Description: Watch is a networking debugging tool for use on
a Macintosh on Localtalk or directly on Ethernet. There is no
documentation for Watch nor is it a supported product. Use it at your
own risk. It is freely distributed but Cayman Systems, Inc. still
maintains a copyright on it. If you have any bugs to report, please
feel free to send email to support@cayman.com or applelink D0523.
Features: Allows collection and decoding of network packets from
ethernet or localtalk. AppleTalk TCP/IP, and DECnet routing protocol
packets are decoded into their components. Packets can be saved in
several forms and recalled later as well as printed. Basic traffic
analysis tools are provided. Full decoding of AppleTalk and TCP/IP
packets is performed, and the first layer of the DNA protocol stack,
DRP, is also decoded.
Using Watch: Launch the program. Select an interface to monitor under
the "interfaces" menu. Localtalk is always present. An Ethernet card
which Watch can use will also be present if found on the NuBus.
Multiple ethernet cards are supported.
Note: Watch closes the AppleTalk and ".ENET" ethernet driver before it
begins. These drivers are not necessarily reopened when you exit
watch. This means if you want to use appletalk you may need to use the
"network" cdev to reselect your network connection or reboot you mac.
Once you have selected an interface, press the "start" button. You
should see packets being collected. When you hit the "stop" button,
the collected packets will be displayed. You can "expand" the
decoding by selecting "Show Detail" and "Dump Hex" under the "Display"
menu. This can also be done by using the arrow keys, and pressing
"Enter," or by double-clicking on the packet to be "expanded."
Scrolling around will show the next or previous packets. Packets can
be saved or recalled to either a binary or text file. Packets saved
to a text file can *not* be recalled.
Decoding: The decoding of packets currently supports
AppleTalk, TCP/IP, and DRP, the first layer in the Digital Network
Architecture. The "Display" menu controls what level of detail is
displayed.
Files: Packets can be saved and recalled in binary files.
Packets can be recalled from binary files saved with Apple's "Peek"
program Packets can be saved as "text"
Printing: Packets can be printed to a printer. Note that
since the appletalk drivers are closed, you need to do some trickery
to print from inside watch. Make sure you stop collection and the use
the control panel "network" cdev to select some other network
connection and then select back your usual connection. Then, open the
chooser, select your printer and print. If you are printing to a local
serialprinter (imagewriter) none of this foolishness is required.
Performance: The basic analysis tools can be used by
selecting the "data window" menu item under "performance". Then, the
contents of the data window can be selected via the menu. Packet size,
protocols in use and station analysis are provided. These tools are
very basic but are helpful.
Cards Supported: Localtalk on any macintosh, Apple/3Com Nubus
Ethernet card, GatorCard E/II Ethernet card, all Asante Ethernet cards.
Known Bugs: Watch will not work on a Mac IIfx. The zone
list in Chooser disappears after quitting from Watch when using a
GatorCard.
History: 1.7.1 Added one line to ddp.c to recognize DDP type 0x68 as DECnet.
Added a lap control packet capture filter. Removed the default setting of "on" for the lap enq/deq display filter. Made the alap control packet filter "on" by default. Added a command key for the address-level capture filter. Updated about box and rolled version numbers. 1.7.0 Added DRP decoding. 1.6.5 Fixed "double click" problems; now works much better (not perfect on localtalk).
Added "arrow key" scrolling and selection support. Improved the
RPC/NFS decoding to pick up port mapper ports. 1.6.2 Changed decodes
of AAROUTEI packets to allow more efficient decoding of big ones.
Added support for AAROUTER and AAROUTEM. Better support for unknown AA packets. 1.6.1 Improved decoding of packets. Fixed ARP and Phase
1 AARP decodes, fixed AA decodes. Improved unknown packet decodes.
Added decode of ATP ZIP packets. Tries to read Phase 2 Ethertalk
EtherPeek packets (but doesn't seem to do other EtherPeeks correctly).
Better translation of sniffer files -- especially packet timestamps.
1.5.3 Improved decoding of packets. Fixed some potential crashes (but
I'm sure there are more!). 1.5.1 A bug where dragging the thumb all
the way to the bottom in the Detail window, caused the display to
disappear and the scrollbar to not function, has been fixed. 1.5
Display filtering - After packets are captured, they can be filtered
before displaying on the screen. Capture filtering - The idea of
capture filtering is to selectively pickup packets from the network,
in order to cut down unnecessary packets. NOTE - Leading zeros are
required for EtherNet address. Address range and format were not
validated, therefore, any error in the address will have undetermined
