this document).
GsGUI.dll: Contains components used by NetWatcher.
IPDecoder*.class: These files make up the IPDecoder program. This program will pop up a window deciphering the format of the specified IP address. You can supply this IP address either from the command line or in the window. IPDecoder can be run from a command line or from the NetWatcher program. You need a Java virtual machine to run IPDecoder. Note, however, that IPDecoder is an optional component of NetWatcher. NetWatcher will operate correctly without IPDecoder.
ipdecoder.bat: A more convenient way to run IPDecoder from the command line.
LOG.DLL: An ActiveX automation component used by NetWatcher to log events.
NetWatcher.exe: The main NetWatcher executable program.
NetWatcher.html: This documentation.
nwrun.bat: A batch file used by Netwatcher to run other character-mode programs.
PING.DLL: An ActiveX automation server used by NetWatcher and rcping to perform network probes.
RCPING.EXE: This program can be used from command-line scripts, such as batch files, to check the presence of a network node. It is similar to ping, supplied with Windows, with the addition that rcping issues a return code indicating the success or failure of the probe. See rcping.txt or issue the command "rcping -h" for more information.
rcping.txt: The documentation file for rcping.
setup.dat: Used by setup.
SETUP.EXE: Used to install NetWatcher.
TestPort.class: This program will test specified ports on a given host to see if they are available. This program is invoked by NetWatcher and it can also be run from a command line. Type "java TestPort" for additional information. You need a Java virtual machine to use TestPort. Note, however, that TestPort is an optional component of NetWatcher. NetWatcher will operate correctly without TestPort.
whois.exe: This program displays information about the owner of a DNS name. It is used by NetWatcher and can also be run from a command line.