Studying the use and application behaviour of a large network

A session-level network monitor that collects network application and user information is described. Such information can potentially be used for various network-management functions, including performance, configuration, accounting, and security management. The design of a prototype monitor for the DECnet environment is reviewed. The use of the monitor is illustrated by applying it to monitor a site in the DECnet corporate network. The popular applications in use at the site are grouped into four types, user communication (information sharing), distributed systems services (resource sharing), network management, and virtual terminal, and reviewed. Various characteristics of these applications obtained from the monitor are summarized.<>