Monitoring SLP Activity

The snoop utility is a passive administrative tool that provides network traffic information while generating minimal network traffic itself. Invoking snoop enables you to watch all activity on your network as it occurs.

The snoop utility provides a printout of the actual SLP message traffic. For example, using snoop with the slp command line argument, the utility displays SLP traces of registrations and deregistrations by which you can gauge the kinds of services being registered and the amount of reregistration activity, which in turn enables you to gauge the network load.

The snoop utility is also useful for observing the traffic flow between hosts in your SLP enterprise. Using snoop with the slp command line argument, you can gauge and monitor the following types of SLP activity to determine whether any network or agent reconfiguration is needed:

• The number of hosts using a particular DA. With this information, you can determine whether to deploy additional DAs for load balancing.

• Which hosts are using which DAs. With this information, you can determine whether particular hosts should be configured with new or different scopes.

• UA requests are timing out and need to be retransmitted, or the DA requires more than a few seconds to send registration acknowledgments to an SA. You can determine whether that particular DA is overloaded. Also, you can gauge whether to rebalance the network load on the DA by placing additional DAs, or changing the scope configurations.

Using snoop with the -V (verbose) command line argument, you can obtain registration lifetimes and value of the fresh flag in SrvReg to determine whether the number of reregistrations should be reduced. However, if you invoke snoop with the verbose option, the volume of text printed out tends to be large. Therefore, you might dump the text to a file and sort through it later.

You can use snoop to trace other kinds of SLP traffic, as well. For example:

• Traffic between UA clients and DAs

• Traffic between multicasting UA clients and replying SAs

For more information about snoop, refer to the snoop(1M) man page.

Use the netstat command in conjunction with snoop to view traffic and congestion statistics. For more information about netstat, refer to the netstat(1M) man page.

Regulating Display Output

The snoop command provides various filters and options through which you control the focus of the snoop trace and the length of its output. Additionally, you can use snoop slp with any other snoop expression.

When using the snoop utility, you can select either brief or verbose mode for the output. In verbose mode, snoop delivers ongoing, unabbreviated output to your monitor, which provides the following types of information:

• The complete address for the service URL

• All service attributes

• The registration lifetime

• All security parameters and flags, if any

Type the following command to invoke snoop with the slp filter in verbose mode:

# snoop slp -v

The default setting for snoop is brief mode, which delivers ongoing output to your monitor that is truncated to fit one line per SLP message.