Inside NetPerSec

NetPerSec uses a standard Internet protocol called SNMP (Simple Network Management Protocol) to collect network information for its operation. In this section, I will discuss SNMP, several Windows DLLs that implement the protocol, and some considerations when using these DLLs. Finally, I'll discuss the technique that NetPerSec uses to create the dynamic icons it displays in the system tray.

SNMP was developed by the Internet Engineering Task Force (IETF) as a standard for exchanging network management information over TCP/IP as well as other types of networks. With SNMP, a network administrator can monitor and control various devices-such as routers, repeaters, bridges, PCs, and printers-that are attached to the network. Details on the SNMP specification can be found in the Request for Comments (RFCs) 1155, 1157, and 1213, which can be found at

SNMP is based on a client/server model. The client in this case, NetPerSec, is called the SNMP manager and connects to a server program called the SNMP agent. The agent is responsible for maintaining the Management Information Base (MIB) database. MIBs contain standard sets of statistical and control objects that can be accessed by an SNMP manager. For example, one MIB object may represent the number of bytes that have been transmitted by the network; another may represent the total time the network has been running. In addition to the standard MIBs, SNMP allows the use of private MIBs that contain information specific to a device. A router manufacturer, for example, may supply a private MIB along with a router that shows the throughput for that particular device.

RFC 1213, which defines the current Internet standard of MIB-II, lists 190 different objects. These are arranged hierarchically in a tree. To identify an object, you give its address in the tree using dot notation. As with an IP address, nodes can be identified by their names or by their associated numbers. As you can see in Figure 5 , is equivalent to All of the objects within MIB-II start with these four nodes. The numeric addressing scheme is called Abstract Syntax Notation, and each numeric address is called an object identifier or OID.

There are two OIDs utilized by NetPerSec: ifInOctets and ifOutOctets. The OID ifInOctets has an identifier of and specifies the number of octets, or bytes, received by the interface. The OID ifOutOctets specifies the number of bytes that have been sent out by the interface and has an OID of

The SNMP services and extensions implemented in Windows encompass a broad range of executable and DLL components. NetPerSec utilizes three DLLs: SNMPAPI (SNMP Utility Library), INETMIB1 (SNMP Internet MIB), and IPHLPAPI (IP Helper API). Systems running Windows 95 may not have the required DLLs installed, so in order to prevent run-time errors, NetPerSec dynamically loads each DLL and reports when an essential interface is not found.

To retrieve statistical information from the SNMP agent, NetPerSec calls the function SnmpExtensionQuery(), passing it the identifiers for the ifInOctets and ifOutOctets objects. The function returns a structure containing the number of bytes that have been sent and received by the interface. NetPerSec repeats this process for all network devices, modems, and network cards contained in the system. In SNMP, this is accomplished using the command ASN_RFC1157_GETNEXTREQUEST, and is sometimes referred to as "walking the tree." You can then calculate data throughput by dividing the deltas for the received and transmitted values by the number of milliseconds that have elapsed between SNMP queries.

Although the concept of MIBs and OIDs may appear impenetrable at first, the interface is actually quite easy to use. To retrieve a particular network statistic, you simply specify the desired OID and call the SNMP agent. SNMP saves you the hassle of dealing with low-level interfaces such as Winsock and TCP/IP. You may find the OIDs defined in RFC 1213 the most interesting, because these identifiers are Internet related.