Fourteen families in this catalogue build things. This one exists to check them, and it is the only discipline here whose product is a number somebody else would rather not hear.

1982: an internal tool nobody meant to sell

At Zynar, the British subsidiary of a personal-computer networking company called Nestar Systems, engineers John Rowlands and Chris Reed built a promiscuous packet receiver for ARCNET to test their own products. They called it TART, for Transmit and Receive Totaliser. Custom hardware, an IBM PC, software in BASIC and assembler, and no commercial intent whatever.

When Nestar was acquired in 1986, Harry Saal and Len Shustek received the rights to TART. They founded Network General on 13 May 1986, sold it first as an ARCNET line analyser, then reengineered it for with a new interface written in C, and shipped it in December 1986 as The Sniffer.

The company had four employees at the end of that year. Between 1986 and March 1997 it sold about nine hundred and thirty-three million dollars of Sniffers and related products, and by 1994 it led the high-end analyser market.

That sequence is the most instructive thing in this family. A tool built to check your own work, by engineers who were not trying to build a product, turned out to be the product - and it reached the market because two founders took the rights with them when the company that owned it was sold.

1999: a standard that opens by accusing the industry

Measurement matters when somebody is claiming a number, and by the late 1990s vendors were claiming a great many.

, by Bradner and McQuaid, March 1999, defines how a device's throughput, latency, frame loss and burst tolerance are to be measured. Its introduction does not hedge: vendors, it says, engage in specsmanship, often involving smoke and mirrors to confuse the potential users of the products.

A standards document written to constrain the dishonesty of the industry it serves is unusual, and the method follows from the motive. Fixed frame sizes. Trials of defined duration. Twenty repetitions with the average reported. A tagged frame at sixty seconds so latency has an unambiguous start and stop. None of that is about measuring accurately; it is about measuring in a way two vendors cannot each describe differently.

The follow-up is equally telling. The later published an applicability statement titled Use on Production Networks Considered Harmful, because a benchmark that deliberately drives a device to its loss threshold does precisely that to whatever else is running on it. The test built for a laboratory kept being pointed at live networks by people who had read the first document and not thought about the second.

1997: the instrument nobody could get to

Gerald Combs was working for a small internet service provider. Commercial analysers cost around fifteen hundred dollars and did not run on the platforms his company used. Worse, the one Sniffer they had was permanently borrowed by somebody else - his own description was that it reminded him of a university with a single pencil that everyone had to share.

He started writing Ethereal in 1997 and released it publicly in July 1998. It was renamed Wireshark in May 2006, because the Ethereal trademark belonged to the employer he had written it at.

Scarcity of the instrument produced its free replacement. That is the same shape as the wireless article's origin - a constraint nobody could buy their way past - and the same outcome as the intrusion detection article's: what was given away became what everyone builds on, and the commercial product it displaced is now a footnote in most engineers' education.

What the discipline actually consists of

Generating traffic you control. The value is not volume, it is knowing exactly what was sent, so that anything missing, late or reordered is attributable rather than suspected.

Capturing what actually happened, which is a different job. Generation proves what a device does with known input; capture explains what it did with unknown input, after the fact, when the input cannot be reproduced.

Recreating scenarios, which is the hard one. Taking a fault that occurred once in production and rebuilding the conditions until it occurs on demand - because most difficult problems are not solved by inspecting the broken system but by reconstructing what broke it.

And underneath all three, stating your conditions. A throughput number without a frame size is not a measurement, because per-frame overhead means the same interface reaches a different bit rate with sixty-four-byte frames than with fifteen hundred. Most disputes between a 's figure and an operator's are this, rather than dishonesty.

The jobs and the practices

Test and measurement produced a role that mostly is not a job title: the person in a lab, a acceptance team or a vendor's engineering group whose output is evidence.

Its practices are recognisably scientific and unusual in this industry. A control, because a measurement with nothing to compare against is an anecdote. Repetition - RFC 2544 asks for twenty trials and the average, precisely because one run is noise. Recording the setup, since a result whose conditions were not written down cannot be challenged or reproduced, which makes it useless in the argument it was gathered for. And not testing in production, a rule this family learned publicly enough that the IETF had to publish it.

The professional habit worth carrying: the number is not the finding. The conditions are the finding, and the number is what happened under them.

The companies

Network General's Sniffer went to McAfee in 1997, was spun out in 2004, and the assets landed at NetScout in 2007. Ixia and Spirent built the traffic generation market for labs and carriers; Ixia is now inside Keysight. Wireshark remains free and is what most engineers actually use. Cloud providers run enormous internal measurement estates and sell none of it.

Where it goes

Measurement moved inside the thing being measured. Streaming telemetry and in-band techniques mean the network reports on itself rather than being interrogated by an instrument on the side, which is faster and removes the independent observer.

That independence is the loss worth naming. A device that reports its own performance is exactly the arrangement RFC 2544 was written to correct. The corrective is not nostalgia for external test sets; it is remembering why they existed.

And the founding property still holds. TART existed because engineers needed to know whether their own work did what they thought. Everything in this family since is that question asked at larger scale and against other people's claims - which is why it is the one discipline here whose value is entirely in being uncomfortable.

Sources