er to focus on The bursty nature of networks means that the sampling period of each protocol in turn. the monitor can make it difficult to set a sensible threshold on which Another way in which the monitor can assist the user is by to base the alarm. Even a well behaved network can have brief grouping pieces of information according to a user specified man- periods of very heavy load. To illustrate the potential difficulty, ner. The most typical instance of this is when monitors are used to consider the following example. look at communication between certain groups of stations. For A network monitor produces a histogram to show the network example, this could be a server used by a number of client stations. usage for a working day, sampling the load every hour. From the The user would have to specify that the monitor should only gather resulting display it is clear that the load never exceeds 5%. So, the statistics on packets in which the server was the source or the user specifies a load threshold of 5%, expecting the monitor to destination. sound an alarm if the network suffers from an unusually high load. A more complex example requires the monitor to build a matrix However, the monitor takes samples of the network load every 30 to show which stations are communicating with which others. This seconds when checking for alarm conditions, and frequently during would help the user to identify where to partition an overloaded the course of the day the load appears to exceed 15%. Obviously the network. monitor alarm will be sounding all the time, with little benefit to the user. 61.4.2.3 Presentation 61.4.3.2 Station behaviour It is common for network monitors to provide both tabular and graphical displays for a variety of statistical information. If the It is also possible for a network monitor to have alarm thresholds monitor has a windowing interface, it is possible to combine both assigned to individual stations. This is useful for monitoring the use sets of information on a single screen. The user has control 