Finally, Efficient Low Cost Network Monitoring

Product Description

"With NET-SONAR, you can have a fully-operational, feature-rich MRTG-based Windows 2000 network monitoring system in less than a day!"

New!  Version 1.2

If you were redirected here from OUTSIDE the SNMP4tPC web, click here to access the Main Page!

See NET-SNAR Live!  Click here!

What IS SystemScope? What is it?  How much does SystemScope cost? How much does it cost?
What does SystemScope look like? What does it look like? Why should I buy SystemScope? Why should I buy it?
How does SystemScope work? How does it work? System Requirements System Requirements
What do you get when you buy SystemScope? What do you get? What kind of support can I expect? Support Provided
Future Enhancements for SystemScope Future Enhancements What kind of support can I expect? How well does it scale?
What do you get when you buy SystemScope? SNMP4W2K-PLUS What kind of support can I expect? Can I get a demo version?
How do I get SystemScope? How do I get it? IMPORTANT information Important Information

NET-SONAR - Network Monitoring for the Budget Conscious

What is it? - NET-SONAR is a “wrapper” for Tobias Oetiker’s excellent Open Source tool MRTG (or Multi Router Traffic Grapher).  NET-SONAR provides an almost immediately usable system that (along with MRTG) will monitor Windows NT computers using SNMP (with optional Active-X and WMI Helper scripts).  Following some simple instructions, you can have it installed and running on Windows NT/2000 in less than a day.

See NET-SNAR Live!  Click here, and then choose Live MRTG Stats!

What does it look like? - NET-SONAR's Main Page provides access to the system type (Servers, Workstations, Hubs, Routers, Switches, Latency, etc.).  It provides visual indication as to whether NET-SONAR is in the middle of an MRTG monitoring cycle or not.

NET-SONAR Main Entry Page

Selecting the Servers page for example, brings up a summary listing  of all servers monitored by MRTG.  It is a page showing Life-Sign Indicator Bar (LSIB) for each monitored systems, as well as access to alert log files.

NET-SONAR Server Summary Page

From here, you can get a sense of how each system is performing based on the state of the Life-Sign indicators.  Every 5 minutes, these indicators will be updated.  

Each system is PINGed before the MRTG polling cycle begins.  If the system does not respond to the PINGs, a icon is displayed, alerts are generated, and no MRTG polling for that system takes place.  If the PING is successful, an icon is displayed, and MRTG polls that system for data.  Clicking this PING icon links you to the MRTG PING-Probe (PING response time) to that system.

A means that that particular statistics' value has not dropped below or exceed the threshold level set in the corresponding MRTG config file and is considered within specification.

A icon indicates just the opposite; that MRTG has detected a threshold breach, and that attention must be paid.  

Clicking either the the or the icon will hyperlink to the web page displaying that statistic's MRTG daily graph, and clicking the daily graph on that page will hyperlink to the longer term (daily, weekly, monthly and yearly) views.

When an event (i.e. threshold breach) occurs that is considered to be an alert condition, NET-SONAR is capable of generating an audio alert (WAV file), sending out an SMTP email, generating an SNMP trap or any combination of the three.  NET-SONAR also writes to text log files and makes these viewable through the system summary page.

The LSIB displays what are widely considered to the most important indications of a system's health, those being CPU, DISK, RAM and Network.  In Addition, the LSIB provides another icon indicating the status of the Windows NT System itself.

If you click on the Server Name, you will be hyperlinked to that system's Summary Page, where you can gain access to a host of other statistics, many of which are not represented on the Life-Sign Indicator bar.

By simply moving your mouse, and clicking on the blue highlighted boxes, you will be hyperlinked to a corresponding summary page showing daily performance graphs for statistics for that particular sub-system (CPU, DISK, RAM, and Network to name just a few).  Depending on the sub-system, there may well be half a dozen graphs on the summary page.  Clicking on the graph will hyperlink to a page showing daily, weekly, monthly and yearly graphs, providing additional insight on the performance on the monitored system.

Some counters are collected using Active-X and WMI, and not always SNMP.

Net-Sonar is ready to expand to include your workstations, hubs, routers, and switches, so once you are ready you can move beyond server monitoring to allow easy access to performance statistics of these devices. 

See NET-SNAR Live!  Click here, and then choose Live MRTG Stats!

How does it work? - NET-SONAR is a collection of carefully developed PERL scripts, batch files, MRTG config files, HTML web page templates and image maps, which in conjunction with the SNMP4W2K-Plus SNMP extension agent (and optional WMI and Active-X collectors), allows a rapid implementation of MRTG to support the near real-time monitoring of Windows NT/2000 systems as well as alert management when threshold events occur.

To view a diagram illustrating how NET-SONAR fits into an MRTG-based monitoring system, click here.

What do you get? - NET-SONAR surrounds MRTG with features that can substantially enhance MRTG by providing you with the following features which are not available with MRTG or anywhere else on the web.

An example of an email notification sent out when free memory drops below a pre-defined threshold is shown below. 

An example of an email notification sent out when the memory has risen back up above the pre-defined threshold level (no longer low) is shown below.

Note how in both the "Alert!" and "A-OK" emails there is a URL linking to the corresponding MRTG graphs!  Very handy! 

New in version 1.2 is the ability to have a customer name associated with the alert messages.  Good for those of you who monitor for more than one customer.  This customer name is also contained in the SNMP trap message and log files as well.

Click here to see an example of a threshold log file.  You can switch between human readable and CSV log-file formats (to support database import and extracting information like "how often between <then> and <now> has system < X> reported a threshold breach where WAN network utilization exceeded 500Kbps"  Won't THAT be nice?

See NET-SNAR Live!  Click here, and then choose Live MRTG Stats!

How much does it cost? - NET-SONAR itself costs USD $500.00.  This is a ONE-TIME fee that allows you to use NET-SONAR as much as you want within your organization.  If you are a consultant or service provider and want to implement NET-SONAR at more than one customer, then you would need to purchase a copy for each customer.

Click here to purchase NET-SNAR  v1.2

Net-Sonar comes with (and is based on) both the SNMP2CA and SNMP4W2K-STD SNMP extension agents (also provided by WTCS.ORG).  For a list of Available Performance counters extracted by SNMP2CA and SNMP4W2K-STD, visit their pages.

SNMP4W2K-PLUS - If you would like to use SNMP to monitor Active Directory, Print Servers, Terminal Servers, ISA Server 2000, SQL Server 2000 or Exchange Server 2000,  then YOU NEED SNMP4W2K-PLUS!

SNMP4W2K is recommended by IpSwitch as a tool to expose Windows 2000 performance counters to their Whatsup Gold product!  Check out there knowlege-base WG-20020522-DM01 for more information.

SNMP4W2K is also referenced in the HP IT Resource Centre as a tool to enable OpenView Network Node Manager to collect Windows 2000 performance statistics.  See this link for more information.  By the way, while the article mentions that a line needed to be removed from the SNMP4W2K MIB, this is no longer the case.  SNMP4W2K compiles natively into Network Node Manager (v6.20).

Therefore, a complete NET-SONAR Monitoring system, including one SNMP4W2K-PLUS performance monitoring extension agent, will cost only $550.00.  If your company has 20 subnets, it will still only cost you $500.00 for Net-Sonar, and whatever extra for the number of copies of SNMP4W2K-PLUS agents you require!

I can provide contract services at a rate of USD $50.00 per hour.  That way you could secure my services to implement NET-SONAR if you would like.  I would require remote access (i.e. VPN, CarbonCopy, etc.) to the Windows 2000 system you intend to use as the MRTG polling station, and would require some system specifics of the systems you would like to monitor.  Contact me if you are interested.

I am legally bondable, and can provide proof of security clearance (from local law enforcement) if required.  I have over 14 years experience in network technologies, and have been using MRTG for over 5 years.

It is my goal to achieve an excellent balance between price and functionality.  I want people to say "It cost me less than six hundred bucks, and look what it can do!"

I want people who buy NET-SONAR to feel satisfied that they received excellent value for their money, knowing that it would cost more for them to build the same thing themselves.

I want to provide to others what I would expect to get myself!  This goes for after sales support too!

Why should I buy it? – Well, you could download MRTG, and then commence to investigating SNMP agents that provide access to Windows NT/2000 performance information (might I suggest SNMP4W2K?) and then figure out what you should monitor, and then start work on creating MRTG config files, and then build an HTML-based system to provide access to the statistics that MRTG can collect, and then configure it to generate log files, audio, SMTP, and SNMP alerts, and then add a script to minimize replication time, but I can guarantee you'd spend a heck of a lot more than 500 bucks!

Anyway, unless you worked for free (and who wants to do THAT?) you'd probably see an easy week go by (really conservative guess) as you tried to build something similar to NET-SONAR.  If you assume a cost of $30.00 per hour for a resource to do this (either you, or someone else) you'd be looking at spending $1200.00 per week of effort!

For less than half of that, you get everything you need to hit the ground running!  And, as your network grows, you can simply duplicate the templates supplied with minimal effort (you can add a new server in less than 15 minutes!).  Finally, if your network monitoring requirements (i.e. number of servers) exceed the ability of the NET-SONAR polling system, you could add (into your network) another NET-SONAR polling system at no cost!  Try that with the big boys!

If you have looked at some of the big-name management tools, you will have probably noticed the somewhat (!!) prohibitive costs associated with their purchase (and implementation).  HP OpenView and Tivoli are not cheap.  Granted, they have considerable performance and functional advantages over MRTG, NET-SONAR and SNMP4W2K, but you need to determine the fit.  What features will you would use most?  What is that worth to you?  As a consultant, I have seen many networks where these big name network management applications were not used for much more than glorified PING testers!


See NET-SNAR Live!  Click here, and then choose Live MRTG Stats!

What are the system requirements? - Since MRTG (like many other network monitoring systems) is a polling-based system, and (when it is generating graphs) is pretty disk intensive, I would recommend a 700Mhz to 1GHz system with a fast disk subsystem, and 256MB to 512MB of System RAM.

NET-SONAR requires Windows 2000 Server, PERL, IIS, and MRTG in order to function as a basic monitoring system.  Alert functionality requires the command line SMTP mailer program "BLAT" and Network Computing Technologies' SNMP Trap Generator.

NET-SONAR does not include MRTG!  When you download MRTG, you get a superb tool for collecting and displaying data from network devices or other feeder systems.  Think of it as the core of the NET-SONAR network monitoring system.  However, MRTG does not just "work" once it is installed, however.  It is up to you to put together the surrounding pieces that make it into a functional system, tailored to your network infrastructure.  If you are unaware of what MRTG is and can do, the click here to jump to the MRTG Web Page.  You won't be disappointed!

NET-SONAR does not include  PERL, BLAT or Trap Generator either.  You must download these from the following locations:
Trap Generator -

IIS is required, but not necessarily on the polling system itself.  NET-SONAR could be configured to run on Windows 2000 Professional, and write log and image files to a mapped drive or volume on a remote IIS Web Server if desired.

NET-SONAR is designed to work with the most current MRTG (upgrading it is incredible easy!)  using a standard unzip of onto a disk drive of your choosing.  It is also set up for you to download and install Blat and Trap Generator into directories set up within the NET-SONAR directory structure.

The main polling system should be running the Windows 2000 OS, and does not need to be Server or Advanced Server (could be Windows 2000 Professional).  See the technical overview diagram here for component information.  It is not outside the realm of possibility to port NET-SONAR over to another OS, but that is beyond the scope of the product as it is today.

From a scalability perspective, if you were looking at monitoring many subnets, it would recommended that each subnet have an MRTG polling system.  The Main Summary Page could then link to the IIS on the distributed polling systems.

How well does it scale? - That's an excellent question.  NET-SONAR scalability depends not so much on NET-SONAR itself, but rather other factors.  These include system horsepower, disk I/O, number of targets, number of SNMP objects queried per target, and (of course) the version of MRTG you are using.

For your information, on my development system (AMD Athlon 1.4GHz, 512MB EIDE) a single SNMP polling cycle takes just under 10 seconds.  This pulls 30 stats from the system, at a rate of about 3 stats per second.  At that rate, you could poll approximately 30 systems in a 300 second period (5 minutes).  If you reached that number, you could start a second polling cycle to run concurrently with the first.  The following table is an estimate of the number of systems that could be scanned based on the number of concurrent scan passes running.

# of polling cycles # systems/cycle (est.) Total Systems (est.)
1 30 30
2 26 52
3 24 72
4 20 80

As you can no doubt appreciate, the number of polling cycles affects the processor utilization, so subsequent cycles cannot scan as many systems as the first.  Once you have reached critical mass (so-to-speak), you can always add another polling system and scale up from there.  It is recommended that the second polling system be modified to write MRTG data to across the network to the NET-SONAR IIS Server.  This would keep all the data in a single repository.

Please note: These are experience-based estimates only.

What kind of support can I expect? - I am currently employed full-time (this is a personal project for me), and therefore support will be limited to an after-hours, and weekend basis, with email and telephone support on a best-effort basis.  I will return calls and emails usually within a business day, and almost without exception can be reached in the evenings.

I am always working on documentation (the hardest part!), and clean-up for easier install.  As with any program it is a work in progress, so modifications are always being added.  

Important information you should know

NET-SONAR does not eliminate end-user customization.  It is still required that you edit some files, including MRTG config files, HTML files, and batch files, but NET-SONAR can massively reduce the time it takes to add server(s) into the monitoring cycle!  From my experience, this is NOTHING when compared to what is required to (pay for) and customize HP OpenView!

You cannot distribute NET-SONAR!  It is a copyrighted work.  It has taken an immense amount of effort to put NET-SONAR together, in writing and debugging the SNMP4W2K performance monitor extension agent, batch files, PERL scripts, HTML Pages, MRTG config files, etc..  Please respect my effort!

I am not selling the PERFMIB.DLL as distributed with the SNMP4W2K extension agents.  What I am selling is the proprietary PERFMIB.MIB and companion MIB.BIN as well as the knowledge and time it takes me to put all of this together.  Believe me, it is not trivial.  For instance, when I add a single performance counter object support to the SNMP4W2K MIB.BIN and PERFMIB.MIB, it can take approximately 2-3 hours to extract, compile, edit to correct syntax, test and make it available as a distributable package. 

Future Enhancements - While I cannot give any guarantees about the longevity of NET-SONAR, some of the things I am looking into as enhancements to NET-SONAR include:

In Summary - Implementing an effective network monitoring system based on MRTG technology can be time consuming and frustrating.  NET-SONAR can cut through that frustration, and and maximize MRTG's potential in an absolute minimum of time.

How do I get it?  - You can purchase NET-SONAR, SNMP4W2K and WTCS Consulting time via secured credit card transaction through PayPal.  PayPal accepts .  You can access the PayPal Purchase Page here!

Demo version - available for download.  It is limited in the following ways:

It does not include the pre-MRTG scan PING check, SMTP email or SNMP trap functionality.  Instead it will pop up a local message box (as shown) informing you of the alert situation, and describing extra functionality included in the full version.  Please respect that this is my method of copy-protection, since it is hard to copy-protect scripts.

Except for the PING state indicator, the status indicator icons are fully functional.  In addition, support will be limited to email only. 

If you are interested in trying a demo version of NET-SNAR, click here.

Williams Technology Consulting Services

This system configured by Garth K. Williams (
For complete professional systems integration services,
call (780) 433-7973

Williams Technology Consulting Services

To return the previous page, please click the button!