OS/2 Shareware BBS: 14 Text/14-Text.zip/dataglan.zip/DGETUSER.INF

OS/2 Help File | 1995-04-20 | 986KB | 11,036 lines

ΓòÉΓòÉΓòÉ 1. Version Notice ΓòÉΓòÉΓòÉ

Second Edition (July, 1994)

This document applies to Version 1, Release 2 of the DatagLANce Network
Analyzer for Ethernet and Token Ring for OS/2, program number 5871-AAA.

Publications are not stocked at the address given below. If you want more IBM
publications, ask your IBM representative or write to the IBM branch office
serving your locality, or contact your DatagLANce team directly at the address
given below.

A form for your comments is provided at the back of this publication. If the
form has been removed, you may address comments to:

Department E67
IBM Corporation
PO Box 12195
Research Triangle Park, NC 27709
USA
IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.


ΓòÉΓòÉΓòÉ 2. Notices ΓòÉΓòÉΓòÉ

References in this publication to IBM products, programs or services do not
imply that IBM intends to make these available in all countries in which IBM
operates. Any reference to an IBM product, program, or service is not intended
to state or imply that only the IBM product, program, or service may be used.
Any functionally equivalent product, program, or service that does not infringe
any of the intellectual property rights of IBM may be used instead of the IBM
product, program, or service. The evaluation and verification of operation in
conjunction with other products, except those expressly designated by IBM, is
the responsibility of the user.

IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not give you
any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
208 Harbor Drive
Stamford, CT 06904
USA

The licensed program described in this document and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement.

This document is not intended for production use and is furnished as is without
any warranty of any kind, and all warranties are hereby disclaimed including
the warranties of merchantability and fitness for a particular purpose.


ΓòÉΓòÉΓòÉ 2.1. Trademarks ΓòÉΓòÉΓòÉ

The following terms, denoted by an asterisk (*) in this publication, are
trademarks of IBM Corporation in the United States or other countries or both:

DatagLANce                                 PS/2
IBM                                        SAA
Micro Channel                              Systems Application Architecture
Operating System/2                         System/370
OS/2                                       XT
Personal System/2

The following terms, denoted by a double asterisk (**) in this publication, are
trademarks of other companies:

AppleTalk         Apple Corporation, Inc.
Banyan            Banyan Systems, Inc.
Cornerstone Agent Protools, Inc.
Foundation Manager Protools, Inc.
NetWare           Novell, Inc.
Network Control Series Protools, Inc.
Sniffer           Network General Corporation
SUN               SUN Microsystems, Inc.
VINES             Banyan Systems, Inc.
DECnet            Digital Equipment Corporation
Intel             Intel Corporation
IPX               Novell, Inc.
LANalyzer         Novell, Inc.
Microsoft         Microsoft Corporation
NFS               SUN Microsystems, Inc.
Novell            Novell, Inc.
Windows           Microsoft Corporation
386               Intel Corporation
486               Intel Corporation
Xerox             Xerox Corporation


ΓòÉΓòÉΓòÉ 3. About This Book ΓòÉΓòÉΓòÉ

This book introduces you to the IBM* DatagLANce* Network Analyzer product, a
powerful, integrated system for monitoring network status, capturing selected
network traffic, and analyzing data. The intent is to help you find the right
information and develop the necessary skills with the DatagLANce analyzer to do
your job efficiently.


ΓòÉΓòÉΓòÉ 3.1. Who Should Use This Book ΓòÉΓòÉΓòÉ

The IBM DatagLANce Network Analyzer is intended for networking support
personnel who are responsible for the development, installation, maintenance,
troubleshooting and fine tuning of networks or network software applications.
Because your needs and backgrounds vary greatly, as space permits, we will
explain things in detail for the novice user, without getting in the way of
more experienced users. Often, this book refers readers who need more help
directly to related documents and tutorials instead of repeating them here. In
other places, the book simply suggests that those who are familiar with the
topic just move on.


ΓòÉΓòÉΓòÉ 3.2. How to Use This Book ΓòÉΓòÉΓòÉ

This book uses a symbol (|) to indicate where changes have been made to the
book. This symbol is located to the left of the changed information.

This book explains how to install and use your DatagLANce Network Analyzer. It
includes the following chapters, appendixes, a glossary, a list of
abbreviations, and an index:

Introducing DatagLANce describes the functions and benefits of your DatagLANce
Network Analyzer.

Installing DatagLANce explains how to install your DatagLANce Network Analyzer
software.

Getting Started, although not a tutorial, helps you get started by
demonstrating how to use the DatagLANce analyzer in several typical situations.

Monitoring the Network gives a detailed description for using most DatagLANce
real-time functions except the capture and traffic functions.

Capturing Frames from the Network explains how to use the capture function to
select and store network data.

Analyzing Captured Frames describes how to understand, format, and redirect
captured data.

Traffic Generation and Playback describes the DatagLANce Network Analyzer's
traffic generation and playback functions.

Frame Formats gives information about frame formats.

Protocols Decoded lists the protocols decoded by the DatagLANce analyzer.

Figure "User Preferences Window" explains how to select the address format
displayed and the font size for some of the windows.

Symbolic Names Support describes the symbolic name support provided by the
DatagLANce analyzer.

Configurations explains how to save and load DatagLANce configurations.

History Statistics File Formats gives the format of the binary file used to
store historical statistics.

Capture Data File Formats gives the format of capture data files created by the
DatagLANce Network Analyzer.

DatagLANce Alarms: SNMP Traps and Pager Codes describes specific information
about DatagLANce alarm reporting options.


ΓòÉΓòÉΓòÉ 3.2.1. Highlighting Conventions ΓòÉΓòÉΓòÉ

The following highlighting conventions are used in this book:

Bold           Identifies commands, action bar choices, menu options, pull-down
               options, and push buttons.

Italics        Identifies parameters whose actual names or values are to be
               supplied by the user, terms that are defined in the following
               text and in the glossary, and titles of manuals.

Monospace      Identifies examples of program code, messages, or text you might
               see displayed.


ΓòÉΓòÉΓòÉ 4. Introducing DatagLANce ΓòÉΓòÉΓòÉ

The IBM DatagLANce Network Analyzer for Ethernet and Token-Ring for OS/2* is a
network monitoring program for use with Ethernet and token-ring networks.
Figure "DatagLANce Network Analyzer" shows the main screen of the DatagLANce
analyzer.


DatagLANce Network Analyzer

This chapter summarizes the functions of the DatagLANce analyzer, describes
briefly how the DatagLANce analyzer works, and lists the major benefits of the
product.


ΓòÉΓòÉΓòÉ 4.1. What the DatagLANce Analyzer Can Do for You ΓòÉΓòÉΓòÉ

You can use the DatagLANce analyzer to:

o Get an accurate picture of the current activity on your network.

o Get an historical record of network activity over a specified period of time.

o Design your own screens and save them.

o Create 32 different bar charts of real-time statistics.

o Launch an analysis session and call up frame summary views, protocol
  interpreted views, and hexadecimal views-all color coded, highlighted, and
  tracked simultaneously.

o Switch to the Network Statistics screen to see statistics in text form, bar
  charts, history graphs, and network status.

o Rearrange the statistics, add to them, and save them under a new name.

o Use the alarms to let you know when certain statistical thresholds, like
  network utilization, are reached.

While the DatagLANce analyzer is monitoring your network, you can even use the
Personal System/2* (PS/2*) computer for other applications.

With the DatagLANce analyzer, you have at your command:

o Eighty-eight source and destination address pairs filtered in real time

o Real-time frame capture while monitoring

o Eight fast, super-powerful, programmable event detectors

o Flexible, user-definable interface

o Reliable, accurate information

o Continuous reports of the most active stations (top talkers), ring map
  (token-ring only), error conditions, statistics, and selected network data

o Broad data import and export support

o Extensive protocol decode coverage

o 10-msec time-stamp (token-ring) or 32-msec time-stamp (Ethernet)

o Optional 840-nanosecond, high-resolution time-stamp

o Fully windowed, graphical, multitasking user interface


ΓòÉΓòÉΓòÉ 4.1.1. Data Capture ΓòÉΓòÉΓòÉ

Use the 8 event detectors to select only the data you want to capture from your
network (see Figure "DatagLANce's Powerful Capture Filter"). Use one event
detector to begin tracing, another to select what to capture, and another to
set the point around which the stored data will be referenced. You still have
five event detectors left for simultaneous custom statistical analysis!


DatagLANce's Powerful Capture Filter

What can one event detector do? How about selecting 11 source/destination
address pairs? If you prefer, select from any combination of the protocols
offered. You say you need to search data fields? One detector permits the
filtering of up to 32 consecutive bytes, defined at the bit level if you wish,
including don't cares; even source-routed frames will not interfere with your
search. Then, multiply this power by combining event detectors in logical
expressions to control capture, gather statistics, and energize alarms.


ΓòÉΓòÉΓòÉ 4.1.2. Data Analysis ΓòÉΓòÉΓòÉ

LAN technology is growing rapidly. It is not easy to keep up with the flood of
new networking protocols. That is why your DatagLANce analyzer carefully and
completely decodes and interprets information (see Figure "DatagLANce's
Protocol Analysis") to help you make sense out of this rather confusing
environment. In addition, the DatagLANce analyzer uses color coding and logical
positioning to present the data in a clear and concise manner.


DatagLANce's Protocol Analysis

This release of the DatagLANce analyzer supports all or portions of the
following protocol suites:

o FDDI Protocol Suite
o Token-Ring Protocol Suite
o Ethernet/802.3 Protocol Suite
o IBM Protocol Suite
o TCP/IP Protocol Suite
o SUN** NFS** Protocol Suite
o XNS Protocol Suite
o Novell** NetWare** Protocol Suite
o DECnet** Protocol Suite
o AppleTalk** Protocol Suite
o Banyan** VINES** Protocol Suite
o ISO Protocol Suite
o X.25 Protocol Suite

See Protocols Decoded for a list of each protocol decoded.


ΓòÉΓòÉΓòÉ 4.1.3. Statistical History ΓòÉΓòÉΓòÉ

The DatagLANce analyzer can store historical views of statistics. The software
permits you to record statistics over selectable time intervals. You can chart
utilization, frame rate, data rate, and error rate statistics in real-time
graphs or save them to a file. They can even be exported to your spreadsheet in
industry-standard format. Five custom counters keep track of the logical
combinations of your eight event detectors. Tailor the counters to keep tally
of just about any type of data that is displayed on your network. Figure
"Viewing Your Network's Past" shows some of the possible history graphs.


Viewing Your Network's Past


ΓòÉΓòÉΓòÉ 4.1.4. Alarms ΓòÉΓòÉΓòÉ

The DatagLANce analyzer's alarm function monitors rates of statistical
information to determine when thresholds are reached. For example, if network
utilization falls outside a given range, your DatagLANce analyzer will make an
entry, sound a tone, or both. All of the statistical counters serve as input to
the alarm function. You can set up alarms for many different conditions.

Your DatagLANce analyzer has five separate alarm priorities to notify you
whenever the condition of your network matches your criteria. Messages in the
alarm log are color coded by priority level to make information easy to see.
Figure "DatagLANce's Alarms Help Monitor Your Network" shows an example of the
alarm log.


DatagLANce's Alarms Help Monitor Your Network


ΓòÉΓòÉΓòÉ 4.1.5. Traffic Statistics ΓòÉΓòÉΓòÉ

:

The DatagLANce analyzer enables you to see the stations that are operating on
the network and the number of bytes and frames that each station has sent
during the time that traffic statistics have been tracked (see Figure "Traffic
Statistics"). You can sort this information in multiple ways to help you watch
the activity of the stations.


Traffic Statistics


ΓòÉΓòÉΓòÉ 4.1.6. Network Glance ΓòÉΓòÉΓòÉ

Network Glance allows you to take a real-time look at frames traveling on the
network (see Figure "Real-Time Network Traffic"). You can also use Network
Glance to look at the frames while the DatagLANce analyzer is capturing data.


Real-Time Network Traffic


ΓòÉΓòÉΓòÉ 4.1.7. Traffic Generation and Playback ΓòÉΓòÉΓòÉ

The DatagLANce analyzer's single frame traffic generation function permits you
to test your network under different traffic loads to measure performance and
do network tuning.

The DatagLANce analyzer's playback function permits you to play back traffic
into the DatagLANce Network Analyzer application or back onto the network.
Playing back into the application permits you to analyze the same network
traffic multiple times, using all of the functions of the application to
troubleshoot your problem. Playing back onto the network permits you to
simulate network traffic for use in classroom situations and DatagLANce Network
Analyzer training.


Simulating Network Traffic


ΓòÉΓòÉΓòÉ 4.2. OS/2 Tips ΓòÉΓòÉΓòÉ

Many good tools require a little effort to find the most effective ways to use
them. As you invest the time to learn OS/2, you build skills that can help you
get your job done. If you are new to OS/2, we encourage you to start by working
through the online OS/2 tutorial located on the OS/2 desktop.

The following sections give some OS/2 hints that you might find helpful when
using your DatagLANce analyzer.


ΓòÉΓòÉΓòÉ 4.2.1. Auto-Starting Applications ΓòÉΓòÉΓòÉ

The SET RESTARTOBJECTS= statement in the CONFIG.SYS file determines whether
applications that are running when the system is shut down will automatically
be restarted when the system is started again. Specifying RESTARTOBJECTS=NO can
save time when the system is activated because time is not spent restarting
applications.


ΓòÉΓòÉΓòÉ 4.2.2. Conserving Diskettes ΓòÉΓòÉΓòÉ

If you have problems with diskettes going bad while you are using MS-DOS or
OS/2, you definitely need to consider this tip.

     Warning: Never remove a diskette when the light emitting diode (LED)
     associated with it is still lit. The software message associated with
     drive access is often displayed on the screen well before the diskette LED
     is off. If you remove the diskette too soon, data on the diskette will
     probably be destroyed.


ΓòÉΓòÉΓòÉ 4.2.3. Using the Alt Key Instead of the Mouse ΓòÉΓòÉΓòÉ

Often, keyboard keys can be used in place of pointing and clicking with the
mouse; these are usually called shortcut keys.

To use the Alt key as a shortcut key:

  1. Press and release the Alt key once. The first choice in the menu bar is
     highlighted.

  2. Move the cursor down one line to open that menu.

  3. Move the cursor to the right to bring the menu you want into view.

  4. Move the cursor to highlight the choice you want and press Enter to select
     it. Instead of using the Enter key, you can also press the underlined
     letter key to select the choice you want directly. Some selections list
     key combinations next to them. These can be used to select the choice
     without even opening the menu.

  5. Hold down the Alt key and press the underlined letter in the menu bar
     selection name to go directly to that selection.


ΓòÉΓòÉΓòÉ 4.2.4. Backing out of Menu Selections ΓòÉΓòÉΓòÉ

The Esc key backs you out of menu selections.


ΓòÉΓòÉΓòÉ 4.2.5. Determining What Applications Are Running ΓòÉΓòÉΓòÉ

The Ctrl-Esc key combination gives a menu of the applications running; from
this menu you can select the application you want. It is easy to locate
different analysis sessions because your DatagLANce analyzer software includes
the file name in this list.


ΓòÉΓòÉΓòÉ 4.2.6. Locating Items in Drop-Down Lists ΓòÉΓòÉΓòÉ

Drop-down lists are identified by a push button, showing an arrow pointing down
to an equal sign, to the right of the box. If you use mouse button 1 to click
on the arrow push button, the list box will open. Although you can scroll
through the list to find your selection, OS/2 also offers a first letter
shortcut. If you know what you are looking for, this really saves time. Just
repeatedly press the first letter of your selection, and move to the next
choice starting with that letter in the list.


ΓòÉΓòÉΓòÉ 4.2.7. Using the Title Bar ΓòÉΓòÉΓòÉ

The title bar is displayed at the top of each window and contains the window
name. You can position your mouse pointer in this area and grab the window by
holding down mouse button 1 as you drag the window to a new position. You can
also use the title bar to maximize and restore the window by clicking on the
push button at the left of the title bar.


ΓòÉΓòÉΓòÉ 4.2.8. Closing Windows ΓòÉΓòÉΓòÉ

The system menu icon is in the upper left corner of each window. Double-click
on this icon to close your window.


ΓòÉΓòÉΓòÉ 4.2.9. Delayed Printing ΓòÉΓòÉΓòÉ

Any files that are sent to the OS/2 printer begin printing only after the
complete file has been received by the printer program. This permits multiple
applications to access the printer simultaneously by ensuring that no one
application interferes with another application's use of the printer.
Therefore, if you select the printer as the device to which to write for a
DatagLANce analyzer application, the data will not be printed until the writing
ends. (For example, if you log alarms to the printer, alarm information will
not be printed until the monitor function is stopped.)


ΓòÉΓòÉΓòÉ 4.3. DatagLANce Analyzer Tips ΓòÉΓòÉΓòÉ

This section contains techniques to help you get the most from your DatagLANce
analyzer.


ΓòÉΓòÉΓòÉ 4.3.1. Viewing Details of a Summary Line ΓòÉΓòÉΓòÉ

In an analysis session, you often need to move forward from Summary, to Detail,
to Hexdump displays. To see the detail of a particular summary line, simply
double-click on the line. The same holds true to move from Detail to Hexdump.


ΓòÉΓòÉΓòÉ 4.3.2. Using Bookmarks ΓòÉΓòÉΓòÉ

Often, captured data contains thousands of frames. Bookmarks are useful tools
for moving quickly from place to place in these files. To set a bookmark
quickly, highlight the desired line and then press Alt-x where x is the
bookmark number. Then, to return to that bookmark, simply press the appropriate
number key on the keyboard. For more information, see Bookmarks.


ΓòÉΓòÉΓòÉ 4.4. Using the DatagLANce Menus ΓòÉΓòÉΓòÉ

This section is a quick overview of some of the things you can do from the
DatagLANce Network Analyzer window. Later chapters give more detail about using
the choices available from each of the menus mentioned in this section.

The DatagLANce Icon View window contains icons for the Token-Ring Network
Analyzer, the Ethernet Network Analyzer or both, depending on your system. We
will look at the Token-Ring Network Analyzer in this introduction section. The
Ethernet Network Analyzer is similar to the Token-Ring Network Analyzer.

The menu bar, under the title bar of the Token-Ring DatagLANce Network Analyzer
window, lists choices that you can select from the window (see Figure
"Token-Ring DatagLANce Network Analyzer Window"). You select a menu choice by
moving the mouse pointer to the item and clicking once with mouse button 1.
This causes a menu for that item to be displayed.


Token-Ring DatagLANce Network Analyzer Window


ΓòÉΓòÉΓòÉ 4.4.1. File Menu ΓòÉΓòÉΓòÉ

From this menu, you can select the address format or, under Preferences, you
can adjust the font size. You can edit any symbolic names. You can also print
reports and save or restore configurations of the options and screens you
design.


ΓòÉΓòÉΓòÉ 4.4.2. Monitor Menu ΓòÉΓòÉΓòÉ

From this menu, you select media connection or speed, adapter options,
statistics recording options, alarms, traffic statistics options, and make the
choice between Network Glance or Ring Map.


ΓòÉΓòÉΓòÉ 4.4.3. Capture Menu ΓòÉΓòÉΓòÉ

Here, you specify what you want to capture, where it will be stored, and when
the capture will take place.


ΓòÉΓòÉΓòÉ 4.4.4. Transmit Menu ΓòÉΓòÉΓòÉ

Here, you select whether to generate traffic, play back traffic onto the
network, or playback traffic into the DatagLANce Network Analyzer.


ΓòÉΓòÉΓòÉ 4.4.5. Screen Menu ΓòÉΓòÉΓòÉ

From the Screen pull-down menu, you can bring up previously designed groups
(screens) of windows that contain convenient sets of displays. Selecting Define
permits you to design and store your own best arrangements.


ΓòÉΓòÉΓòÉ 4.4.6. Window Menu ΓòÉΓòÉΓòÉ

From the window pull-down menu, you can design your own screens. Then, from the
Screens window, you can select the windows you created using this menu.


ΓòÉΓòÉΓòÉ 4.4.7. Help Choice ΓòÉΓòÉΓòÉ

Selecting the Help choice accesses the IBM DatagLANce Network Analyzer for
Ethernet and Token Ring for OS/2 User's Guide and displays the section that
relates to the current screen. To access a different section, select Contents
from the Options menu in the window that is displayed.


ΓòÉΓòÉΓòÉ 4.4.8. Analysis! Choice ΓòÉΓòÉΓòÉ

Here, you select to launch a protocol analysis session to analyze frames stored
in the capture buffer or a file.


ΓòÉΓòÉΓòÉ 4.4.9. Go! Choice ΓòÉΓòÉΓòÉ

Selecting this choice starts the monitoring of the network or the capturing of
frames, and changes the menu choice to Stop!, which permits you to stop the
monitoring or capturing.


ΓòÉΓòÉΓòÉ 5. Installing DatagLANce ΓòÉΓòÉΓòÉ


ΓòÉΓòÉΓòÉ 5.1. Hardware and Software Requirements ΓòÉΓòÉΓòÉ

You need the following hardware and software to use the DatagLANce analyzer
software:

 o An IBM 386, or higher, processor-based computer. An IBM 486 33 MHZ, or
   higher, is recommended.

 o A VGA, or higher, color display is recommended.

 o OS/2 2.0 or higher.

 o A minimum of 6 MB of RAM, 12 MB of RAM is recommended.

 o A minimum of 12 MB of free fixed disk space.

 o One of the following adapters:

 o Token-Ring DatagLANce:

    - IBM DatagLANce Token-Ring 16/4 ISA Adapter

    - IBM DatagLANce Token-Ring 16/4 MC Adapter

    - IBM DatagLANce Token-Ring 16/4 CC Adapter

 o Other IBM token-ring:

    - IBM Trace and Performance Token-Ring 16/4 Adapter

    - IBM Trace and Performance Token-Ring 16/4 Adapter/A

 o OEM

    - Network General 16/4 Token-Ring Sniffer** Network Analyzer, excluding
      Madge Networks, Inc., Token-Ring Adapters for AT Bus

 o Ethernet:

    - IBM LAN Adapter for Ethernet TP

    - IBM LAN Adapter for Ethernet CX

    - IBM LAN Adapter for Ethernet

    - IBM PS/2 Adapter/A for Ethernet Networks

    - IBM PS/2 Ethernet Twisted-Pair Adapter/A

    - Credit Card Adapter for Ethernet 10Base2

    - Credit Card Adapter for Ethernet 10BaseT

 o If you plan to use a credit card adapter, your computer must have OS/2 2.1
   or higher, plus the card and socket services drivers appropriate for your
   computer installation.

 o For a dual same-media DatagLANce Network Analyzer (such as, two token-ring
   or Ethernet DatagLANce analyzers in the same computer), you will need
   another of the above adapters for the same media.

 o To utilize the SNMP Trap alarm option (see Configuring Alarms: The Alarm
   Options), you must have IBM TCP/IP for OS/2 installed and a separate network
   interface for TCP/IP communication configured (i.e. another network adapter
   or SLIP line).

 o To utilize the pager alarm option (see Configuring Alarms: The Alarm
   Options), you must have a phone and a Hayes** compatible modem attached to
   one of the COM ports of your computer.


ΓòÉΓòÉΓòÉ 5.2. Installing the DatagLANce Network Analyzer ΓòÉΓòÉΓòÉ

To install the DatagLANce Network Analyzer software onto your fixed disk,
follow these steps:

  1. Attach the DatagLANce key to the parallel port of your computer.

  2. Place installation diskette 1 in drive A and, from an OS/2 full screen
     command prompt, type the following command:

          A:INSTALL

  3. Follow the installation instructions given to you by the installation
     program.

  4. Install the supplied adapters in your system using the installation
     instructions supplied with the adapters.

     The adapters must be configured as instructed by the DatagLANce analyzer
     installation program.

  5. Connect the network interface cable to the adapter. This will connect your
     DatagLANce analyzer to the network.

     When connecting to Ethernet coaxial cable, be sure to connect with a
     Coaxial T connector and, if needed, use a BNC terminator cap on any
     unconnected end.

     Some Ethernet adapters have multiple connections. Select the media to
     which you will connect your DatagLANce analyzer from the Monitor menu or
     correctly configure the adapter (by means of DIP switches on the adapter)
     before connecting. See Using the Monitor Menu for a description of these
     options. Refer to the reference book that comes with your Ethernet adapter
     for configuration options.

  6. Restart the computer, making sure the DatagLANce key is still attached to
     the parallel port.

  7. Review the READ.ME file that resides in the same directory as the
     software.  This file may be viewed using any standard text file editor.

 Help can be accessed anytime from the help menus found on most windows. See
 Getting Started for a good starting point to learn how to use your DatagLANce
 analyzer.


ΓòÉΓòÉΓòÉ 5.3. DatagLANce Device Driver Options ΓòÉΓòÉΓòÉ

The DatagLANce analyzer installation program will automatically modify your
CONFIG.SYS file to add one or more DatagLANce device driver statements. The
device drivers installed can be:

 o The DatagLANce High-Resolution Time-Stamp Device Driver (DEVICE=DGHRT$.SYS)

 o The DatagLANce Token-Ring Device Driver (DEVICE=DGTR0$.SYS)

 o The DatagLANce Ethernet Device Driver (DEVICE=DGEN0$.SYS)

 The following sections explain in more detail the DatagLANce device driver
 parameters that you can change to customize your DatagLANce analyzer.


ΓòÉΓòÉΓòÉ 5.3.1. The High-Resolution Time-Stamp Option ΓòÉΓòÉΓòÉ

Because standard timestamp resolution is just 10-msec for token-ring and
32-msec for Ethernet, the DatagLANce analyzer offers time-stamping frames with
a high-resolution time-stamp. This time-stamp is measured in 840 nanosecond
clock ticks. There are limitations to interpreting this time-stamp, however.

 o Because the adapters being used to capture frames do not automatically
   time-stamp the frames as they arrive, the DatagLANce device driver must
   time-stamp the frame when processed. Because the speed of the processors
   available in computers can vary, this time-stamp value will be affected by
   the speed of the computer.

 o The time-stamp will also be affected by the amount of processing that the
   DatagLANce analyzer performs on the frame that arrives. Thus, enabling the
   filtering options can affect this time-stamp.

 o The high resolution time-stamp attaches a precision number to each frame
   processed. This number can often help in resolving networking problems by
   giving a good approximation of the relative arrival times of frames. The
   time-stamp is not guaranteed to represent a precise frame arrival time.

 o The DEVICE=DGHRT$.SYS device driver statement added to the CONFIG.SYS file
   enables the high-resolution time-stamp option to be used. This device
   statement will be added by the DatagLANce installation program during
   installation if you elect to use the high-resolution time-stamp option. To
   disable this option, remove this statement.


ΓòÉΓòÉΓòÉ 5.3.2. The BUFSIZE= Parameter ΓòÉΓòÉΓòÉ

The BUFSIZE= parameter on the DEVICE=DGTR0$.SYS (or DEVICE=DGEN0$.SYS) line in
the CONFIG.SYS selects the size of the memory capture buffer that the
DatagLANce analyzer will use to store captured frames (see Capturing Frames
from the Network).

This parameter is specified as:

BUFSIZE=size

where size is the buffer size. The value for size can range from 64K (for a
64-KB buffer) to 32M (for a 32-MB buffer). For example, for a 128-KB buffer
size, you specify:

BUFSIZE=128K
The buffer size must be specified as a multiple of 64-KB increments. If this
parameter is not specified, the default buffer size is 64 KB.

By increasing the capture buffer size, you can increase the number of frames
that the DatagLANce analyzer can capture to the buffer, thus giving you a
larger window in which to analyze frames from the network. By increasing this
buffer size, you can also improve the performance of the DatagLANce analyzer
when capturing data to a file (see Capturing to the Capture Buffer Versus
Capturing to File).

Note:  Ensure that the system has sufficient memory available to operate when
you specify this parameter. The memory claimed by the device driver is not
available for system use.


ΓòÉΓòÉΓòÉ 5.3.3. The TRAFFIFO= Parameter ΓòÉΓòÉΓòÉ

The TRAFFIFO= parameter on the DEVICE=DGTR0$.SYS (or DEVICE=DGEN0$.SYS) line in
the CONFIG.SYS selects the size of the traffic statistics first-in first-out
(FIFO) buffer that the DatagLANce analyzer will use to store frames for traffic
analysis.

This parameter is specified as:

TRAFFIFO=size

where size is the FIFO buffer size. The value for size can range from 64K (for
a 64-KB buffer) to 16M (for a 16-MB buffer). For example, for a 128-KB FIFO
buffer size, you specify:

TRAFFIFO=128K
The buffer size must be specified as a multiple of 64-KB increments. If this
parameter is not specified, the default buffer size is 64 KB. For each 64 KB
that is specified, approximately 512 frames will be stored for traffic
statistics processing.

By increasing the traffic FIFO buffer size, you can increase the number of
frames that the DatagLANce analyzer can have queued for traffic analysis
processing. This will improve the performance of the traffic analysis function
when network traffic is occurring in bursts.

Note:  Ensure that the system has sufficient memory available to operate when
you specify this parameter. The memory claimed by the device driver is not
available for system use.


ΓòÉΓòÉΓòÉ 6. Getting Started ΓòÉΓòÉΓòÉ

Although not exactly a tutorial, this hands-on chapter helps you get started
with your DatagLANce analyzer by taking you through several typical scenarios.

These scenarios use the default configuration shipped with the DatagLANce
analyzer.

References to the DatagLANce Network Analyzer window refer to either the
Token-Ring or Ethernet DatagLANce Network Analyzer window.


ΓòÉΓòÉΓòÉ 6.1. Ending a DatagLANce analyzer Session ΓòÉΓòÉΓòÉ

It might seem strange to tell you how to end a session before we tell you how
to start one, but you might decide to end a session before you finish a
scenario.

To end a DatagLANce analyzer session:

  1. Move your mouse pointer to the system menu push button located in the
     upper left corner of the Token-Ring or Ethernet DatagLANce Network
     Analyzer window and double-click mouse button 1.

  2. You will be prompted to answer questions so the session can be ended.


ΓòÉΓòÉΓòÉ 6.2. Ending an OS/2 Session ΓòÉΓòÉΓòÉ

Ending an OS/2 session is slightly more complicated. OS/2 permits multiple
programs to be active at the same time. This allows you to stop in the middle
of one job and switch to another.

     Warning: This flexibility means that you can switch out of an application
     without saving some of your work. If you simply turn the system off, you
     will lose unsaved data. To prevent this from happening, get into the habit
     of closing open applications before switching the power off.

 OS/2 also prefers that you give it orderly shutdown instructions. This permits
 the operating system to clean up temporary files that otherwise clutter your
 system disk.

  1. Click anywhere on the desktop with mouse button 2. In the menu that is
     displayed, click on Shutdown.

  2. Answer any questions that OS/2 asks during the shutdown process.


  Shutdown


ΓòÉΓòÉΓòÉ 6.3. Starting Your DatagLANce Network Analyzer ΓòÉΓòÉΓòÉ

In this scenario, you will start your DatagLANce analyzer.

  1. Turn the power on for your DatagLANce system. When OS/2 is loaded, the
     OS/2 Desktop will be displayed (see Figure "OS/2 Desktop").


          OS/2 Desktop

  2. Double-click on the DatagLANce group icon. The DatagLANce Icon View window
     is displayed (see Figure "DatagLANce Icon View Window").


          DatagLANce Icon View Window

  3. Move the mouse pointer to the Token-Ring Network Analyzer icon or the
     Ethernet Network Analyzer icon and double-click with mouse button 1. Wait
     1 or 2 minutes until the DatagLANce analyzer software has been loaded.
     (The blinking LED on the disk drive indicates that the load is in
     progress.) After the DatagLANce software has been loaded, the DatagLANce
     Network Analyzer window is displayed (see Figure "DatagLANce Network
     Analyzer Window"). Other windows are also displayed. Because you are not
     monitoring the network yet, the windows do not contain statistics.


          DatagLANce Network Analyzer Window

 You are now ready to start one of the scenarios in this section.


ΓòÉΓòÉΓòÉ 6.4. Starting a Monitoring Session ΓòÉΓòÉΓòÉ

In this scenario, you will start a monitoring session, take a quick look at
what you can do from the Screen choice on the DatagLANce Network Analyzer
window menu bar, and learn how to silence audible alarms.

  1. If you have not already started your DatagLANce system, follow the steps
     in Starting Your DatagLANce Network Analyzer.

  2. To start monitoring the frames so you can take a look at what is happening
     on your network, click on Go! in the DatagLANce Network Analyzer window
     menu bar.

     For an Ethernet network, a screen showing current network statistics will
     now be displayed.

     For a token-ring network, a Verification window will be displayed. If your
     token-ring is operating at the speed specified in the Verification window,
     click on the Yes push button.

     If your token-ring is not operating at the speed specified in the
     Verification window:

     a. Click on the No push button.

     b. Click on Monitor in the Token-Ring DatagLANce Network Analyzer window
        menu bar.

     c. Select the correct speed.

     d. Click on Go! in the Token-Ring DatagLANce Network Analyzer window menu
        bar again.

     e. Click on the Yes push button on the Verification window, indicating
        that you are now at the speed specified.

     A screen showing current network statistics will be displayed.

  3. You might be hearing periodic ringing now. Do not worry, the rings are
     just the audible alarms that are set in the default configuration. If you
     want to silence the audible alarms, perform the following steps:

     a. Click on Screen in the DatagLANce Network Analyzer window menu bar.

     b. Click on Alarm Log in the Screen menu. You should now see the Alarm Log
        window showing the alarms that are occurring.

     c. Click on Options in the Alarm Log window menu bar and click on Allow
        Audible Alarms in the Options menu to silence the audible alarms. You
        should no longer hear the alarm, but the DatagLANce analyzer is still
        logging the alarms. For more information about alarms, see Configuring
        Alarms: The Alarm Options.

  4. Now, let us take a closer look at the Screen choice in the DatagLANce
     Network Analyzer window menu bar. Click on Screen to get the Screen menu
     (see Figure "Screen Menu").


          Screen Menu
     The menu contains the following choices:

    o OS/2 Desktop - Click on this choice to display the OS/2 Desktop. All
      DatagLANce windows except the DatagLANce Network Analyzer window are
      hidden.

    o Configuration Description - Click on this choice to display a text
      description of the current DatagLANce configuration. See Configurations
      for more information about DatagLANce configurations.

    o Network Statistics - Click on this choice to display the screen showing
      current network status and statistics.

    o Network History - Click on this choice to display windows showing network
      history graphs.

    o Network Errors - Click on this choice to display the network error
      windows.

    o Traffic Statistics - Click on this choice to display windows with
      statistics about stations operating on your network.

    o Network Glance - Click on this choice to get the Network Glance Frame
      Summary window. Click on Glance!  in the Network Glance Frame Summary
      window. A window is displayed showing a snapshot of the frames on the
      network. For more information about Network Glance, see Figure "Network
      Glance Window".

    o Alarm Log - Click on this choice to display the Alarm Log window. You
      looked at this window briefly if you silenced the audible alarms.

    o Capture Status/Control - Click on this choice to display the current
      status of the capture. You can learn more about capturing data in
      Capturing Frames from the Network.

     Click on Screen, in each case, to get back to the Screen menu.

 This brief look at the DatagLANce analyzer is now complete. If you want, you
 can end the session or look at one of the other scenarios.


ΓòÉΓòÉΓòÉ 6.5. Capturing All Frames and Looking at the Captured Data ΓòÉΓòÉΓòÉ

In this scenario, you will capture data from the network and then look at the
captured data.

  1. If you have not started the network analyzer, click on the Capture Frames
     icon in the Token-Ring DatagLANce Icon View window or Ethernet DatagLANce
     Icon View window.

     If you have already started the network analyzer, perform the following
     steps to stop the analyzer:

     a. Click on Stop! in the DatagLANce Network Analyzer window menu bar.

     b. Click on Screen in the DatagLANce Network Analyzer window menu bar.

     c. In the Screen menu, click on OS/2 Desktop.

     d. In the Ethernet or Token-Ring DatagLANce Icon View window, click on the
        Capture Frames icon.

     e. A Verification Window might be displayed. If so, answer the question to
        continue.

  2. Click on Go! on the DatagLANce Network Analyzer window menu bar.

     For an Ethernet network, continue with step 3.

     For a token-ring network, a Verification window is displayed. If your
     token-ring is operating at the speed specified in the Verification window,
     click on the Yes push button.

     If your token-ring is not operating at the speed specified in the
     Verification window:

     a. Click on the No push button.

     b. Click on Monitor in the Token-Ring DatagLANce Network Analyzer window
        menu bar.

     c. Select the correct speed.

     d. Click on Go! in the Token-Ring DatagLANce Network Analyzer window menu
        bar again.

     e. Click on the Yes push button on the Verification window.

  3. You should now see a screen with the following windows:

    o Captured Frames Rate History
    o Network Status
    o Current All Frames Rate
    o Current Captured Frames Rate
    o Capture Status/Control

     You have captured data when you see blue on the bar in the Capture Buffer
     Status box in the Capture/Status Control window.

  4. To stop capturing data, perform the following steps:

     a. Click on Stop! in the DatagLANce Network Analyzer window menu bar. The
        Verification window is displayed.

     b. Click on the Yes push button in the Verification window. The network
        analyzer stops capturing data.

        For more information about capturing frames, see Capturing Frames from
        the Network.

  5. You can now look at the captured data. Click on the Analysis push button
     in the Capture Status/Control window and wait while the network analyzer
     activates the analysis software. When the Frame Summary: Token-Ring (or
     Ethernet) Capture Buffer 0 window is displayed, continue with the next
     step.

  6. The Frame Summary: Token-Ring (or Ethernet) Capture Buffer 0 window
     displays the captured frames. You can get details for any frame by
     following these steps:

     a. Double-click on the line in the Frame Summary: Token-Ring (or Ethernet)
        Capture Buffer 0 window for which you want details. The Frame Detail
        window is displayed for the frame.

     b. If you want to maximize the Frame Detail window, double-click on the
        title bar of the window.  Double-click again to return the window to
        its original size.

     c. Double-click on a line in the Frame Detail window to display the Frame
        Hexdump window.

        Note:  If you click on another line in the Frame Summary: Token-Ring
        (or Ethernet) Capture Buffer 0 window, details of that frame are given
        in the Frame Detail window and in the Frame Hexdump window.

     d. To close the Frame Hexdump window, double-click anywhere in the Frame
        Detail window.

     e. Click on Display in the Frame Summary window menu bar to display the
        Display menu. From this menu, you can select items to display, such as
        frames missed, time-stamps, and frame addresses. See Selecting Frame
        Summary Information to Be Displayed for more information about choices
        in the Frame Summary window Display menu.

     f. Press Esc to remove the Display menu from the screen.

  7. If you want to save the captured data, perform the following steps:

     a. Click on File in the Frame Summary: Token-Ring (or Ethernet) Capture
        Buffer 0 window.

     b. Click on Save in the File menu. The Save window is displayed.

     c. From the Save window, select the range of frames to save.

     d. Click on the Pathname input field in the Save window and enter the file
        name under which you want to save the captured data.

     e. Click on the OK push button.

     f. When the save is complete, an Information window is displayed. Click on
        the OK push button in the Information window.

        The network analyzer has now saved the captured data.

  8. Double-click on the push button to the left of the title bar to close the
     Frame Summary: Token-Ring (or Ethernet) Capture Buffer 0 window. A
     Verification window is displayed.

  9. Click on the Yes or No push button in the Verification window to indicate
     whether the current configuration should be saved or not.

 10. The DatagLANce Network Analyzer window is displayed.

     See Analyzing Captured Frames for more information about analyzing
     captured frames.

 This scenario is now complete. If you want, you can end the session or look at
 one of the other scenarios.


ΓòÉΓòÉΓòÉ 6.6. Capturing Frames between Two Stations ΓòÉΓòÉΓòÉ

In this scenario, you will capture all the frames sent between two stations on
your network.

  1. If you have not started the network analyzer, click on the Capture Frames
     icon in the Token-Ring DatagLANce Icon View window or Ethernet DatagLANce
     Icon View window.

     If you have already started the network analyzer, perform the following
     steps to stop the analyzer:

     a. Click on Stop! in the DatagLANce Network Analyzer window menu bar.

     b. Click on Screen in the DatagLANce Network Analyzer window menu bar.

     c. In the Screen menu, click on OS/2 Desktop.

     d. In the Ethernet or Token-Ring DatagLANce Icon View window, click on the
        Capture Frames icon.

     e. You might see a Verification Window now. If you do, answer the question
        to continue.

  2. Click on Capture in the Token-Ring or Ethernet DatagLANce analyzer,
     Configuration: startup window.

  3. Click on Frame Capture Filter in the Capture menu. The Frame Capture
     Filter window is displayed.

  4. Click on the Clear push button and then on the Edit push button.

  5. The Edit Equation Line window is displayed. Click on To/From Selected
     Station.

  6. Configure Event Detector 1 is displayed. Change the label edit field to
     Between Two Stations or whatever descriptive name you choose.

  7. Click on the Configure push button.

  8. The DLC Address Pairs window will be displayed. Click on the Clear push
     button to clear the list box labeled Address Pair List.

  9. Set up the Event Detector using the following steps:

     a. In the Dest edit field, enter, in MSB or LSB hexadecimal form, the DLC
        address of the first station that you want to monitor.

        For example,

       MSB form:

              10:00:5A:11:22:33

       LSB form:

              08-00-5A-88-66-CC

    Note:  The use of colons or dashes indicates whether the address is in MSB
    or LSB form.  See Figure "User Preferences Window" for more information
    about address forms.

     b. In the Source edit field, enter the DLC address of the second station
        you want to monitor.

        Note:  If you want to monitor all the frames sent to the first station,
        regardless of the source, you can enter XX:XX:XX:XX:XX:XX in the Source
        edit field.

     c. Click on the Add push button.

     d. Click on the Switch push button. Click on the Add push button again.
        This swaps the source and destination addresses so that you will
        capture all frames between the stations, regardless of which station is
        the source.

     e. Click on the OK push button.

     f. Click on the OK push button on the Configure Event Detector 1 window.

     g. In the Edit Equation Line window, click on the push button to the left
        of the Between Two Stations push button. The word IF will be displayed
        on the face of that push button.

     h. Click on the OK push button. Event Detector 1 is now configured.

        See Figure "Frame Capture Filter" for more information about
        configuring capture filters.

 10. The Frame Capture Filter is displayed. Ensure that the Enabled check box
     is checked. (If it is not, click on the Enabled check box.) Click on the
     OK push button.

 You are now ready to start the capture. Follow the steps in Capturing All
 Frames and Looking at the Captured Data, starting at step 2 to capture the
 frames specified by Event Detector 1 and to look at the captured data.


ΓòÉΓòÉΓòÉ 6.7. Point and Click Filtering: Quickly Filtering Frames After a Capture ΓòÉΓòÉΓòÉ

This scenario gives you a quick way to filter frames after the DatagLANce
analyzer captures them so you can view only those you are interested in at that
time.

  1. First, you need to capture some frames. Follow steps 1 through 5 of the
     scenario Capturing All Frames and Looking at the Captured Data.

  2. The Frame Summary: Token-Ring Capture Buffer 0 (or the Frame Summary:
     Ethernet Capture Buffer 0) window shows the captured frames. You are now
     ready to look at the frames, to and from one of the source addresses,
     listed in the window.

  3. Click on any of the frames shown with mouse button 2.

  4. Click on the OK push button on the window that is displayed.

  5. Click on the OK push button on the Quick Filter menu.

  6. The Frame Summary Refresh Options window is displayed. Click on the
     Refresh Summary from Beginning-of-File radio button and then click on the
     OK push button.

  7. The Frame Summary window is refreshed to show only frames to and from the
     source address of the frame that you clicked on in step 3. See Quick
     Filter: The Quick Equation Writer for more information about Quick Filter.

 This scenario is now complete. If you want, you can end the session or look at
 one of the other scenarios.


ΓòÉΓòÉΓòÉ 6.8. Viewing the Top Talkers on Your Network ΓòÉΓòÉΓòÉ

In this scenario, you will monitor the network and look at the most active
stations (the top talkers) on your network.

  1. If you have not started the network analyzer, click on the Traffic
     Analysis icon in the Token-Ring DatagLANce Icon View window or Ethernet
     DatagLANce Icon View window.

     If you have already started the network analyzer, perform the following
     steps to stop the analyzer:

     a. Click on Stop! in the DatagLANce Network Analyzer window menu bar.

     b. Click on Screen in the DatagLANce Network Analyzer window menu bar.

     c. In the Screen menu, click on OS/2 Desktop.

     d. In the Ethernet or Token-Ring DatagLANce Icon View window, click on the
        Traffic Analysis icon.

     e. You might see a Verification Window now. If you do, answer the question
        to continue.

  2. Click on Go! in the DatagLANce Network Analyzer window menu bar.

     For an Ethernet network, continue with step 3.

     For a token-ring network, a Verification window is displayed. If your
     token-ring is operating at the speed specified in the Verification window,
     click on the Yes push button.

     If your token-ring is not operating at the speed specified in the
     Verification window:

     a. Click on the No push button.

     b. Click on Monitor in the Token-Ring DatagLANce Network Analyzer window
        menu bar.

     c. Select the correct speed.

     d. Click on Go! in the Token-Ring DatagLANce Network Analyzer window menu
        bar again.

     e. Click on the Yes push button on the Verification window.

  3. The Traffic Statistics window is refreshed as the DatagLANce analyzer
     monitors the traffic on the network.

  4. To view the top talkers on your network, perform the following steps:

     a. Click on Display in the Traffic Statistics window menu bar. Click on
        Traffic from Station in the Display menu.

     b. Click on Sort in the Traffic Statistics window menu bar. Ensure that
        the Descending item is checked. (If it is not checked, click on
        Descending.) Click on Frames in the Sort menu. The Traffic Statistics
        window will now show which stations on the network are transmitting the
        most frames.

     c. Click on Sort in the Traffic Statistics window menu bar. Click on Bytes
        in the Sort menu. The Traffic Statistics window will now show which
        stations on the network are transmitting the most bytes.

  5. To view the top listeners on your network, perform the following steps:

     a. Click on Display in the Traffic Statistics window menu bar. Click on
        Traffic to Station in the Display menu.

     b. Click on Sort in the Traffic Statistics window menu bar. Click on
        Frames in the Sort menu. The Traffic Statistics window will now show
        which stations on the network are receiving the most frames.

     c. Click on Sort in the Traffic Statistics window menu bar. Click on Bytes
        in the Sort menu. The Traffic Statistics window will now show which
        stations on the network are receiving the most bytes.

 This scenario is now complete. If you want, you can end the session or look at
 one of the other scenarios.


ΓòÉΓòÉΓòÉ 6.9. Setting an Alarm ΓòÉΓòÉΓòÉ

In this scenario, you will set an alarm.

  1. If you have not started the network analyzer, click on the Default icon in
     the Token-Ring or Ethernet DatagLANce Icon View window.

     If you have already started the network analyzer:

     a. Click on Screen in the DatagLANce Network Analyzer window. The Screen
        menu is displayed.

     b. Click on OS/2 Desktop in the Screen menu.

     c. Double-click on the Default icon in the DatagLANce Icon View window.

  2. Click on Monitor in the DatagLANce Network Analyzer window menu bar.

  3. Click on Alarm Option in the Monitor menu. The Alarm Option window is
     displayed.

  4. Click on All Frames Utilization in the Alarm Event list box.

  5. The Alarm Thresholds box shows the defaults for this alarm event. Change
     the defaults as follows:

     a. Click on the Inform: MAXIMUM box and enter 1. Do not press the Enter
        key until you are told to do so.

        Note:  Pressing the Enter key will cause an inform priority audible
        alarm to occur whenever network utilization goes over 1%. In a real
        situation you would probably never use the values you are using in this
        scenario; we want to make sure you will get some audible alarms.

     b. Click on the Warning: MAXIMUM box and enter 5.

     c. Click on the Minor: MAXIMUM box and enter 10.

     d. Press Enter. The alarm is now set.

  6. Click on Screen in the DatagLANce Network Analyzer window menu bar.

  7. Click on Alarm Log in the Screen menu. You should now see the Alarm Log
     window, but no alarms are occurring because you have not started the
     network analyzer yet.

  8. If you want to silence the audible alarms, perform the following steps:

     a. Click on Options in the Alarm Log window menu bar.

     b. Click on Allow Audible Alarms in the Options menu. You will not hear
        any ringing when the DatagLANce analyzer is started, but the DatagLANce
        analyzer will still log the alarms.

  9. For Ethernet, click on Go! in the DatagLANce Network Analyzer window menu
     bar.

     For token-ring, select the ring speed as follows:

     a. Click on Monitor in the Token-Ring DatagLANce Network Analyzer window
        menu bar.

     b. Select the correct speed.

     c. Click on Go! in the Token-Ring DatagLANce Network Analyzer window menu
        bar.

     d. Click on the Yes push button on the Verification window.

 10. If a Verification window is displayed indicating that the capture buffer
     contains captured data, click on the Yes push button to allow the
     DatagLANce analyzer to overwrite the data.

 11. The Alarm Log shows alarms as they occur. Because of the thresholds you
     set in step 5, when frame utilization for the network is over 1%, an
     inform alarm occurs. When frame utilization for the network is over 5%, a
     warning alarm occurs. When frame utilization for the network is over 10%,
     a minor alarm occurs. For more information about alarms, see Configuring
     Alarms: The Alarm Options.

 This scenario is now complete. If you want, you can end the session or look at
 one of the other scenarios.


ΓòÉΓòÉΓòÉ 6.10. Monitoring a File Server ΓòÉΓòÉΓòÉ

In this scenario, you will configure DatagLANce to monitor a file server (or
any other network station that you prefer) on your network. Before you start
this scenario you will need the network address (either DLC or network-layer
address) of the file server. For example, if you will monitor a Novell NetWare
file server, you should obtain either the IPX address of the server or the DLC
address of the network adapter in the server.

  1. If you haven't started the network analyzer, click on the File Server
     Template icon in the Token-Ring or Ethernet DatagLANce Icon View window.

     If you have already started the network analyzer:

     a. Click on Screen in the DatagLANce Network Analyzer window. You should
        see the Screen menu.

     b. Click on OS/2 Desktop in the Screen menu.

     c. Double-click on the File Server Template icon in the DatagLANce Icon
        View window.

  2. Click on Monitor in the DatagLANce Network Analyzer window menu bar.

  3. Click on Custom Events in the Monitor menu. You should see the Custom
     Events to be Monitored window.

  4. Click on 3:Traffic To/From File Server in the Custom Events list box.

  5. Type in a label specific to your file server in the Custom Event Label
     edit field.  For example, if you will be monitoring your department's file
     server enter Traffic To/From Department File Server into the edit field.

  6. Click on the Edit push button next to the Count a frame list box.

  7. The Edit Equation Line window is displayed. Click on To/From File Server.

  8. Configure Event Detector 1 is displayed. Change the label edit field to
     To/From Department Server or whatever descriptive name you choose.

  9. Depending on whether you have the DLC address or the network address of
     the file server, do the following:

     a. If you have the DLC address of the file server:

        1. Click on the arrow to the right of the Event combination box. This
           will drop down the list of available event detectors.

        2. Select DLC Address Pairs in the Event combination box. The drop down
           list will disappear and DLC Address Pairs will appear in the box.

        3. Click on the Configure push button.

        4. The Destination/Source Pairs window will be displayed. Click on the
           Clear push button to clear the list box labeled Address Pair List.

        5. In the Dest edit field, enter, in MSB or LSB hexadecimal form, the
           DLC address of the file server that you want to monitor.

           For example,

          MSB form:

                    10:33

          LSB form:

                    08-00-5A-88-66-CC

       Note:  The use of colons or dashes indicates whether the address is in
       MSB or LSB form.  See Figure "User Preferences Window" for more
       information about address forms.

        6. If not already selected, click on the Stations radio button to the
           right of the window.

        7. Click on <Any DLC Station> in the Symbolic Names List.

        8. Click on the From <- push button.

        9. Click on the Add push button.

       10. Click on the Switch push button. Click on the Add push button again.
           This swaps the source and destination addresses so that you will
           monitor traffic in both directions between the file server and any
           other station on the network.

       11. Click on the OK push button.

     b. If you have the network-layer address of the file server:

        1. Click on the arrow to the right of the Event combination box. This
           will drop down the list of available event detectors.

        2. Select Network Address Pairs in the Event combination box. The drop
           down list will disappear and Network Address Pairs will appear in
           the box.

        3. Click on the Configure push button.

        4. The Network Address Pairs window will be displayed. Click on the
           Clear push button to clear the list box labeled Network Address Pair
           List.

        5. Select the network address level of the address of the file server
           from the Network Address Level combination box. For example, if you
           are going to monitor a Novell NetWare file server, select IPX
           (Novell) from the combination box by clicking on the arrow, then
           selecting this item from the list.

        6. In the Dest edit field enter the network-level address of the file
           server that you want to monitor.

        7. Click on <Any xxxxx Station> in the Symbolic Names List. The symbol,
           xxxxx, will be different depending on what network address level is
           selected.

        8. Click on the From <- push button.

        9. Click on the Add push button.

       10. Click on the Switch push button. Click on the Add push button again.
           This swaps the source and destination addresses so you can monitor
           traffic in both directions between the file server and any other
           station on the network.

       11. Click on the OK push button.

 10. Before exiting the Configure Event Detector 1 window, let's save this
     event detector as a pre-configured event detector, so that in the future
     you will be able to load the event detector (by clicking the Load push
     button, instead of Configure) without having to go through specifying the
     addresses:

     a. Click on the Save As push button.

     b. The Save as Pre-Configured Event Detector window is displayed. Specify
        a filename (i.e. DEPTSRVR) in the Event detector filename edit field.

     c. Click on the OK push button.

 11. Click on the OK push button on the Configure Event Detector 1 window.

 12. Click on the OK push button on the Edit Equation Line window.

 13. Click on the OK push button on the Custom Events to Be Monitored window.

 14. Click on Go! in the DatagLANce Network Analyzer window menu bar.

     For an Ethernet network, continue with step 15.

     For a token-ring network, you should see a Verification window. If your
     token-ring is operating at the speed specified in the Verification window,
     click on the Yes push button. If your token-ring is not operating at the
     speed specified in the Verification window:

     a. Click on the No push button.

     b. Click on Monitor in the Token-Ring DatagLANce Network Analyzer window
        menu bar.

     c. Select the correct speed.

     d. Click on Go! in the Token-Ring DatagLANce Network Analyzer window menu
        bar again.

     e. Click on the Yes push button on the Verification window.

 15. The windows displayed on the screen will now start refreshing with
     statistics.

 16. Let us now create a custom window to display more information about the
     file server:

     a. Click on Window in the DatagLANce Network Analyzer window menu bar.

     b. Click on New Window.

     c. A window will be displayed in the upper left corner of the screen. You
        may change the size of this window to change the size of the font.

     d. Click on this window with mouse button 2.

     e. A pop-up menu will be displayed in the window. Click on Event.

     f. Click on Custom Event 3.

     g. The window now displays current statistics about your file server.

     h. Click on Format on the pop-up menu.

     i. Click on Bar (Cumulative).

     j. Click on Display on the pop-up menu.

     k. Click on Percent Frame Traffic. The window now displays the cumulative
        total percentage of total frame traffic going to or coming from the
        file server.

     l. Click on Display on the pop-up menu.

     m. Click on Set Axis Limits.

     n. The Set Axis Limits window will be displayed. Enter 100 in the Maximum
        edit field and 0 in the Minimum edit field.

     o. Click on OK. The window now displays cumulative total percentage of
        total frame traffic going to or coming from the file server on a bar
        graph that is scaled from 0 to 100 percent.

     p. Click on Format on the pop-up menu.

     q. Click on History. The window now displays the current percentage of
        total frame traffic going to or coming from the file server in history
        format.

     r. Experiment with the other options in the pop-up menu. To make the menu
        disappear, click anywhere outside of the pop-up menu.

 17. Close the All Frames Utilization window at the bottom left of the screen.
     To do this, double-click on the upper-left system menu push button of the
     window.

 18. Now move this newly created custom window into the position that the
     window you closed occupied.

 19. Click on Screen in the Token-Ring DatagLANce Network Analyzer window menu
     bar.

 20. Click on Define.

 21. The Define Screen window is displayed. Enter File Server Traffic into the
     Screen name edit field.

 22. Click on OK. The screen is now defined. You can display it whenever you
     desire by selecting File Server Traffic from the Screen menu. You can also
     display other screens by selecting them from that menu.

 23. Click on File in the Token-Ring DatagLANce Network Analyzer window menu
     bar.

 24. Click on Save Configuration.

 25. Enter MYSERVER in the Configuration pathname edit field or whatever
     descriptive name you choose.

 26. Click OK. The configuration will now save to disk. In the future you can
     load this configuration by selecting Load Configuration from the File
     menu.

 27. See Configurations for more information if you would like to create your
     own icon that automatically loads the MYSERVER configuration.

 This scenario is now complete. If you want, you can end the session or look at
 one of the other scenarios.


ΓòÉΓòÉΓòÉ 7. Monitoring the Network ΓòÉΓòÉΓòÉ

The performance of a network depends on many factors. Knowledge of traffic
load, throughput, and errors occurring on the network is invaluable in
fine-tuning a network as well as in planning network expansion. The DatagLANce
Network Analyzer gives you the capability to monitor these and other statistics
about your network.


ΓòÉΓòÉΓòÉ 7.1. Overview of DatagLANce Monitoring Capability ΓòÉΓòÉΓòÉ

With the DatagLANce Network Analyzer, you have the power to monitor your
network by:

 o Displaying current network status, including:

    - Current ring speed (token-ring) or which media is currently attached
      (Ethernet)

    - Current state of the network

    - Current and historical network events for the network

 o Displaying global current or cumulative network statistics, including:

    - Time stamps: cumulative monitor active time, cumulative network
      active/inactive time, and cumulative network up/down time (token-ring) or
      first/last network activity (Ethernet)

    - All frames statistics: total frames, total bytes, average frame length,
      average frame rate, average byte rate, and average utilization

    - Error statistics:

       o Token-Ring: soft errors, ring purges, beacon frames, and oversized
         frames

       o Ethernet: CRC/alignment errors, collisions, runt frames (frames
         smaller than Ethernet's 64-byte minimum frame size), and oversized
         frames

 o Accumulating cumulative statistics and current event statistics for the
   following:

    - All frames appearing on the network

    - Five user-selectable custom event frames

 o Creating up to 32 user-configurable windows to display event statistics in
   the following formats:

    - Current or cumulative numeric format: displays current or cumulative
      statistics such as frames, bytes, and rate information in tabular form.

    - Current or cumulative bar format: displays current or cumulative
      statistics such as frames, bytes, or rate information in a bar graph
      form.

    - History format: displays statistics such as frames, bytes, or rate of an
      event versus time.

 o Recording history statistics for long-term statistics accumulation to a file
   at intervals from 1 second to 5 minutes. This file can be recorded in binary
   format, text format, or comma-separated variable text format that can be
   imported into most spreadsheets.

 o Activating five-level floor alarms, ceiling alarms, or both for events such
   as network down time, CRC errors, and all frames utilization. Alarms are
   logged to a window that is color-coded for each priority and can optionally
   be logged to a file for a long-term alarm record.

 o Displaying, with the Network Glance function, a snapshop of traffic
   currently traveling on your network (or into your capture buffer) with full
   seven-layer protocol decodes for certain protocols.

 o Listing, with the Ring Map function (token-ring), an ordered list of the
   stations on your ring and indicating when stations become disconnected or
   when new stations insert onto the ring.

 o Monitoring and displaying various traffic statistics for the stations
   currently on your network using the traffic analysis options.

 o Printing reports on network activity such as cumulative network statistics
   and network utilization trends.

 Each of these functions is discussed in detail in the following sections.


ΓòÉΓòÉΓòÉ 7.2. Controlling the DatagLANce Network Analyzer ΓòÉΓòÉΓòÉ

The DatagLANce Network Analyzer is controlled mostly from a single window, the
DatagLANce Network Analyzer control window, shown in Figure "DatagLANce Network
Analyzer Control Window".


DatagLANce Network Analyzer Control Window

Each of the selections in the menu bar give access to the options windows that
allow configuration of the DatagLANce analyzer for any of the purposes for
which it was designed.

The DatagLANce analyzer starts monitoring the network when you select the Go!
option from the DatagLANce Network Analyzer control window. The Go! option is
then replaced by the Stop! option. You can select the Stop! option to stop the
active monitor.

When the DatagLANce analyzer is monitoring, you can display individual
statistics windows to show the statistics that have accumulated. To display
these statistics windows, select the desired window from the Window menu in the
DatagLANce Network Analyzer control window. The following sections discuss
these windows.

The Screen menu contains a list of arrangements of user-defined windows. This
menu makes it easy to move between different views of multiple windows.

When the monitor is started, all selected configuration options take effect.
Some options can be changed while monitoring; others can only be viewed.


ΓòÉΓòÉΓòÉ 7.2.1. Controlling the DatagLANce Network Analyzer by the Keyboard ΓòÉΓòÉΓòÉ

The following shortcut keys are available for use in the various DatagLANce
Network Analyzer applications:

 F1             Offers access to online help.

 F2             Mark a frame in the DatagLANce Protocol Analysis Application.

 F3             Invoke Protocol Analysis for capture (equivalent to clicking on
                "Analysis..." in the Capture Status/Control Window)

 F5             Configure the Capture Start Options (Capture must be enabled
                first).

 F6             Configure the Frame Capture Filter (Capture must be enabled
                first).

 F7             Analyzer Applications: Configure the Trigger/Stop Capture
                Options (Capture must be enabled first). Protocol Analysis:
                Move to the previous frame.

 F8             Analyzer Applications: Capture Control Key (equivalent to
                clicking on "New...", "Start" or "Stop" in the Capture
                Status/Control Window). Protocol Analysis: Move to the next
                frame.

 F9             Start/stop the monitor (equivalent to clicking on the "Go!" or
                "Stop!" menu items on the DatagLANce Network Analyzer Control
                Window).

 TAB            Moves among the Analyzer application windows displayed on the
                screen.

 Space          Displays popup menu on the Network Statistics and Event Windows
                (equivalent to clicking the right mouse button inside the
                window)

 In addition to these keys, others are available using Alt and Ctrl key
 functions. The Alt and Ctrl keys available are displayed next to their
 corresponding menu choices in drop-down menus.


ΓòÉΓòÉΓòÉ 7.3. Using the Monitor Menu ΓòÉΓòÉΓòÉ

The Monitor option of the DatagLANce Network Analyzer control window has a
number of choices that control the DatagLANce monitoring functions. The
Token-Ring DatagLANce menu is shown in Figure "Token-Ring DatagLANce Monitor
Menu", and the Ethernet DatagLANce menu is shown in Figure "Ethernet DatagLANce
Monitor Menu".


Token-Ring DatagLANce Monitor Menu

At the top of the Token-Ring Network Analyzer menu are two menu choices: 4 Mbps
and 16 Mbps. These choices allow selection of the ring speed for the token-ring
network.


Ethernet DatagLANce Monitor Menu

At the top of the Ethernet Network Analyzer Monitor menu are three menu
choices:

 o AUI (10BASE5) Connection
 o BNC (10BASE2) Connection
 o TPI (10BASE-T) Connection

 These menu choices allow selection of the media to which the DatagLANce
 analyzer will attach. Some of these menu choices might be grayed indicating
 that the selection does not apply for the Ethernet adapter being used. If all
 of these menu choices are grayed, the media connection for the Ethernet
 adapter being used is selectable only by the adapter (that is, either the
 adapter automatically senses the media connection, the DIP switches on the
 adapter card select the media connection, or the cable that is being used
 determines the media connection).

 The menu choices are described in the following information:

 Audible Clicks
      Selects whether to click the speaker when a frame arrives. This clicking
      sound can give an audible indication of the level of network traffic.

 Refresh Rate
      Selects the screen refresh rate. All current statistics throughout the
      DatagLANce analyzer are based on this refresh rate.

 Adapter Options
      Permits you to select adapter-specific options that can improve the
      performance of the DatagLANce analyzer as well as allow you to process
      only a subset of network traffic. These options are discussed in
      Improving Monitoring Performance: The Adapter Options.

 Custom Events
      Permits you to specify custom events that the DatagLANce analyzer should
      monitor on the network. See Selecting Custom Events to be Monitored for
      more information.

 History Statistics Options
      Permits you to select the history statistics interval and specify whether
      to record history statistics to a file. This topic is discussed in
      History Statistics: Network Statistics Versus Time.

 Alarm Options
      Permits you to specify various floor and ceiling alarm events at multiple
      priority levels and specify whether to log the alarms to a file. Alarms
      are discussed in Alarms: Keeping a Watchful Eye on Your Network.

 Traffic Analysis Options
      Permits you to enable and select which specific traffic analysis function
      will be performed to gather traffic statistics about the stations on your
      network and to select whether to write these statistics to a file for
      post-processing by another application. This is discussed in Figure
      "Traffic Statistics Window".

 Network Glance Filter
      Permits you to specify a subset of network traffic that you would like to
      watch. Network Glance is discussed in Figure "Network Glance Window".
      When the capture is enabled, this menu choice is labeled Glance Captured
      frames and permits you to glance at the frames that match the Frame
      Capture Filter. See Figure "Frame Capture Filter".

 Ring Map
      When the DatagLANce analyzer is not capturing frames, Ring Map permits
      you to use the ring map function of the DatagLANce analyzer instead of
      the filtered glance capability. This is discussed in Ring Map: A Logical
      Token-Ring Map.

 The Monitor menu of the DatagLANce Network Analyzer control window gives you
 access to all of the windows that configure the various monitoring options
 that the DatagLANce analyzer supports.


ΓòÉΓòÉΓòÉ 7.4. Using the Network Status Window to Monitor the Current State of the Network ΓòÉΓòÉΓòÉ

The Network Status window shows the current state of the network being
monitored. You can display this window by selecting Network Status from the
Window menu of the DatagLANce Network Analyzer control window. Figure
"Token-Ring Network Status Window" shows the Token-Ring Network Status window,
and Figure "Ethernet Network Status Window" shows the Ethernet Network Status
window.


Token-Ring Network Status Window


ΓòÉΓòÉΓòÉ 7.4.1. Token-Ring Network Status ΓòÉΓòÉΓòÉ

The top line of the window, Ring Speed, displays the current ring speed of the
network being monitored. This can read 4 Mbps or 16 Mbps. You can select the
ring speed from the Monitor menu of the Token-Ring DatagLANce Network Analyzer
control window.

The second line of the Token-Ring DatagLANce Network Status window, State,
displays the current state of the token-ring network. The following information
shows the states that can be displayed and an explanation of each:

 Monitor Stopped
      The DatagLANce analyzer is currently not monitoring; the network state is
      unknown.

 Operational
      The network is operational; frames are being seen by the DatagLANce
      analyzer.

 Network Inactive
      The network is up; no frames are being seen by the DatagLANce analyzer.

 Monitor Contention
      The network is currently in a monitor contention process; claim frames
      are being seen by the DatagLANce analyzer.

 Ring Beaconing
      The station upstream of the DatagLANce analyzer is beaconing; beacon
      frames are being seen by the DatagLANce analyzer.

 Adapter Beaconing
      The DatagLANce adapter is beaconing; the DatagLANce connection to the
      token-ring network should be checked.

 Lobe Wire Fault
      An open or short circuit has been detected, in the lobe data path, by the
      adapter.

 Signal Loss
      The network is down (or there are no stations on the network) or the
      DatagLANce adapter is not connected to the network (that is, if either
      the cable is not connected to the adapter or the cable is not connected
      to the network).

 Removed from Ring
      The DatagLANce analyzer has been removed from the ring because a remove
      frame has been received. This state will be shown only if you are using a
      Trace and Performance Adapter. DatagLANce Token-Ring Adapters will ignore
      remove frames.

 The Network Events indicators, at the bottom of the Token-Ring Network Status
 window, are colored red, blue, gray, or white to show the current and
 historical events for the network. Indicators for events that have not
 occurred are white. The indicators for current network events, current means
 occurring in the last second, change to blue for normal network events and
 change to red for network events of which you should be aware. The indicators
 for historical network events, events that occurred more than one second in
 the past, are gray.

 The Reset push button clears all network event indicators; only events that
 occur after you push this push button are displayed.

 The following list describes token-ring events:

 Frame Missed
      The DatagLANce analyzer was unable to process a frame. Statistics are not
      valid because of the missed frame. If the DatagLANce analyzer is
      capturing data, one or more frames were not recorded.

      Note:  The first time a frame is missed, the DatagLANce analyzer will
      notify you, with a pop-up window, that data is no longer valid and ask if
      you want to continue.

 Signal Loss
      The network is down, or there are no stations on the network. This state
      can also appear if the DatagLANce adapter is not connected to the network
      (that is, if either the cable is not connected to the adapter or the
      cable is not connected to the network).

 Soft Error
      The DatagLANce analyzer detects a media access control (MAC) soft-error
      report frame.

 Ring Purge
      The DatagLANce analyzer detects a MAC ring purge frame.

 Oversized
      The DatagLANce analyzer detects an oversized frame.

 Broadcast
      The DatagLANce analyzer detects a frame with a broadcast address.

 Multicast
      The DatagLANce analyzer detects a frame with a multicast address.

 Operational
      The DatagLANce analyzer detects a frame indicating the network is
      operational.

 Claim
      The network is going through the monitor contention process to select a
      new, active monitor.

 Beacon
      The network is beaconing.
 For a more detailed explanation of token-ring states and events, refer to the
 IBM Token-Ring Network Architecture Reference.


ΓòÉΓòÉΓòÉ 7.4.2. Ethernet Network Status ΓòÉΓòÉΓòÉ


Ethernet Network Status Window

The top line of the Ethernet DatagLANce Network Status window, Connection,
displays the current media connection to the Ethernet network being monitored.
This connection can be:  AUI (10BASE5), BNC (10BASE2), TPI (10BASE-T), or
Adapter Specific. Adapter Specific means that the adapter selects the media
connection. The DatagLANce software has no control over, or cannot determine,
the media connection. You can select the media connection from the Monitor
pull-down menu of the Ethernet DatagLANce Network Analyzer control window.

The second line of the Ethernet DatagLANce Network Status window, State,
displays the current state of the Ethernet network. The following information
shows the states that can be displayed and an explanation of each:

 Monitor Stopped
      The DatagLANce analyzer is currently not monitoring; the network state is
      unknown.

 Operational
      The DatagLANce analyzer detects frames.

 Network Inactive
      The DatagLANce analyzer does not detect any frames.

 The Network Events indicators, at the bottom of the Ethernet Network Status
 window, are colored red, blue, gray, or white to show the current and
 historical events for the network. Indicators for events that have not
 occurred are white. The indicators for current network events, current means
 occurring in the last second, change to blue for normal network events and
 change to red for network events of which you should be aware. The indicators
 for historical network events, events that occurred more than one second in
 the past, are gray.

 The Reset push button clears all network event indicators; only events that
 occur after you press the push button are displayed.

 The following list describes Ethernet events:

 Frame Missed
      The DatagLANce analyzer was unable to process a frame. Statistics are not
      valid because of the missed frame. If the DatagLANce analyzer is
      capturing data, one or more frames were not recorded.

      Note:  The first time a frame is missed, the DatagLANce analyzer will
      notify you with a pop-up window, that data is no longer valid and ask if
      you want to continue.

 CRC Error
      The DatagLANce analyzer detects a frame with a cyclic redundancy check
      (CRC) error.

 Align Error
      The DatagLANce analyzer detects a frame with an alignment error,

 Runt
      The DatagLANce analyzer detects a runt frame.

 Oversized
      The DatagLANce analyzer detects an oversized frame.

 Broadcast
      The DatagLANce analyzer detects a frame with a broadcast address.

 Multicast
      The DatagLANce analyzer detects a frame with a multicast address.

 Operational
      The DatagLANce analyzer detects a valid frame.

 Collision
      The DatagLANce analyzer detects a collision fragment indicating that a
      collision has occurred.

      Note:  This is an estimate of the actual number of collisions. Collisions
      that occur during the preamble of a frame and collision fragments that
      are less than the minimum frame size accepted by the adapter are not
      counted.

 Jabber
      The DatagLANce analyzer detects a jabber frame, a collision at the end of
      a large frame.


ΓòÉΓòÉΓòÉ 7.5. Network Statistics: Network Performance at A Glance ΓòÉΓòÉΓòÉ

The Network Statistics window contains general statistics about the network.
This window can be displayed by selecting Network Statistics in the Window menu
of the DatagLANce Network Analyzer control window. Figure "Token-Ring Network
Statistics Window" shows the Token-Ring Network Statistics window, Figure
"Ethernet Network Statistics Window" shows the Ethernet Network Statistics
window.


Token-Ring Network Statistics Window


Ethernet Network Statistics Window

The Network Statistics window is divided into three groups of information:
Timestamps, Traffic Statistics, and Error Counts.


ΓòÉΓòÉΓòÉ 7.5.1. Time-stamps ΓòÉΓòÉΓòÉ

The Time-stamps group displays the following time-stamp information about the
network:

 Current Time
      The date and time supplied by OS/2. The time is updated only when the
      DatagLANce analyzer is monitoring.

 Monitor Active
      The cumulative time that the DatagLANce analyzer has been monitoring.

 Network Active
      An approximation of how much time the network has been active, while it
      has been operational.

 Network Inactive
      An approximation of how much time the network has been idle, while it has
      been operational.

 Network Up (token-ring only)
      An approximation of how much time the token-ring network, to which the
      DatagLANce analyzer is attached, has been operational.

 Network Down (token-ring only)
      An approximation of how much time the token-ring network, to which the
      DatagLANce analyzer is attached, was not operational (for example:
      signal loss, beaconing).

 First Activity (Ethernet only)
      The time the first frame was seen on the Ethernet network.

 Last Activity (Ethernet only)
      The time the last frame was seen on the Ethernet network.


ΓòÉΓòÉΓòÉ 7.5.2. Global Statistics ΓòÉΓòÉΓòÉ

The Global Statistics group displays information about all frames that have
been seen by the DatagLANce analyzer. This information is available in current
or cumulative form. Current Traffic Statistics are statistics accumulated since
the last screen refresh. Cumulative Traffic Statistics are statistics
accumulated since the monitor was started.

Current or Cumulative statistics can be selected by clicking anywhere on the
Network Statistics window with mouse button 2. As shown in Figure "Token-Ring
Network Statistics Window: Selection of Current or Cumulative Statistics", a
menu is displayed that permits you to select either mode with mouse button 1.


Token-Ring Network Statistics Window: Selection of Current or Cumulative Statistics

The following list describes statistics displayed in the Traffic Statistics
group:

 Total Frames
      The count of all frames processed during the previous screen refresh
      interval (current statistics) or since Monitor Active (cumulative
      statistics).

 Total Bytes
      The count of all bytes in total frames. For a token-ring frame, the start
      delimiter, end delimiter, frame status, and frame check sequence bytes,
      as well as the bytes in the frame, are included in the count; this better
      represents network utilization. For Ethernet, this count includes the
      frame check sequence in addition to the bytes of the frame, but the
      preamble or start delimiter fields are not counted, because some of the
      preamble can be lost as the frame travels through the network.

 Avg Frame Length
      The total bytes divided by total frames results in the average length of
      total frames.

 Avg Frame Rate
      The average number of frames processed per second. For current
      statistics, this is total frames divided by the screen refresh interval.
      The total frames divided by Monitor Active time results in the cumulative
      statistics.

 Avg Byte Rate
      The average number of bytes processed per second. The total bytes divided
      by the screen refresh interval results in the current statistics. The
      total bytes divided by Monitor Active time results in cumulative
      statistics.

 Avg Utilization
      The average percentage of maximum theoretical bandwidth of the network
      that has been utilized by all frames. This value is computed by dividing
      the value in Avg Byte Rate by the network speed.


ΓòÉΓòÉΓòÉ 7.5.3. Error Counts ΓòÉΓòÉΓòÉ

The Error Counts group displays counts of network errors that are monitored by
the DatagLANce analyzer. Depending on whether cumulative or current statistics
have been selected (see Global Statistics), this will be either Cumulative
Error Counts or Current Error Counts. Cumulative Error Counts are error counts
accumulated since the monitor was started. Current Error Counts are error
counts accumulated since the last screen refresh.


ΓòÉΓòÉΓòÉ 7.5.3.1. Error Counts for the Token-Ring DatagLANce Analyzer: ΓòÉΓòÉΓòÉ

 Soft Errors
      A count of all soft errors that have been reported in MAC soft error
      report frames.

 Ring Purges
      A count of all MAC ring purge frames that were monitored by the
      DatagLANce analyzer.

 Beacon frames
      A count of all beacon frames that were monitored by the DatagLANce
      analyzer.

 Oversized Frames
      A count of all oversized frames that were monitored by the DatagLANce
      analyzer.


ΓòÉΓòÉΓòÉ 7.5.3.2. Error Counts for the Ethernet DatagLANce analyzer: ΓòÉΓòÉΓòÉ

 CRC/Alignment Errors
      A count of all frames monitored by the DatagLANce analyzer that contained
      either a CRC error or an alignment error (see Figure "Ethernet Network
      Statistics Window").

 Collisions
      A count of all collision fragments and jabbers (late collisions)
      monitored by the DatagLANce analyzer.

      Note:  The count of collision fragments is an estimate of the actual
      number. Collisions that occur during the preamble of a frame and
      collision fragments that are less than the minimum frame size accepted by
      the adapter are not counted.

 Runt frames
      A count of all runt frames monitored by the DatagLANce analyzer.

 Oversized Frames
      A count of all oversized frames monitored by the DatagLANce analyzer.

 The Network Statistics window gives general information about the network's
 performance including active and inactive time, traffic utilization, traffic
 rate, and error information. Sometimes more specific information is needed
 about certain conditions that occur on the network. The next section describes
 how to select and monitor these conditions.


ΓòÉΓòÉΓòÉ 7.6. Monitoring Events on the Network ΓòÉΓòÉΓòÉ

Although the Network Status and Network Statistics windows offer a good summary
of network operations, they are limited. For example, what if you need
statistics for specific events occurring on the network? The DatagLANce
analyzer enables you to accumulate statistics for five custom events. Each
custom event is specified by writing equations using the output of the
DatagLANce event detectors. Before describing how to use the event detectors,
it is important to understand the meaning of an event.


ΓòÉΓòÉΓòÉ 7.6.1. Understanding Events ΓòÉΓòÉΓòÉ

The DatagLANce Network Analyzer considers an event to be a frame that matches a
set of criteria. The criteria might specify that the frame be a MAC frame
(token-ring), IEEE 802.3 frame (Ethernet), a frame containing an SNA
transmission header, or any other set of criteria. An event detector is a
module within the DatagLANce software that identifies an event.

The DatagLANce Network Analyzer has eight event detectors that can identify
eight separate events in each frame that it sees. The following information
describes the types of events that each event detector can be configured to
identify:

 Frame Format/Protocols
      Frame formats (network specific) and various protocol headers that can be
      displayed in a frame (BPDU, SNA, SNAP, ARP, IP, TCP, ICMP).

 DLC Destination Addresses
      A frame's destination address. Each event detector can match up to 25
      individually-specified addresses or address masks.

 DLC Source Addresses
      A frame's source address. Each event detector can match up to 25
      individually specified addresses or address masks.

 DLC Address Pairs
      A frame's destination and source addresses. Each event detector can match
      up to 11 individually specified addresses or address mask pairs.

 Network Address Pairs
      A frame's destination and source network addresses. Each event detector
      can match up to 2 individually specified network addresses or network
      address mask pairs for various network layer protocols.

 Frame Data Pattern
      A specific string of characters within a frame.

 Source Routing Indicators
      A frame with specific routing broadcast types, source route length,
      source ring and destination ring numbers.

 MAC Frame (Token-Ring)
      A MAC frame that has a specific destination and source address and a data
      pattern within the MAC information field.

 LLC/IEEE 802.3 Frame
      An LLC frame (Token-Ring) or IEEE 802.3 Frame (Ethernet) that has a
      specific destination and source address and either specific LLC Protocol
      Data Unit fields or a data pattern within the LLC information field.

 Ethernet Frame (Ethernet)
      A frame that has a specific destination and source address an Ethernet
      type, and a data pattern within the information field.

 For information on configuring event detectors. see Configuring Event
 Detectors.


ΓòÉΓòÉΓòÉ 7.6.2. Selecting Custom Events to be Monitored ΓòÉΓòÉΓòÉ

Understanding Events described how the DatagLANce analyzer can accumulate
statistics for five custom events. These custom event statistics supplement the
statistics continuously accumulated for all frames. This section describes how
to specify the five custom events.

Figure "Custom Events to be Monitored Window" shows the Custom Events to be
Monitored window. This window is displayed when the Custom Events choice is
selected from the Monitor menu in the DatagLANce Network Analyzer control
window.


Custom Events to be Monitored Window

The Custom Events list box is used to select the custom event (1-5) to be
configured. Figure 23 shows that custom event 3 is being configured.

The Custom Event label field contains the name you assigned to the custom
event. Because this label is displayed with all references to this event that
are in other windows, a descriptive label is recommended. The sample label
displayed in Figure "Custom Events to be Monitored Window" is Traffic To/From
File Server.

The Count a Frame list box contains the equation that describes this custom
event. The label indicates that any frame that passes the equation in the list
box will be included in the count of frames for this custom event. Details
about using equations are discussed in the next section.

When you click on the OK push button, the definition of all custom events to be
monitored will be accepted. When the DatagLANce analyzer is started, it will
begin to monitor the specified custom events.


ΓòÉΓòÉΓòÉ 7.6.3. Understanding Event Equations ΓòÉΓòÉΓòÉ

An event equation combines the binary results from one or more event detectors
on a frame-by-frame basis to produce a TRUE or FALSE result (see Understanding
Events). Event equations are used throughout the DatagLANce software to specify
events to be monitored, events to be captured, and events to be displayed after
a capture has been performed.

Event equations are always displayed in list-box form as shown in the sample
equation in Figure "Custom Events to be Monitored Window". This sample equation
reads:

IF To/From: File Server

A frame passes this equation if the destination or source address matches that
of the file server. The result (for the Custom Events to be Monitored) is a
counting of all frames to and from the station file server that is being
monitored by the DatagLANce analyzer.

The actual detection of the destination, or source addresses matching the File
Server's address, is done by an event detector whose label is: Dest/Source:
File Server. For more information on configuring event detectors, see
Configuring Event Detectors.


ΓòÉΓòÉΓòÉ 7.6.4. Defining and Modifying Event Equations ΓòÉΓòÉΓòÉ

Use the push buttons, which are next to an equation list box (see Figure
"Custom Events to be Monitored Window"), to edit an event equation. You can
perform the following tasks:

 Edit      Permits the current line to be edited.

 OR        Adds another line to the equation. Clicking on this button will
           create a new line that can be edited and added to the equation.

           All lines in an equation are ORed together in determining whether
           the equation has a TRUE or FALSE result. If any line in an equation
           is TRUE, the result is TRUE.

 Delete    Deletes the current line in the equation.

 Clear     Clears the equation to the following setting:

                      IF ANY COMBINATION OF EVENTS

           This sets the equation to TRUE for every frame. After the equation
           has been cleared, the Edit push button can be used to identify
           desired events.


ΓòÉΓòÉΓòÉ 7.6.5. Editing an Event Equation ΓòÉΓòÉΓòÉ

If you click on the Edit push button in this window, the Edit Equation Line
window is displayed. (See Figure "Token-Ring DatagLANce Edit Equation Line
Window" or Figure "Ethernet DatagLANce Edit Equation Line Window".)


Token-Ring DatagLANce Edit Equation Line Window

Use this window to combine logically different event detectors, frame status
indicators, and special network events which the DatagLANce analyzer
identifies.

The first and third column of buttons on this window are logic toggle switches.
These buttons are toggled among three states: blank, IF, and IF NOT. The blank
state indicates that the event detector should not appear in the equation line.
IF (or AND if not first in the list) indicates that the event detector should
identify the frame being examined (in other words, the event should occur). IF
NOT (or AND NOT if not first in the list) indicates that the event detector
should not identify the frame being examined (in other words, the event should
not occur). AND and AND NOT may also be displayed if you choose more than 1
condition.  AND and AND NOT mean the same as IF and IF NOT.

Note:  If you need to use OR logic for your equation, you will need to add an
additional line (see Defining and Modifying Event Equations).

In the upper right quadrant of this window are the following frame status
indicators:

 Address Recognized The A frame status indicator at the end of a frame

 Frame Copied The C frame status indicator at the end of a frame

 The Address Recognized and Frame Copied indicators appear at the end of each
 frame. The IF NOT logic toggle switch state corresponds to the indicator being
 reset, and the IF logic toggle switch state corresponds to the indicator being
 set.


  Ethernet DatagLANce Edit Equation Line Window

 For Ethernet, the upper right quadrant of this window contains the following
 receive status state indicators:

 CRC Error
      A frame containing a CRC error

 Frame Alignment Error
      A frame containing a frame alignment error

 The two lines below the status indicators of text on the Edit Equation contain
 the following destination-address class items:

 Broadcast Frame
      A frame that has a broadcast address

 Multicast Frame
      A frame that has a multicast address

 Beneath these indicators is a list box that permits one item to be selected.
 The items in this list are special network events that are identified by the
 DatagLANce analyzer. These special network events are described in the
 following list:

 Any Special Event
      Any of the special events listed here

 Soft Error Report (token-ring only)
      A MAC soft error report frame

 Ring Purge (token-ring only)
      A MAC ring purge frame

 Claim Frame (token-ring only)
      A MAC claim Frame

 Beacon Frame (token-ring only)
      A MAC beacon frame

 Oversized Frame (Both token-ring and Ethernet)
      A frame that is larger than the network's allowed maximum size

 Runt frame (Ethernet only)
      A frame that is smaller than Ethernet's allowed 64-byte minimum size

 Collision (Ethernet only)
      A collision fragment that is the remnants of a frame due to a collision

 Jabber (Ethernet only)
      A jabber frame

 These special network events are identified by the DatagLANce analyzer to
 permit the 8 event detectors to be used for more productive purposes.

 The second column from the left in the Edit Equation Line window is a series
 of 8 buttons.  Each button has a label. These 8 buttons represent the 8 event
 detectors discussed earlier. An event detector is configured by clicking on
 its button. The topic of configuring an event detector is discussed in the
 next section.

 Clicking on the Clear radio button displayed in Figure "Token-Ring DatagLANce
 Edit Equation Line Window" causes all of the IF or IF NOT terms in the
 equation to return to blank. The following label will be displayed next to the
 Clear radio button:

  IF ANY COMBINATION OF EVENTS
 This label means that, regardless of whether any term is TRUE or FALSE, the
 equation line result will be TRUE. After a term is added to the equation, the
 radio button label returns to Clear.


ΓòÉΓòÉΓòÉ 7.7. Configuring Event Detectors ΓòÉΓòÉΓòÉ

To configure an event detector, click on any of the 8 event-detector buttons
shown in Figure "Token-Ring DatagLANce Edit Equation Line Window". The window
in Figure "Configure Event Detector Window" will be displayed.


Configure Event Detector Window

The Label field is displayed at the top of this window. Enter the descriptive
name that you want to be displayed on the event-detector button. A simple label
might be Destination: File Server for an event detector identifying a frame
whose destination is station File Server. A more complex label might be:

File Server <-> WkStat #2
for an event detector identifying traffic between station File Server and
station WkStation #2. An event detector that identifies any frame coming from a
group of source addresses might be labeled Source: WkStation Group. In the
example shown in Figure "Configure Event Detector Window", the label is TCP/IP
Frame.

The Event combination box contains the type of event identified by this event
detector. For unconfigured or disabled event detectors, the Event list box is
labeled Disabled. In the following sections, we will discuss in depth the
options for configuring event detectors. In the example shown in Figure
"Configure Event Detector Window", the event identified is Frame
Format/Protocols.

The Configure push button is used to configure the event detector with the
event type selected. The Cancel push button is used to cancel the configuration
of an event detector.

When you click on the Configure push button, an options window specific to the
event type selected is displayed. The options contained in each of these
windows are described in the following sections.

Instead of manually configuring an event detector, you also have the option of
loading a pre-configured event detector. The Load push button activates this
function. When you click on this button the window in Figure "Pre-Configured
Event Detectors window" will be displayed.


Pre-Configured Event Detectors window

The Sort by group box allows you to sort the available event detectors by file
name or by the label of the event detector. By selecting an event detector
listed in the list box labeled Pre-Configured Event Detector List and clicking
on the Load Selected push button, a pre-configured event detector can be
loaded.

The Save As push button on the Configure Event Detector window allows you to
save any configured event detector that you customize as a pre-configured event
detector.


ΓòÉΓòÉΓòÉ 7.7.1. Frame Format/Protocols Event Detector ΓòÉΓòÉΓòÉ

A Frame Format/Protocols Event Detector identifies frames with specific types
of frame formats or protocol headers, or both, within the frame. Up to 48
different frame formats and protocol headers (at multiple layers of the
protocol stack) within a frame can be identified by one event detector.

Figure "Frame Format/Protocols Event Detector Options" shows the window that is
displayed when you select the Frame Format/Protocols configuration option.


Frame Format/Protocols Event Detector Options

The list box labeled Frame Format/Protocol List contains the names of all frame
format and protocol headers selected for identification by this event detector.
The push buttons to the right of this list box remove individual entries
(Delete button) or all entries (Clear button).

Beneath the Frame Format/Protocol list box is a series of combination boxes,
edit fields, and push buttons that can be used to select format/protocols to be
added to the list box.

The Level combination box, on the left side of the window, permits a particular
protocol stack level to be selected to which a format or protocol can be added.
You can select from the following list of levels:

 Any           Permits selection of major protocols without regard to protocol
               stack level. That is, the answer to the following question is
               not needed: Is the Banyan VINES protocol on this network SAP,
               SNAP, or IP encapsulated?.

 DLC           Data Link Control Layer, identifies network-specific frame
               formats.

 LLC           IEEE 802.2, Logical Link Control Protocol Data Unit Header,
               identifies frame protocols containing specific Destination or
               Source Link Service Access Points (LSAPs). It permits selection
               of different LSAPs or specification of a custom LSAP value in
               hexadecimal.

 SNA           IBM Systems Network Architecture Transmission Header relates to
               protocols with specific SNA transmission header types or
               request-and-response unit command categories.

 SNAP/Etype    SubNetwork Access Protocol Header for token-ring or Ethertype
               for Ethernet, selects frame protocols containing specific
               Ethernet type numbers. It permits selection of specific Ethernet
               types or specification of a custom Ethernet type value in
               hexadecimal.

 IP            Internet Protocol Header contains IP datagrams, Stream
               datagrams, or specific protocol headers that follow IP headers,
               such as those for ICMP, TCP, and UDP. You can select internet
               protocols from a list or by specifying a decimal number for a
               custom internet protocol.

               Note:  IP Datagrams and IP-encapsulated protocols are assumed
               not to be encapsulated with Berkeley Trailers. If they are on
               the network being analyzed, use the SNAP/Etype-level Berkeley
               Trailers Protocols.

 After the protocol level has been chosen, the Format/Protocol Select
 combination box will be filled with a list of protocol-layer specific formats
 or protocols that can be selected. The Add Selected push button places the
 format or protocol selected from the Format/Protocol Select combination box
 into the Frame Format/Protocol List box. If custom format or protocol input is
 supported for the selected protocol level, the Add Custom push button will add
 whatever custom format or protocol has been entered in the Custom Edit field.
 This field will have a different name depending on the protocol level
 selected. For example, the Custom Edit field in Figure "Frame Format/Protocols
 Event Detector Options" is named Custom IP Protocol Edit.

 When you click on the OK push button, the event detector is configured to
 identify all frames containing any of the frame formats or protocols in the
 Frame Format/Protocol List.


ΓòÉΓòÉΓòÉ 7.7.2. DLC Destination Addresses Event Detector ΓòÉΓòÉΓòÉ

A DLC Destination Addresses event detector identifies frames with specific DLC
destination addresses. Up to 25 individual DLC destination address masks can be
contained in a single event detector.

Figure "Destination Addresses Event Detector Options" shows the options window
that is displayed when you select the DLC Destination Addresses Event Detector
configuration option.


Destination Addresses Event Detector Options

The list box labeled Destination Address List displays each frame destination
address selected for this event detector. Addresses are added to this list box
by entering each address in the Address Mask Edit field and clicking on the Add
push button. Addresses can also be deleted from this list (Delete), or the
entire list can be cleared by clicking on the Clear push button.

Addresses entered in the Address Mask Edit field can contain hexadecimal
values, as well as wildcard characters (Xs) where the particular bits in the
address are unimportant. The address can be entered in MSB or canonical form
(LSB) using colons or hyphens to indicate these forms. For example,
10:00:5A:B8:99:11 and 10:00:5A:XX:XX:XX are valid MSB address masks.
Represented in canonical form, these addresses would be 08-00-5A-1D-99-88 and
08-00-5A-XX-XX-XX. You can also enter an address without the colons or hyphens,
and the DatagLANce analyzer will assume that the default address representation
is being used. See Figure "User Preferences Window" for more information.

The Symbolic Names List contains either adapter manufacturer IDs or symbolic
station names. These names can be used to add addresses to the Destination
Address List. By simply selecting either manufacturer IDs or symbolic station
names using the Manuf ID or Stations radio buttons, you can click on a Station
Name or Manuf ID in the Symbolic Names List, and its corresponding address will
be displayed in the Address Mask Edit field. The Edit push button permits you
to edit this list. For more information about symbolic names, see Symbolic
Names Support.

The Hexadecimal and Symbolic Names radio buttons below the list box labeled
Destination Address List enable you to display addresses in hexadecimal or
symbolic form in the list box.

When you click on the OK push button, the event detector is configured to
identify a frame containing any of the destination addresses in the Destination
Address List.


ΓòÉΓòÉΓòÉ 7.7.3. DLC Source Addresses Event Detector ΓòÉΓòÉΓòÉ

Like a DLC Destination Addresses Event Detector, the DLC Source Addresses Event
Detector identifies frames with specific source addresses. Up to 25 individual
source DLC address masks can be contained in a single event detector.

Figure "DLC Source Addresses Event Detector Options" illustrates the window
that is displayed when you select the DLC Source Addresses Event Detector
configuration option.


DLC Source Addresses Event Detector Options

The push buttons in this window work the same as those in the DLC Destination
Addresses Event Detector Options window. See Figure "Destination Addresses
Event Detector Options" for a description of the operation of that window.

When you click on the OK push button, the event detector is configured to
identify a frame containing any of the source addresses in the Source Address
List.


ΓòÉΓòÉΓòÉ 7.7.4. DLC Address Pairs Event Detector ΓòÉΓòÉΓòÉ

Although DLC Addresses Event Detectors identify either destination or source,
the DLC Address Pairs Event Detectors identify frames that match destination
and source DLC address masks. A single-event detector can contain up to 11
destination and source DLC address pairs.

Figure "Destination/Source Address Pairs Event Detector Options" shows the
window that is displayed when you select the DLC Address Pairs Event Detector
configuration option.


Destination/Source Address Pairs Event Detector Options

Most push buttons in this window function in the same way as those in the DLC
Destination Addresses Event Detector Options window (see Figure "Destination
Addresses Event Detector Options"); however, there are a few additional
buttons.

In the top left of this window are the Dest and Source address edit fields;
these are the addresses that will be added to the Address Pair List when you
press the Add button. These addresses can be entered directly in the fields or
edited in the Address Mask Edit field and transferred by using the To <- and
From <- push buttons.

The Switch push button exchanges the contents of the Dest and Source address
fields to aid in adding pairs of stations that are communicating with one
another. (The address that was the source address replaces the destination
address, and the address that was the destination address becomes the source
address.)

The Address Pair List contains all of the address pairs that this event
detector will detect. They are displayed in the following form:

destination address<-source address

When you click on the OK push button, the event detector is configured to
identify a frame containing any of the destination and source address pairs in
the Address Pair List.


ΓòÉΓòÉΓòÉ 7.7.5. Network Address Pairs Event Detector ΓòÉΓòÉΓòÉ

A Network Address Pairs Event Detector identifies frames containing specific
network layer addresses or address masks. Network layer addresses are addresses
with a specific network layer protocol such as IP and IPX**. Up to 2 individual
network address pairs can be contained in a single event detector, allowing you
the ability to filter on traffic between two network stations.

Figure "Network Address Pairs Event Detector Options" displays the options
window that appears when you select the Network Address Pairs configuration
option.


Network Address Pairs Event Detector Options

The Address Level combination box selects the level of addresses that will be
entered into the list box entitled Network Address Pair List. The address
levels within the combination box are described in Symbolic Names Support.

The remainder of push buttons in this window function in the same way as those
on the DLC Address Pairs Event Detector Options window (see Figure
"Destination/Source Address Pairs Event Detector Options").


ΓòÉΓòÉΓòÉ 7.7.6. Frame Data Pattern Event Detector ΓòÉΓòÉΓòÉ

A Frame Data Pattern Event Detector identifies frames containing specific data
patterns. A data pattern can represent up to 32 sequential bytes of data and
can be specified in binary, hexadecimal, ASCII, or EBCDIC form.

Figure "Frame Data Pattern Event Detector Options" shows the options window
that is displayed when you select the Frame Data Pattern Event Detector
configuration option.


Frame Data Pattern Event Detector Options

The radio buttons in the Pattern is group box select the starting point for the
data pattern search. Frame-relative means that the search will start at the
beginning of the frame, and the pattern can include part of the frame control,
destination, and source addresses. InfoField-relative means that the search
will start at the beginning of the information field of the frame, and Source
Routing indicators will be skipped.

The radio buttons in the Type of Search group box select the portion of the
frame that will be searched. A fixed offset search looks only for a pattern
located a specific number of bytes from the search start position. A sliding
search looks for the pattern anywhere after the search start position. If the
From check box is selected, the sliding search will be limited to the range
specified in the From and to edit fields.

The Pattern group box located below the Type of Search group box displays the
search pattern and contains a View/Edit push button to reveal the entire
pattern.

The example in Figure "Frame Data Pattern Event Detector Options" shows the
search pattern 10005A. This search will occur throughout each monitored frame.

Pressing the View/Edit push button will cause the window shown in Figure
"Hexadecimal Pattern Edit" to be displayed.


Hexadecimal Pattern Edit

The pattern is entered in the field within the Pattern Edit group box. By
selecting one of the formats in the Pattern Format group box, you can enter the
pattern in binary, hexadecimal, ASCII, or EBCDIC form. When you select a
different format, the window's appearance and data pattern change to the new
format.

Figure "Binary Pattern Edit" shows the same pattern as Figure "Hexadecimal
Pattern Edit" but in binary format.


Binary Pattern Edit

As shown, the binary format window permits entry of a full 32-byte (256-bit)
pattern.

The two remaining supported formats are ASCII and EBCDIC. Figure "ASCII Pattern
Edit" shows the ASCII format window.


ASCII Pattern Edit

The EBCDIC format window is similar to this window. In either format, any
unprintable characters are displayed as upside-down question marks.

Note:  A keyboard combination of Ctrl-? permits wildcard characters to be added
to ASCII and EBCDIC format patterns. For the binary and hexadecimal formats, an
X represents a wildcard character. However, wildcard characters can be used
only in fixed offset patterns.

All four formats can be used to enter a single pattern. You can switch formats
at any time, and the existing pattern will be translated into the new format.
This permits maximum flexibility and power in specifying your patterns.

When you click on the OK push button, the window accepts changes to the pattern
and returns to the Frame Data Pattern Event Detector Options window.


ΓòÉΓòÉΓòÉ 7.7.7. Source Routing Indicators Event Detector ΓòÉΓòÉΓòÉ

A Source Routing Indicators Event Detector identifies frames with specific
source routing information within the frame.

Figure "Source Routing Indicators Event Detector Options" shows the window that
appears when you select the Source Routing Indicators configuration option.


Source Routing Indicators Event Detector Options

The Routing Type group allows you to select whether to identify frames
containing non-broadcast, single-route broadcast, or all-routes broadcast
routing fields.

The Routing Length combination box allows you to specify the length of the
routing field.  Any ignores the routing length when identifying source routing
indicators.

The Dest and Source Ring Masks allow you to specify the destination and source
rings of the frame. An X can be used as a wildcard in specifying the ring mask.

When you click on the OK push button, the event detector is configured to
identify all frames containing the source routing indicators specified.


ΓòÉΓòÉΓòÉ 7.7.8. MAC Frame Event Detector ΓòÉΓòÉΓòÉ

The MAC Frame Event Detector (Token-Ring DatagLANce Network Analyzer) combines
the Frame Format/Protocols, DLC Address Pairs, and Frame Data Pattern Event
Detectors into one event detector that can detect all 3 of these events. This
allows for optimum event detector utilization that without the combined format
might require as many as three event detectors to identify an event.

Figure "MAC Frame Event Detector Options" shows the window that is displayed
when you select the MAC Frame Event Detector configuration option.


MAC Frame Event Detector Options

The Frame Control group box contains 6 checkboxes: Beacon, Claim, Ring Purge,
AMP (Active Monitor Present), SMP (Standby Monitor Present), and Other. This
Event Detector identifies a MAC frame if its frame control field matches any
one of the frame controls that are checked.

The Frame Addresses group box permits the destination and source address masks
for the frame to be specified. The Hex and Name radio buttons allow the
addresses to be displayed in either hexadecimal or symbolic name formats
respectively. The Edit pushbutton in this group permits the addresses to be
edited. Pressing this button will cause the panel in Figure "Frame Address Edit
Window" to be displayed.


Frame Address Edit Window

This window permits the destination and source addresses of the frame to be
edited in a fashion similar to the DLC Address Pairs Event Detector (see Figure
"Destination/Source Address Pairs Event Detector Options").

Back to the MAC Frame Event Detector Options, the InfoField Pattern permits
specification of a sliding search or fixed offset data pattern that is to
appear within the MAC Frame information field. Editing of this pattern is
similar to the Frame Data Pattern Event Detector (see Figure "Frame Data
Pattern Event Detector Options").

When OK is pressed, the event detector is configured to identify a MAC frame of
the types checked, matching also the destination and source address masks
specified, and containing the InfoField Pattern if one is specified.


ΓòÉΓòÉΓòÉ 7.7.9. LLC/IEEE 802.3 Frame Event Detector ΓòÉΓòÉΓòÉ

The LLC Frame Event Detector (Token-Ring DatagLANce Network Analyzer) and the
IEEE 802.3 Frame Event Detector (Ethernet DatagLANce Network Analyzer) also
combines the Frame Format/Protocols, Destination/Source Address Pairs, and
Frame Data Pattern Event Detectors into one event detector that can detect all
3 of these events.

Figure "LLC/IEEE 802.3 Frame Event Detector Options" shows the window that is
displayed when you select the LLC/IEEE 802.3 Frame Event Detector configuration
option.


LLC/IEEE 802.3 Frame Event Detector Options

The Frame Addresses group box allow the destination and source address masks
for the frame to be specified. Editing these addresses is discussed in MAC
Frame Event Detector.

The Source Routing Information group box permits selection of whether the
LLC/IEEE 802.3 frame has source routing indicators. This can be specified by
selecting one of the No-Routing, Has-Routing, or Either radio buttons.

By selecting Sliding search or Fixed offset, you activate data pattern
searching within the LLC information field. This information field includes the
LLC protocol data unit (LPDU) header. Editing of this pattern is discussed in
Figure "Frame Data Pattern Event Detector Options".

To identify information within the LPDU header within an LLC/IEEE 802.3 frame,
select Match LPDU Fields to activate the search. The specifics of the LPDU
fields search can be specified by clicking on the LPDU Fields button,
displaying the window in Figure "LLC Protocol Data Unit Fields Options".


LLC Protocol Data Unit Fields Options

This panel permits specification of the LPDU header fields of the LLC/IEEE
802.3 frame to be identified.

The Service Access Points (SAP) group box permits specification of Destination
and Source SAP masks within the LPDU. These masks can be specified in either
binary or hexadecimal by selecting the appropriate radio button.

Command and Response LPDUs can be identified by selecting the appropriate radio
button in the Command/Response group box.

The status of the Poll/Final bit in the various LPDU command formats of the
LPDU can be specified by selecting the appropriate radio button in the
Poll/Final Bit group box.

The remainder of the buttons on the panel are check boxes that allow selection
of the various LPDU formats that an LLC/IEEE 802.3 frame can contain. The event
detector will identify an LLC/IEEE 802.3 frame that contains any of these
chosen formats. If the Information Transfer Format check box is selected, all
I-Format LPDUs will be identified. If the Unnumbered Format check box is
selected, all checked U-Format LPDUs in the box beneath this button will be
identified. If the Supervisory Format check box is selected, all checked
S-Format LPDUs in the box beneath this button will be identified.

When the OK pushbutton is pressed, the options selected will be accepted and
you will be returned to the LLC/IEEE 802.3 Frame Event Detector Options window.


ΓòÉΓòÉΓòÉ 7.7.10. Ethernet Frame Event Detector ΓòÉΓòÉΓòÉ

The Ethernet Frame Event Detector (Ethernet DatagLANce Network Analyzer)
combines the Frame Format/Protocols, DLC Address Pairs, and Frame Data Pattern
Event Detectors into one event detector that can detect all three of these
events. This allows for optimum event detector utilization that without the
combined format might require as many as three event detectors to identify an
event.

Figure "Ethernet Frame Event Detector Options" shows the window that is
displayed when you select the Ethernet Frame Event Detector configuration
option.


Ethernet Frame Event Detector Options

The Frame Addresses group box allows you to specify the destination and source
address masks for the frame. Editing these addresses is discussed in MAC Frame
Event Detector.

The Ethernet Type Field group box allows you to specify a hexadecimal mask for
the type field of the Ethernet frame in the Mask edit field.

The InfoField Pattern permits specification of a sliding or fixed offset data
pattern search within the Ethernet Frame information field. The procedure for
editing this pattern is similar to that for Frame Data Pattern Event Detector
(see Figure "Frame Data Pattern Event Detector Options").

When OK is pressed, the event detector is configured to identify an Ethernet
frame containing the destination and source address masks specified, matching
the Ethernet type mask, and containing the InfoField Pattern if one is
specified.


ΓòÉΓòÉΓòÉ 7.8. Displaying Monitored Events ΓòÉΓòÉΓòÉ

When the DatagLANce analyzer monitors the network, it accumulates data for all
custom events specified and all events that the DatagLANce analyzer
automatically monitors. The DatagLANce analyzer displays the statistics
accumulated on these events in event windows.


ΓòÉΓòÉΓòÉ 7.8.1. Creating a New Event Window ΓòÉΓòÉΓòÉ

A new event window is created by selecting New Window from the Window menu of
the DatagLANce Network Analyzer window. Figure "New Event Window" illustrates a
new event window.


New Event Window

This window displays the current statistics in numeric form for the All Frames
default event.

The appearance of an event window can be changed at any time. To do this, place
the pointer anywhere within the event window, and press mouse button 2. Figure
"Event Window Options Menu" is displayed.


Event Window Options Menu

From this menu you can select an event to be displayed (Event), the format in
which you want to display the statistics (Format), and the statistics to
display about the event (Display). The following topics describe these options.


ΓòÉΓòÉΓòÉ 7.8.2. Displaying Events ΓòÉΓòÉΓòÉ

To display an event, click on Event (shown in Figure "Event Select Submenu")
with mouse button 1.


Event Select Submenu
A check mark is displayed beside the current event selected. To select a
different event, click mouse button 1 on the event.


ΓòÉΓòÉΓòÉ 7.8.3. Selecting the Event Format ΓòÉΓòÉΓòÉ

The Format menu in the Event window options menu contains a submenu (see Figure
"Format Select Submenu") for selecting numeric, bar chart, or line graph
display formats for statistics. Click on Format with mouse button 1 to display
this submenu.


Format Select Submenu

Select the format you want with mouse button 1. The formats are:

 Numeric (Current)
      Displays, in numeric format, event statistics collected during the last
      refresh interval. This format permits the display of multiple statistics,
      such as frames, bytes, average frame size, and utilization. Figure
      "Numeric (Current) Format" shows this format.


            Numeric (Current) Format

 Numeric (Cumulative)
      Displays, in numeric format, event statistics collected since the monitor
      was started.

 Bar (Current)
      Displays, in bar graph format, current event statistics. Only one
      statistic category, such as frames, bytes, or frame rate can be displayed
      in this window. Figure "Bar (Current) Format" illustrates this format.


            Bar (Current) Format

 Bar (Cumulative)
      Displays, in bar graph format, event statistics collected since the
      monitor was started. Only one statistic can be displayed in this window.

 History
      Displays any event statistic in relation to time. Statistics are sampled
      at the interval specified in the History Statistics Options (see History
      Statistics: Network Statistics Versus Time) and are displayed in a
      history graph in the window, as shown in Figure "History (Current)
      Format".


            History (Current) Format

      The /2 and x2 buttons will halve or double the number of points displayed
      on the history graph. Up to 400 points of history statistics will be
      retained for display.


ΓòÉΓòÉΓòÉ 7.8.4. Selecting Display Options ΓòÉΓòÉΓòÉ

To select display options, click, with mouse button 1, on the Display menu in
the Event window. (See Figure "Display Select Submenu").


Display Select Submenu

The following list explains each display option:

 Frames
      Displays the number of frames counted for the event.

 Bytes
      Displays the number of bytes in all the frames counted for the event. For
      token-ring, this count includes the start delimiter, end delimiter, frame
      status, and frame check sequence bytes and the frame bytes. Including
      these bytes in the count results in the best approximation of frame
      network utilization. For Ethernet, this count includes the frame check
      sequence and the frame bytes. The preamble, or start delimiter fields,
      are not counted because some of the preamble can be lost as the frame
      travels through the network.

 Avg Frame Length
      Displays the average frame length of the event's frames. This is
      calculated by dividing the number of bytes counted for the event by the
      number of frames counted for the event.

 Frame Rate
      Displays the average number of event frames counted per second. For
      current statistics, this is the number of event frames counted divided by
      the screen refresh interval. For cumulative statistics, this is the
      number of event frames counted divided by the number of seconds the
      DatagLANce analyzer has been monitoring.

 Byte Rate
      The average number of bytes in all the event frames counted per second.
      For current statistics, this is the number of bytes counted for the event
      divided by the screen refresh interval. For cumulative statistics, this
      is the number of bytes counted for the event divided by the number of
      seconds that the DatagLANce analyzer has been monitoring.

 Utilization
      Displays the average utilization of maximum bandwidth in percent used by
      all the bytes in all the frames counted for the event. For current
      statistics, this is the Byte Rate value divided by the maximum network
      speed in megabytes per second. For cumulative statistics, this is the
      Byte Rate value divided by the maximum data rate.

 Percent Frame Traffic
      Displays the average percentage of all frames counted that matched the
      event being displayed. For current statistics, this is the number of
      frames counted for the event divided by the count of all frames monitored
      during the last screen refresh interval. For cumulative statistics, this
      is the number of frames counted for the event divided by the count of all
      frames seen since the DatagLANce analyzer started monitoring.

 Percent Byte Traffic
      Displays the average percentage of all bytes counted that have been in
      frames that matched the event being displayed. For current statistics,
      this is the number of bytes counted for the event divided by the number
      of bytes in all frames seen during the last screen refresh interval. For
      cumulative statistics, this is the number of bytes counted for the event
      divided by the number of bytes in all frames seen since the DatagLANce
      analyzer started monitoring.

 Soft Errors (token-ring only)
      A count of all soft errors reported in all MAC soft error report frames.
      This statistic is valid only for the All Frames event.

 Ring Purges (token-ring only)
      A count of the number of frames identified as MAC ring purge frames. This
      statistic is valid only for the All Frames event.

 Beacon Frames (token-ring only)
      A count of the number of frames identified as MAC beacon frames. This
      statistic is valid only for the All Frames event.

 CRC/Alignment Errors (Ethernet only)
      A count of the number of frames that contained CRC/Alignment errors. This
      statistic is valid only for the All Frames event.

 Collisions (Ethernet only)
      A count of the number of collision fragments and jabber frames (late
      collisions). This statistic is valid only for the All Frames event.

      Note:  The count of collision fragments is an estimate of the actual
      number. Collisions that occur during the preamble of a frame and
      collision fragments that are less than the minimum frame size accepted by
      the adapter are not counted.

 Runt Frames (Ethernet only)
      A count of the number of frames that were runts. This statistic is valid
      only for the All Frames event.

 Oversized Frames
      A count of the number of frames that were oversized. This statistic is
      valid only for the All Frames event.

 Event
      Displays the name of the event in the window. The name of the event is
      always displayed in the window's caption. Disabling this option provides
      room for other information within the window.

 Statistic
      Displays the name of the statistic displayed in the bar or history graph.
      Disabling this option provides room for other information within the
      window.

 First Activity
      Displays the time of the first occurrence of the event. This statistic is
      available only for numeric formats.

 Last Activity
      Displays the time of the last occurrence of the event. This statistic is
      available only for numeric formats.

 Units
      Displays the units used to display the bar or history graph. Disabling
      this option provides room for other information within the window.

 Date/Time
      Displays the date and time of events on a history graph. Disabling this
      option provides room for other information within the window.

 Grid
      Displays a dashed grid on history graphs. Each vertical line on the graph
      corresponds to the Date/Time shown below it.

 Min
      Displays the minimum value of the event's history statistics on the
      history graph.

 Avg
      Displays the cumulative average of the event's history statistics on the
      history graph.

 Max
      Displays the maximum peak of the event's history statistics on the
      history graph.

 Manual Scaling
      Permits the axis limits of the bar and history graph to be manually
      manipulated. When disabled, the bar graph is automatically adjusted as
      the statistics exceed the bounds of the graph. (Note that the bounds of
      the graph do not include the minimum and maximum statistics.) When manual
      scaling is disabled for history graphs, the minimum and maximum will
      equal the historical minimum and maximum values.

 Set Axis Limits
      Displays a window, enabling you to enter the axis limits of the bar or
      history graph.


ΓòÉΓòÉΓòÉ 7.9. History Statistics: Network Statistics Versus Time ΓòÉΓòÉΓòÉ

Selecting the Event Format, describes how the statistics accumulated for an
event can be displayed in relation to time. This information can show trends of
events that are occurring on the network.

Sometimes, it is useful to accumulate these statistics over longer periods of
time and analyze them. In addition to accumulating and displaying these
statistics in relation to time, you can record the statistics to a file for
printing or further analysis by other programs, such as spreadsheets.

The History Statistics Options window (see Figure "History Statistics Options")
is displayed when History Statistics Options is selected from the Monitor menu.


History Statistics Options

The History Statistics Sample Interval combination box specifies the length of
time for accumulating history statistics. This time interval can range from one
second to one hour (except for a 16Mbps token-ring, which has a maximum time
interval of 30 minutes).

The radio buttons below the History Statistics Sample Interval combination box
specify recording options:

 Do not Record History Statistics Causes the DatagLANce analyzer to not record
      statistics, but to accumulate them for displaying in event windows. When
      history recording stops, you can use the report function (see Figure
      "Print Report Options") to print the history statistics for some events.

 Start Recording Immediately Causes history statistics to start being written
      when the DatagLANce analyzer starts monitoring.

 Start Recording at Date/Time Causes the DatagLANce analyzer to start recording
      history after the date and time specified.

 The Number of Samples to Record combination box specifies the number of sample
 intervals to record. A number can be specified, or selected, from the list
 box. If you select Unlimited, the DatagLANce analyzer will record statistics,
 until monitoring stops.

 Note:  Since the platform running your DatagLANce analyzer has finite disk
 space, ensure that: (1) enough storage space is available on your system for
 recording statistics, and (2) the DatagLANce monitor is stopped before the
 system drive is full. Each sample takes from 34 to 660 bytes of disk space
 depending on the statistics/format file you have selected to be written.

 Just below the Number of Samples to Record box, the DatagLANce analyzer
 displays the total time needed to record statistics.

 The device, or path name of the file to contain the statistics, can be entered
 in the Device or Pathname field. Device names entered in this field must end
 in a colon (for example, PRN:). Use the full directory path name for any file
 located outside the Current Path. The file extension must be omitted.

 The File Format group box gives the following choices for formatting the file:

 o If you select Text, the selected statistics are written in columnar format
   to a text file with an extension of HTX.

 o Delimited Fields, in combination with Text, causes the statistics selected
   to be written in comma-separated variable format. This format is suitable
   for importing the file into industry-standard spreadsheet programs.

 o If you select Binary, all accumulated statistics are written to a binary
   file with an extension of HRF. You can write custom programs to read and
   manipulate the data in this format. See History Statistics File Formats.
 The Select Statistics push button enables you to choose the statistics to be
 recorded for text format history statistics files. When you click on this push
 button, the window shown in Figure "Select History Statistics for Recording
 Window" is displayed.


  Select History Statistics for Recording Window

 Use the Event list box to select any event that the DatagLANce analyzer
 monitors. The statistics selected for this event are displayed in the
 Statistics to Record group box. All selected statistics check boxes are
 recorded. Grayed statistics check boxes cannot be recorded for the event.

 The Clear push button removes the check marks from all the check boxes for the
 event selected. The Clear All Events push button removes the check marks from
 the check boxes for all events.

 Clicking on the OK push button causes all statistics selected to be accepted
 and returns you to the History Statistics Options window.


ΓòÉΓòÉΓòÉ 7.10. Alarms: Keeping a Watchful Eye on Your Network ΓòÉΓòÉΓòÉ

The DatagLANce analyzer accumulates statistics on a variety of events, displays
these statistics in current, cumulative, and historical formats, and permits
you to record these statistics to a history statistics file for a record of
your network activity.

But what happens when something critical occurs on your network, such as All
Frames Utilization exceeding 80% or too many CRC errors are degrading network
performance? One way to ensure that you are alerted to this condition when it
occurs, would be to continuously monitor a view of All Frames Utilization
History. In most cases, however, you will be doing something more productive
than watching the DatagLANce screen when your network starts experiencing
problems, like these.

The DatagLANce analyzer offers you the capability of configuring 5-level floor
and/or ceiling audible alarms for various types of alarm events as well as
recording these alarms in a file. With this function, you are free to do other
work while the DatagLANce analyzer watches your network for potential problems.

In addition to logging alarms to a file, the DatagLANce analyzer can be
configured to send an SNMP trap to a management station on your network, beep a
pager, stop a capture already in progress (see Capturing Frames from the
Network), or run your own program that takes appropriate action to the alarm.

Some DatagLANce configurations (see Configurations) include alarms that might
be useful for your network. Since there is no defined normal activity for all
networks, you will need to customize the supplied alarm values for your
network. The next topic explains how to perform this customization.


ΓòÉΓòÉΓòÉ 7.10.1. Defining Normal Thresholds of Network Operation ΓòÉΓòÉΓòÉ

Before you configure the DatagLANce analyzer to look for potential problems,
determine the thresholds of your network's normal operation. This can be
accomplished by recording statistics for your network over at least a 24-hour
period of normal network operation, such as a weekday. The interval you select
for this recording should be the interval for which you want to be notified of
potential problems (for example, 30 seconds). You can record events such as All
Frames Utilization, soft errors (token-ring) or CRC/alignment errors
(Ethernet), and other performance statistics that influence frame counts
(Broadcast frames, ICMP frames).

Next, examine this file to determine trends by using a spreadsheet or by
printing out the information. Locate the maximum and minimum peaks of each
event monitored. Find any critical events, such as traffic to-and-from a
critical file server, or another device, on which your network is heavily
dependent.

You can use this information to determine safe performance thresholds of your
network.


ΓòÉΓòÉΓòÉ 7.10.2. Configuring Alarms: The Alarm Options ΓòÉΓòÉΓòÉ

Select the Alarm Option from the Monitor menu of the DatagLANce Network
Analyzer control windows to configure alarms for specific events. When this
menu item is selected, the window in Figure "Alarm Options" is displayed.


Alarm Options

In the Alarm Events list box you can select of a number of events that support
the specification of alarm thresholds. The selected event in the list contains
all of the options displayed in the remainder of the window.

The Interval combination box specifies the time interval, in seconds, over
which measurements occur to determine whether an alarm condition exists for the
event selected in the Alarm Events list box. Each alarm event can have a
different interval. Select longer intervals to prevent sporadic bursts of
traffic from creating unwanted alarm entries. When averaged over a longer
period of time, these events will fall within normal network thresholds.

In the Alarm Condition Exists When group box you can specify whether a floor
alarm, ceiling alarm, or a combination floor and ceiling alarm are disabled.
You can select from the following options:

 Disabled
      Disables the alarm. No thresholds for this alarm event will be monitored.

 Min Violated
      Specifies that if the value of the event falls below specified minimum
      thresholds, an alarm condition exists. This is a floor alarm.

 Max Violated
      Specifies that if the value of the event exceeds specified maximum
      thresholds, an alarm condition exists. This is a ceiling alarm.

 Either Violated
      Specifies that if any of the minimum or maximum thresholds specified are
      violated, an alarm condition exists.

 The Alarm Thresholds group specifies the thresholds of the floor and ceiling
 alarms. The five levels of alarm thresholds are:

 Inform
      Some event of interest has occurred.  For example, the network is near
      its maximum normal All Frames Utilization.

 Warning
      Some event has exceeded normal network thresholds. For example, the
      network has exceeded its maximum normal All Frames Utilization.

 Minor
      Some event has more than exceeded normal network thresholds. For example,
      the network is 10% above its maximum normal All Frames Utilization.

 Major
      Some event is nearing a critical normal network threshold.  For example,
      the network has exceeded 30% above its maximum normal All Frames
      Utilization.

 Critical
      Some event has reached a critical normal network threshold.  Critical
      alarms indicate when conditions exist that severely degrade network
      performance. For example, the network has exceeded 80% utilization.

 You can enter thresholds for each alarm priority in the MINIMUM and MAXIMUM
 edit field boxes next to the priority. The units of the alarm threshold are
 shown next to the alarm event in the Alarm Event combination box. These units
 might be seconds (Network Inactive Time), percent (All Frames Utilization), or
 counts (for example, All frames counts). A blank edit field indicates that no
 alarm conditions exist for that priority.

 The alarm ACTIONS check boxes located next to the thresholds edit boxes allow
 you to select which actions to perform when an alarm event occurs.

 Log
      Records the alarm event in the Alarm Log.

      The Log selections have no effect on audible alarms. Any logged or
      unlogged alarm event causes the alarm to sound if the Audible Alarms
      check box has been checked.

 Stop
      Causes the Capture to stop. This option only takes effect if the
      capturing is enabled and is active.

 Trap
      Sends an SNMP Trap to a specific network management station. This option
      requires that IBM TCP/IP for OS/2 be installed, along with a separate
      network interface (network adapter or SLIP line) for TCP/IP network
      communication. A list of the Enterprise Specific SNMP Trap variables
      originated by the DatagLANce Network Analyzer is defined in SNMP Traps
      from the DatagLANce Network Analyzer:  The MIB Definition.

 Page
      Beeps your pager. This option requires that a Hayes-compatible modem,
      connected to a phone, be attached to one of the COM ports of your
      computer.  Only one page per any ten minute interval will be performed.

 Run
      Runs a program. This option permits you to write your own specific
      application to be executed when this alarm condition occurs. Clicking on
      the Run push button next to the check box will allow you to select the
      program to execute.

 Beneath the Critical alarm thresholds is the When alarm threshold violation
 ceases line and alarm ACTIONS check boxes. These actions are performed when
 the alarm condition ceases to exist (the network returns to within normal
 thresholds for this alarm).

 The Audible Alarms switch in the Options group box will cause the speaker to
 sound when an alarm condition occurs for this alarm event. Higher priority
 alarms have higher pitches as well as longer duration.

 The One-Time Alarms switch in the Options group box sets alarm event logging
 to a single unacknowledged Log entry. This prevents alarm events, which can
 occur again and again, from cluttering up the Alarm Log.

 The Log Alarms To push button permits you to specify whether the alarm log is
 written to a file. When you click on the Log To push button, the window in
 Figure "Alarm Log Options" will be displayed.


  Alarm Log Options

 If you select the Log to window only radio button, no Alarm Log file is
 written.

 Selecting both radio buttons instructs the DatagLANce analyzer to record the
 Alarm Log both to the Alarm Log window and to a device/file.

 The Alarm Log Device or Pathname edit field permits entry of the device or
 path name of the file. Device names should end with a colon (for example,
 PRN:). The extension should be omitted when specifying a file (the extension
 will be LOG); also, full path names must be specified for files written to a
 directory other than Current Path.

 The Append File if Exists flag enables extending an existing Log file with new
 data.  Since system disks cannot provide an infinite amount of storage space,
 make sure that you shorten or delete this file regularly.

 The Send Traps To push button on the Alarm Options window permits you to
 specify where to send SNMP traps when an alarm occurs. When you click on the
 Send Traps To push button, the window in Figure "SNMP Traps Options" will be
 displayed.


  SNMP Traps Options

 The TCP/IP Address of the network management station in which to send SNMP
 traps should be specified in the Send Traps to IP Address edit field.

 The Pager Setup push button on the Alarm Options window permits you to specify
 the commands necessary to beep pager through your Hayes-compatible modem. When
 you click on the Pager Setup push button, the window in Figure "Pager Setup
 Window" will be displayed.


  Pager Setup Window

 The Modem Connected To combination box selects which COM port to issue the
 modem commands through.

 The Modem Initialization Commands edit fields specify what commands to send to
 the modem before issuing the command to beep your pager. A two second delay
 will be inserted between each initialization command. A blank edit field will
 cause no delay.

 The Dial Pager Modem Command specifies which command to issue to the modem to
 dial your pager.  For Hayes-compatible modems, this command is prefixed by
 ATDT (for touch tone phones) or ATDP (for pulse phones). Following this prefix
 is the dial out sequence to beep your modem.

 A sample dial pager modem command can be as follows:

  ATDT9,234-5678,,7890,,,

 This sample command causes the modem to dial 9, then waits two seconds (each
 comma in the command instructs the modem to wait two seconds), dial 234-5678,
 wait four seconds, dial the pager extension 7890, then wait six seconds.

 Choosing the Append Dial Pager Command with Alarm Code check box causes
 DatagLANce to append an alarm code to the command string. In the example above
 the six-second delay will be followed by an alarm event and condition specific
 code. These codes are defined in DatagLANce Alarm Pager Codes.

 Each of the Run push buttons on the Alarm Options window permits you to
 specify a program to execute when an alarm occurs. When you click on the Run
 push button, the window in Figure "Execute Program on Alarm" will be
 displayed.


  Execute Program on Alarm

 The program to be executed, and any arguments to the program, should be
 specified in the edit field of this window. This program must be a valid OS/2
 EXE file and the full path of the program including drive designators must be
 specified.

 OS/2 CMD files can be run by executing the OS/2 Command Processor, CMD.EXE,
 found with the \OS2 directory on the drive where you installed OS/2. Check the
 OS/2 Command Reference for the command syntax.


ΓòÉΓòÉΓòÉ 7.10.3. The Alarm Log Window: A View into the Network's Alarm Past ΓòÉΓòÉΓòÉ

When monitoring, the DatagLANce analyzer logs any alarm events that occur to
the Alarm Log window and, if requested, to an alarm file. This window can be
displayed by selecting Alarm Log from the Window menu of the DatagLANce Network
Analyzer window (see Figure "Alarm Log Window").

     Warning: When you operate more than one Datag analyzer at the same time,
     you should choose different file names for the alarm log (or place them in
     separate directories).


  Alarm Log Window

 The most recent alarm events appear at the top of the Alarm Log window. Each
 logged alarm has several information fields, displayed in a columnar format:

 Number
      Represents the number of the alarm event. The first alarm event is
      numbered 1, and so on.

 Priority
      Represents the alarm's priority. Each alarm is displayed in the color
      that matches its alarm priority.

 Timestamp
      Shows the date and time the alarm event occurred.

 Alarm Description
      Describes which alarm event occurred and whether a minimum or maximum
      threshold was breached.

 There are several menu options that enable you to manipulate the Alarm Log
 displayed in the window:

 Acknowledge
      Acknowledges an alarm. An `a' character is displayed to the left of the
      alarm, indicating that it has been acknowledged, and the alarm is grayed.
      This indicates that you have personally noted the alarm but wish to leave
      it displayed in the Alarm Log window.

 Clear
      Removes the alarm from the Alarm Log window. The alarm will still be
      recorded in the Alarm Log file if one has been specified.

 Options
      Has the following menu choices:

    o Clear All Alarms clears all alarm log entries from the Alarm Log window.
      The alarms will still be recorded in the Alarm Log file if one has been
      specified.

    o Allow Audible Alarms enables audible alarms for events whose Audible
      Alarm switch is turned on. This item is a convenient way of temporarily
      or permanently disabling any alarms that might become audible.

 The Alarm Log window displays a maximum of 50 alarm entries.  Any earlier
 alarm entries are discarded. These log entries give you a view into your
 network's previous alarms. For a complete record, though, you should send
 alarms to a file.

 Note:  The DatagLANce analyzer also discards One-Time Alarms from the Alarm
 Log window based on the Alarm arrival time.  Yet the One-Time rule remains in
 effect to prevent new entries to the log.  For discarded entries, no other
 mechanism exists to clear them individually.  Therefore, to permit a new
 occurrence of a discarded One-Time Alarm, you must use the Clear All Alarms
 option.


ΓòÉΓòÉΓòÉ 7.11. Network Glance: Viewing the Traffic on the Network ΓòÉΓòÉΓòÉ

While monitoring, the DatagLANce analyzer reports statistical information about
events such as frames, tokens, and any custom events that it has been
configured to monitor. These statistics give you information about how often
events occur as well as how many events have occurred since the DatagLANce
analyzer started monitoring. However, you might also want to examine the type
of traffic that is currently traveling on the network. If so, you will want to
use the DatagLANce Network Glance function.


ΓòÉΓòÉΓòÉ 7.11.1. What is Network Glance? ΓòÉΓòÉΓòÉ

The Network Glance function enables you to view traffic that is traveling on
the network by recording for some period of time (or until the Glance buffer is
full) and then displaying the frames in decoded form.

The Glance function stores frames in the DatagLANce Network Analyzer's 64-KB
Glance buffer. All frames on the LAN or only a subset of frames can be glanced.
Only the first 176 bytes of each frame will be saved in the Glance buffer.

Glance cannot time-stamp frames. If you need frame time-stamps, see Capturing
Frames from the Network.

The next section discusses a variety of formats available for displaying
glanced frames.


ΓòÉΓòÉΓòÉ 7.11.2. Operating Network Glance ΓòÉΓòÉΓòÉ

The Network Glance window controls the Glance function as shown in Figure
"Network Glance Window".  You can display this window by selecting Network
Glance from the Window menu of the DatagLANce Network Analyzer control window.


Network Glance Window

The Glance! menu choice in the menu bar of the Network Glance window initiates
a glance. Clicking on this menu choice causes the DatagLANce analyzer to start
recording frames.

The Options menu contains the following Glance options:

 Glance at All Frames
      Causes the DatagLANce analyzer to glance at any frame on the network.

 Glance at Filtered Frames Only
      Causes the DatagLANce analyzer to glance at frames matching the Network
      Glance Filter. See Figure "Network Glance Filter".

      If you configure your DatagLANce analyzer to capture frames, this menu
      choice label becomes Glance at Captured Frames Only. See Capturing Frames
      from the Network. The DatagLANce analyzer glances at any frames that
      match the Frame Capture Filter as discussed in Figure "Frame Capture
      Filter". This function enables you to view frames being captured without
      stopping the capture.

 Glance Interval
      Specifies how long to listen for frames. The DatagLANce analyzer stops
      glancing at the end of this interval and then displays the frames that
      were glanced.

 Auto-Refresh
      Places the DatagLANce analyzer in auto refresh mode. The DatagLANce
      analyzer continuously glances and refreshes as specified by the glance
      interval.

 When a glance cycle is completed, the DatagLANce analyzer presents the frames
 glanced in a summary format. This format, as well as the remainder of the menu
 choices on the Network Glance window, functions the same as the DatagLANce
 protocol analysis application does. (See Analyzing Captured Frames for a
 discussion of these functions.)


ΓòÉΓòÉΓòÉ 7.11.3. The Network Glance Filter: Selecting Frames to Glance ΓòÉΓòÉΓòÉ

When the DatagLANce analyzer is not configured to capture frames from the
network, the Monitor menu of the DatagLANce Network Analyzer control window
contains a menu choice labeled Network Glance Filter. Figure "Network Glance
Filter" shows the window that is displayed when you select this menu choice.


Network Glance Filter

The Network Glance Filter represents an event equation that selects events to
glance. Event equations are discussed in Understanding Event Equations. When
the Glance at Filtered Frames Only choice in the Network Glance window's
Options menu is selected, only the frames passing this event equation are
glanced.


ΓòÉΓòÉΓòÉ 7.12. Ring Map: A Logical Token-Ring Map ΓòÉΓòÉΓòÉ

The Token-Ring DatagLANce Network Analyzer can build and display a logical map
of the token-ring. This logical map lists MAC addresses representing all of the
stations on the ring.

You can choose to activate the Ring Map instead of the Network Glance Filter by
selecting the Ring Map menu choice from the Monitor menu in the DatagLANce
Network Analyzer control window. Since this function also requires the use of
one event detector, at least one event detector must be configured as disabled
to use this function. (See Configuring Event Detectors.)

Note:  The capture function must be disabled in order to use this function (see
The Capture Menu).

The Ring Map window displays the token-ring map as shown in Figure "Ring Map
Window".


Ring Map Window

The Refresh! menu choice in the menu bar of the Ring Map window produces a
record of the current ring map. Selecting this menu choice causes the
DatagLANce analyzer to start listening for MAC active monitor present frames
and MAC standby monitor present frames that each station transmits on the ring.
From this information, the DatagLANce analyzer builds a logical token-ring map.

The ring map is displayed as a list of station addresses. The DatagLANce
Network Analyzer should appear at the bottom of this list. If it does not, the
DatagLANce analyzer has not been able to determine the address of the nearest
upstream station.

Stations positioned above the DatagLANce analyzer in the list are upstream from
the Analyzer.  Each station is listed in same order that it occurs the ring.

Each line in the window represents a single station on the ring. Information
about the station is displayed in a columnar format. You can display or hide
optional information about the station by selecting a particular menu choice
from the Display menu in this window.  The items of information you can display
about a station are:

 Status Flag (Unlabeled Field)
      This column has no title and is always displayed on the left side of the
      display.  The flag field contains a status flag about the station. This
      flag can be one of the following flag characters:

    <blank> Indicates that the station is currently active on the ring.

    N    Indicates that the station has just been inserted into the ring.

    D    Indicates that the station has disconnected from the ring or has been
         isolated from the ring somehow. A station will also be considered
         disconnected if it stops participating in MAC standby-monitor-present
         notifications.

 Station
      Displays the MAC address of the station.

      The width of this field can be varied by selecting the Address Field
      Width menu choice in the Display menu.

      The Display menu also contains two selections, Numeric Addresses and
      Symbolic Names. These selections control whether the address should be
      displayed in hexadecimal or whether any corresponding symbolic names
      should be displayed for the address.

 NAUN
      Identifies the station's nearest active upstream neighbor's (NAUN's)
      address.

      The upstream neighbor should be displayed directly above the station in
      the ring map, but, in instances where one or more stations become
      disconnected or isolated, it can be displayed several entries below its
      upstream neighbor. This occurs because when the new ring map is built,
      any disconnected or isolated stations will be inserted into the ring map
      beneath their last known upstream neighbor.

      You can hide or display this field by selecting NAUN from the Display
      menu.

 Station Status
      Identifies the station as the active monitor, standby monitor, or as this
      DatagLANce analyzer. You can hide or display this field by selecting
      Station Status from the Display menu.

 The File menu contains an option to print the ring map or to write it to a
 text file.

 The Options menu contains the following menu choices that affect the ring map:

 Acknowledge New Stations
      Removes the new condition flag from each new station.

 Clear Disconnected Stations
      Removes from the ring map any disconnected or isolated stations.

 Refresh Interval
      Selects the time period that the DatagLANce analyzer will listen to the
      ring for MAC active-monitor-present and MAC standby-monitor-present
      broadcasts, at the end of which it updates and displays the ring map.

 Auto-Refresh
      Causes the DatagLANce analyzer to refresh the ring map continually as
      specified by the Refresh Interval menu choice.

 The top line of the ring map window contains the date and time of the last
 ring map refresh and a count of:

 The stations on the ring
 Newly inserted stations
 Disconnected stations.
 If the DatagLANce analyzer cannot determine it's NAUN, "OurNAUN=Unknown" is
 displayed on this line.


ΓòÉΓòÉΓòÉ 7.13. Analyzing the Traffic Flow on Your Network ΓòÉΓòÉΓòÉ

The DatagLANce analyzer can gather statistics on traffic to, from, and between
stations on the network. You can display and sort these statistics to find out
information, such as, the top talkers and top listeners on your network.

The next two sections discuss enabling this function and viewing and sorting
the statistics.


ΓòÉΓòÉΓòÉ 7.13.1. The Traffic Analysis Options ΓòÉΓòÉΓòÉ

The DatagLANce Traffic Analysis function is enabled by selecting Traffic
Analysis Options from the Monitor menu of the DatagLANce Network Analyzer
Control window. When you select this option, the window in Figure "Traffic
Analysis Options" is displayed.


Traffic Analysis Options

The Enable Traffic Analysis Processing check box at the top of this window
activates the traffic analysis function. If it is not checked, the DatagLANce
analyzer does not perform traffic analysis.

The Only for Event check box can be used to limit traffic analysis to the
custom event selected in the combination box next to this check box. This
permits you to perform traffic analysis on a subset of network traffic. See
Monitoring Events on the Network for more information on monitoring custom
events.

The Processing Options group box permits you to select the traffic analysis you
want, as well as specific options related to traffic analysis.

The Table Entries field specifies the maximum number of table entries to
create. Depending on the Analysis Type selected, the reception of a frame
creates or updates one or more table entries. If you check the Notify user if
table becomes full check box, you are notified when the table becomes full.

The Sample Interval combination box represents the amount of time that the
DatagLANce analyzer will accumulate traffic statistics. The value Until Stopped
indicates that the DatagLANce analyzer will accumulate statistics until the
monitor is stopped. The other options in the combination box select the time
interval over which the DatagLANce analyzer will accumulate (and record, if
recording is enabled) the traffic statistics. The Reset table at end of
interval check box will cause all statistics in the table to be cleared at the
end of this interval, effectively restarting the traffic analysis function.

The Start radio-button selects when to start traffic statistics processing.
The When the monitor is started radio button selects that processing should
begin when the Go! menu choice is selected on the DatagLANce Network Analyzer
window. The Time radio-button specifies the time within the next 24 hours that
traffic statistics processing should begin.

The Stop radio-button selects when to stop traffic statistics processing.  The
When the monitor is stopped radio button selects that processing should stop
when the Stop! menu choice is selected on the DatagLANce Network Analyzer
window. The Time option specifies the time that traffic statistics processing
should stop. The time specified will be the time within 24 hours of the start
time.

The Process Priority radio-button selects the priority assigned to traffic
statistics processing. Time-Critical is the highest priority and Normal is the
lowest priority. Lower priorities tend to increase the chance that the
DatagLANce analyzer will drop frames from traffic statistics processing if too
many frames are queued for processing. The TRAFFIFO= device driver option
selects the size of the traffic statistics FIFO. (See The TRAFFIFO= Parameter.)

To obtain the best traffic statistics processing performance, select
Time-Critical as the priority, but be aware that high network activity might
cause a sluggish display. If you want only the list of active stations, you can
use a lower priority and get reasonably accurate approximations of network
activity.

The Analysis Type combination box selects one of the following ways to
accumulate data:

 DLC Station Analysis
      Causes data to be accumulated for traffic to and from each single DLC
      station on the network. Statistics accumulated include frames, bytes,
      errors (token-ring: soft error reports; Ethernet: CRC errors), last
      partner address, station status, and first, last, and elapsed activity
      time stamps.

 DLC Traffic Matrix
      Causes data to be accumulated for traffic between pairs of DLC stations
      on the network. Statistics accumulated include frames, bytes, and first,
      last, and elapsed activity time stamps.

 Network Station Analysis
      Causes data to be accumulated for traffic to and from each single
      network-level station on the network. Statistics accumulated include
      address level (for example, TCP/IP or IPX addresses), last partner
      network address, frames, bytes, first, last, and elapsed activity time
      stamps.

 Protocol Matrix Analysis
      Conversations between pairs of network addresses on the network.
      Statistics accumulated include: frames, bytes, network addresses, and
      major and minor protocols being used.

 Dynamic Protocol Distribution Analysis
      All Protocols being used on the network. Statistics accumulated include:
      major and minor protocols, frames and bytes.

 Source Routing Traffic Analysis
      Analysis of traffic between source-routed network segments. Statistics
      accumulated include: frames, bytes, and smallest, average, and largest
      frame lengths.

 Token-Ring Soft Error Analysis (Token-Ring DatagLANce Network Analyzer)
      Detailed analysis of soft errors reported. Soft errors are separated into
      types of soft errors including: Line errors, burst errors, and receiver
      congestion.

 The Recording Options group box enables you to select whether to record
 statistics and to specify the name of the file that will contain traffic
 statistics.

 If the Record Statistics check box is checked, statistics will be recorded on
 the interval specified by the Sample Interval combination box (discussed
 earlier in this section). If the interval is Until Stopped, the statistics
 gathered will be displayed or filed as soon as the monitor stops.

 The file name recorded will be the one specified in the Device or Pathname
 field. The file extension will be .CSV. The Append if Exists check box selects
 whether to overwrite the file, if it exists, or append to it.


ΓòÉΓòÉΓòÉ 7.13.2. Viewing Traffic Statistics ΓòÉΓòÉΓòÉ

When you enable traffic statistics processing from the Traffic Statistics
Options window, and you start the monitor, the DatagLANce analyzer will begin
accumulating traffic statistics. You can display these statistics by selecting
Traffic Statistics from the Window menu of the DatagLANce Network Analyzer
Control window. Figure "Traffic Statistics Window" shows the window that is
displayed.


Traffic Statistics Window

The menu bar of this window controls what statistics are displayed and how they
are sorted.

A Display menu can be selected from this window. On the Display menu, you can
choose the individual statistics fields to display in the window.  Exactly
which fields appear depends on the analysis type previously selected (single
station, traffic matrix, or protocol matrix).  The fields on the Display menu
include:

 Address Field Width
      Selects the width of the address fields displayed.

 Numeric Addresses
      Selects the display of numeric addresses.

 Symbolic Names
      Selects the display of symbolic names, if available, instead of the
      numeric address.  (See Symbolic Names Support.)

 Total Traffic
      Displays total counts of traffic to and from a station (DLC and network
      station analysis) or between two stations (DLC traffic matrix and
      protocol matrix analysis).

 Traffic to Station
      Displays traffic counts to the station (DLC and network station analysis)
      or traffic counts from the partner to the station (DLC traffic matrix and
      protocol matrix Analysis).

 Traffic from Station
      Displays traffic counts from the station (DLC and network station
      analysis) or traffic counts from the station to the partner (DLC traffic
      matrix and protocol matrix analysis).

 Traffic To and From
      Displays traffic counts both to and from the station (DLC and network
      station analysis).

 Traffic From Both
      Displays traffic counts from both the station and from the partner to the
      other station (traffic matrix and protocol matrix analysis).

 Station Address
      Displays or hides the station's DLC address (DLC station and DLC traffic
      analysis) or network address (network station analysis).

 Partner Address
      Displays or hides the partner's DLC address (traffic matrix and protocol
      matrix analysis).

 Last Partner Address
      Displays or hides the last partner's DLC address of the station (DLC and
      network station analysis) or network address (network station analysis).

 Station Status
      Displays or hides the station status (DLC and network station analysis).

      Station status can be one of the following:

    o Broadcast Addr

      Station is a broadcast address.

    o Multicast Addr

      Station is a group address.

    o Station

      Station is a station on the Ethernet network.

    o Trace Tool

      Station is a trace tool (like the DatagLANce analyzer).

    o Trace Tool-Disc

      Station is a trace tool that was disconnected from the network.

    o Active Monitor

      Station is the active monitor on the local token-ring network.

    o Standby Monitor

      Station is a standby monitor on the local token-ring network.

    o Remote Station

      Station is a station on a remote token-ring network.

    o Disconnected

      Station was on the local token-ring network at one time but has been
      removed or disconnected from the network.

 Errors
      Counts of the number of soft errors reported by the station (token-ring)
      or the number of frames received from the station containing CRC or
      alignment errors (Ethernet). The DatagLANce analyzer offers these
      statistics for DLC Station Analysis and Token-Ring Soft Error Analysis
      only.

 Frames
      Displays number of frames accumulated.

 Bytes
      Displays number of bytes accumulated.

 Avg Frame Rate
      Displays the average number of frames accumulated per second. This
      statistic will not appear until statistics have been accumulated for
      about 20 seconds.

 Avg Byte Rate
      Displays the average number of bytes accumulated per second. This
      statistic will not appear until statistics have been accumulated for
      about 20 seconds.

 Avg Frame Length
      Displays the average number of bytes in the accumulated frames.

 Smallest Frame Length
      Displays the smallest number of bytes seen in any frame.

 Largest Frame Length
      Displays the largest number of bytes seen in any frame.

 Avg Utilization
      Displays the average percent utilization of network bandwidth. This
      statistic will not appear until statistics have been accumulated for 20
      seconds.

 Percent of Frame Traffic
      Displays the percentage of accumulated frames contributed to total frame
      traffic.

 Percent of Byte Traffic
      Displays the percentage of accumulated bytes contributed to total frame
      traffic.

 First Activity
      Displays the time of the first traffic statistics entry recorded for this
      type of traffic.

 Last Activity
      Displays the time of the last traffic statistics entry recorded for this
      type of traffic.

 Elapsed Activity
      Displays the amount of time that has passed since the previous activity
      occurred for this type of traffic.

 Address Level
      Displays the address level of the station address (network station
      analysis). The address levels are documented in Symbolic Names Support.

 Major Protocol
      Displays the major protocol suite being used between the partner and the
      station (protocol matrix analysis) or the major protocol suite containing
      the minor protocol (dynamic protocol distribution analysis).

 Minor Protocol
      Displays the minor protocol being used between the partner and the
      station (protocol matrix analysis) or the specific protocol within the
      protocol suite (dynamic protocol distribution analysis).

 Encapsulation
      Describes the encapsulation used for the major and minor protocols
      (dynamic protocol distribution analysis). The encapsulation can be DLC,
      LLC, Ether, 802.3, or SNAP.

 Station Network Address
      Displays the network address for the station (protocol matrix analysis).

      Note:  The DLC address of a router that belongs to the local LAN
      associates with every higher level address, for example IP, that is
      routed to the local LAN.  This produces the effect that the router
      appears to have multiple network addresses. This happens because the
      actual DLC station that corresponds to the station network address
      connects somewhere outside the local LAN on the other side of the router.

 Partner Network Address
      Displays the network address for the partner (protocol matrix analysis).
      See the note under Station Network Address.

 Source Routing Indicators
      Displays the source routing path of the communication taking place
      (protocol matrix analysis). The station's ring number is always displayed
      to the left. SRB signifies single route broadcast (SRB) and ARB signifies
      all routes broadcast (ARB).

 Source Ring
      Displays the source ring segment of traffic (source routing traffic
      analysis). This Ring is displayed if the ring number, to which the
      DatagLANce analyzer is attached, is not known. Local is displayed for
      traffic that is not source-routed.

 Destination Ring
      Displays the destination ring segment of traffic (source routing traffic
      analysis). SRB signifies single route broadcast (SRB) and ARB signifies
      all routes broadcast (ARB).

 NAUN
      Displays the next-active upstream neighbor of the token-ring station
      (token-ring soft error analysis).

 Ring Purges
      Displays the total number of ring purges transmitted by the station
      (token-ring soft error analysis).

 Beacons
      Displays the total number of MAC beacon frames transmitted by the station
      (token-ring soft error analysis).

 Monitor Contentions
      Displays the total number of MAC claim frames transmitted by the station
      (token-ring soft error analysis).

 Line Errors
      Displays the total number of line errors reported by the station
      (token-ring soft error analysis).

 Internal Errors
      Displays the total number of internal errors reported by the station
      (token-ring soft error analysis).

 Burst Errors
      Displays the total number of burst errors reported by the station
      (token-ring soft error analysis).

 A/C Errors
      Displays the total number of A/C errors reported by the station
      (token-ring soft error analysis).

 Abort Delimiters Transmitted
      Displays the total number of Abort Delimiters reported as transmitted by
      the station (token-ring soft error analysis).

 Lost Frame Errors
      Displays the total number of lost frames reported by the station
      (token-ring soft error analysis).

 Receiver Congestion
      Displays the total number of receiver congestion errors reported by the
      station (token-ring soft error analysis).

 Frame-Copied Errors
      Displays the total number of frame-copied errors reported by the station
      (token-ring soft error analysis).

 Frequency Errors
      Displays the total number of frequency errors reported by the station
      (token-ring soft error analysis).

 Token Errors
      Displays the total number of token errors reported by the station
      (token-ring soft error analysis).

 Note:  For detailed information on token-ring specific soft errors, consult
 the IBM Token-Ring Network Architecture Reference.

 A Sort menu can be selected from the Traffic Statistics window. On the Sort
 menu, you can select the field on which to base the sort. The Descending and
 Ascending choices allow you to reverse the direction of the sorting.

 The Options menu permits you to select when to re-sort the window contents by
 selecting a time interval.  If your network produces many table entries, you
 might want to increase this interval.

 The File menu has a print option that permits you to print the window contents
 after you have arranged it to your liking. This permits you to print reports
 such as top talkers, top listeners, top errors, top pairs, and any custom
 reports you want.

 The headings at the top of the window tell which statistics are being
 displayed. By displaying only the statistics that you need to see you can keep
 watch on the traffic levels and flow on your network.

 The statistics displayed on the Traffic Statistics window will refresh at the
 rate selected as the screen refresh rate. (See Using the Monitor Menu.) The
 statistics will re-sort at the rate selected in the Options menu of this
 window.


ΓòÉΓòÉΓòÉ 7.14. Printing Reports ΓòÉΓòÉΓòÉ

The DatagLANce analyzer accumulates extensive statistics about the network
being monitored. If you want a hardcopy of the statistics accumulated, the
Print Report choice in the File menu of the DatagLANce Network Analyzer control
window permits you to print them.

When you select this option, the window shown in Figure "Print Report Options"
is displayed.


Print Report Options

The Report combination box permits you to select which report to print. From
this combination box you can select to print cumulative network statistics,
event distributions, network history, and other reports.

The report prints to the device or file name specified in the Device or
Pathname edit field. A device is specified by appending a colon to its name
(for example, PRN:). If the Delimited Format check box is checked, the
DatagLANce analyzer will insert commas between the statistics printed to the
device or file.


ΓòÉΓòÉΓòÉ 7.15. Defining Screens: Window Arrangements ΓòÉΓòÉΓòÉ

A screen consists of one or more windows open at the same time.

Because the DatagLANce analyzer offers a wide variety of windows displaying
many kinds of statistics, the number of windows open on the screen at any one
time can become overwhelming. The DatagLANce analyzer enables you to define
arrangements of these windows which allow you to display only a few windows at
a time, yet at the selection of a menu choice, display another arrangement of
windows.

Screens are defined by first arranging the windows on the screen. You should
close any of the DatagLANce windows that you do not want on the screen, since
any windows hidden behind the foreground windows might be displayed when the
screen is rearranged.  Then, when you select the Define menu choice from the
Screen menu in the DatagLANce Network Analyzer control window, a window
requesting the name of the screen to define is displayed, as shown in Figure
"Define Screen Window".


Define Screen Window

When the Define Screen window is displayed, enter the name of the screen in the
Screen name edit field. When you click on the OK push button, the location and
size of all DatagLANce windows currently on the screen will be saved.

The name of the screen is then displayed in the Screen menu and, when you
select the name from this menu, the DatagLANce analyzer will display the
windows as you arranged them. Note that the same window can appear on more than
one screen.

To change an existing screen, select the screen, arrange the windows as you
would like, and then select a different screen name from the Screen menu.

To restore a screen to the original screen arrangement, select the name of the
original screen from the Screen menu. The Delete menu choice in the Screen menu
of the DatagLANce Network Analyzer control window opens a window that permits
you to select the window arrangement you want to delete.

In summary, by defining arrangements of windows as screens, the DatagLANce
analyzer makes it possible for you to flip among any of several screens of
related monitoring information easily.


ΓòÉΓòÉΓòÉ 7.16. Quick Filter: The Quick Equation Writer ΓòÉΓòÉΓòÉ

The Event Equation function permits you to combine event detectors for
selecting events to monitor, to start the capture, to capture, to trigger the
capture, and to perform post-capture filtering (discussed in Figure "Display
Filter Equation Edit Window"). It can be tedious, however, to go through all
the windows necessary to write one equation.

The Quick Filter function enables you to select events for monitoring,
capturing, and displaying with only a few keystrokes or mouse clicks. Activate
the Quick Filter function by clicking on the desired line of the window using
the mouse button 2. You can also activate the Quick Filter by selecting the
Quick Filter menu choice.

For the DatagLANce Network Analyzer application, the Quick Filter function is
active within any of the following windows:

 o The Network Glance Frame Summary window (see Figure "Network Glance Window")

 o The Network Glance Frame Detail window

 o The Traffic Statistics window (see Figure "Traffic Statistics Window")

 o The Ring Map window (see Ring Map: A Logical Token-Ring Map)

 For the DatagLANce Protocol Analysis Application, the Quick Filter function is
 active within any of the following windows:

 o The Frame Summary window (see The Frame Summary: A Summary of Frames
   Captured)

 o The Frame Detail window (see Frame Detail: Detailed Protocol Analysis)

 The Quick Filter function, when activated, checks the current selected line
 within the window and configures an appropriate event detector for that line.
 The type of event detector configured depends upon the window. See
 Understanding Events for a description of events and event detectors.

 For the Network Glance, Protocol Analysis Frame Summary, and Ring Map windows,
 the event will be the source address of the record selected. Quick Filter will
 set up an as-similar-as-possible pattern match for the address if an
 appropriate event detector configuration is not available.

 For the Network Glance and Protocol Analysis Frame Detail window, the event
 depends upon the bytes highlighted in the Frame Hexdump window when you click
 on the line.

 For the Traffic Statistics window, the event will be traffic to the station,
 from the station, either direction, or between the station and its partner.
 The type of traffic is determined by which statistics are being displayed.

 When configured, event detector options will be displayed for your final
 approval. Selecting the OK push button on this window accepts the Quick Filter
 information, and the window shown in Figure "Quick Filter Options Window" will
 be displayed.


  Quick Filter Options Window

 The Detector Label edit field specifies the label to give to the event
 detector just configured. Quick Filter will automatically assign a label
 appropriate to the event, but you can edit it to specify a more descriptive
 term.

 The Equation push button (for the DatagLANce Network Analyzer application
 only) enables you to select the equation to modify.

 The two radio buttons on the Quick Filter window enable you to select whether
 to count, capture, or display a frame if the frame matches or does not match
 the event. Any previous event detectors or filtering performed by the equation
 will be discarded.

 The Manually Edit Equation push button enables you to modify the existing
 quick filter equation (see Editing an Event Equation).

 When you select the OK push button, the DatagLANce analyzer adds the new event
 detector to the equation.


  Quick Filter Equation Select Window

 The window shown in Figure "Quick Filter Equation Select Window" permits you
 to select the equation to modify for the DatagLANce Network Analyzer
 application. The equation is displayed when you click on the Equation push
 button on the Quick Filter Options window.

 If you select the Custom Event radio button, the custom event equation by the
 number combination box next to it will be configured. The Label edit field
 will contain the name of the event assigned to the custom event.

 When you click on the OK push button, you will return to the previous window,
 where you can select how to modify the equation.

 To read more about the equations that Quick Filter will modify for you, see
 the following sections:

 o Selecting Custom Events to be Monitored

 o Figure "Network Glance Filter"

 o Figure "Frame Capture Filter"

 o Selecting When to Start Capturing: The Capture Start Event

 o Selecting When to Stop Capturing: The Trigger/Stop Capture Options

 o Figure "Display Filter Equation Edit Window"


ΓòÉΓòÉΓòÉ 7.17. Improving Monitoring Performance: The Adapter Options ΓòÉΓòÉΓòÉ

The DatagLANce Network Analyzer usually monitors all frames appearing on the
network. This requires looking at each frame that arrives, determining if it
passes or fails each enabled event detector, and then updating statistics based
on the results. Since the DatagLANce Analyzer does real-time processing,
network traffic can overburden the system processor. Adapter options allow you
to limit the amount of processing done for each frame as well as the number of
frames that are examined by the DatagLANce analyzer. Before discussing how to
improve monitoring performance by using the adapter options, let us discuss how
monitoring performance can be affected by which DatagLANce software options you
enable.

The DatagLANce Network Analyzer can miss frames under the following conditions:

 o The current network load is too heavy for DatagLANce to handle.

   The DatagLANce Network Analyzer must process each frame that appears on the
   network in order to report accurate statistics. If the buffers on the
   adapter card become full before the DatagLANce Network Analyzer can process
   the frames on the card, the DatagLANce analyzer will miss frames.

 o The event detectors configured are too complex for the current network load.

   The DatagLANce event detectors are extremely powerful and identify many
   different events. Some events require more examination of a frame than
   others, and the sum of the time spent examining frames by all event
   detectors is cumulative. For example, identifying a frame containing a
   destination DLC address requires examining six bytes of each frame that
   arrives. In contrast, identifying a frame containing a specific protocol may
   require many more bytes be examined.

 o Too many processing options are enabled for the current network load.

   If traffic analysis, capture, glance, and one or more custom events are all
   enabled at the same time, and the network load is heavy, the DatagLANce
   Network Analyzer can miss frames.

 o Two DatagLANce Network Analyzers are active at the same time within the same
   computer and the network load is heavy.

   The DatagLANce Network Analyzer can monitor two networks simultaneously;
   however, should network load on either or both networks become heavy, either
   DatagLANce Network Analyzer can miss frames.

 The following actions can be done to improve performance of the DatagLANce
 Network Analyzer:

 o Utilize adapter-specific options (see below) to improve performance.

   Specifically enabling first-buffer processing (Process only first xx bytes)
   or using available Adapter Filter Options can very much improve performance.

 o Disable any event equations that are not necessary.

   For example, if all five custom events are not required, clear the unused
   event equations (select Clear on the equation edit window). It is not
   required to disable any event detectors, since any event detectors not
   appearing in any event equations use no processing time.

 o Disable any unnecessary processing options.

   For example, if it is not necessary to do traffic analysis while you are
   capturing frames, disable traffic analysis processing.

 o Simplify event detectors.

   For example, more processing is required to filter by network-layer address
   pairs than by DLC address pairs. If possible (i.e. stations you are
   filtering by are on the local network, not on the other side of a router),
   substitute DLC addresses for the network-layer addresses that you want to
   monitor. If this is not possible, try using fixed offset pattern matches to
   match the network-layer addresses.

 o If capturing frames, slice them.

   If the entire frame is not needed for analysis, slice the frame (see
   Improving Capture Buffer and File Utilization).

 o Use a faster computer.

   For example, a 33 Mhz 486-based computer has much better performance than a
   20 Mhz 386-based computer.

 o Use a faster network adapter or reconfigure your existing network adapter.

   For example, an IBM DatagLANce Token-Ring 16/4 MC Adapter has better
   performance than an IBM Token-Ring Network 16/4 Trace and Performance
   Adapter/A.

   For the Ethernet DatagLANce, the IBM PS/2 Adapter/A for Ethernet Networks
   can be configured to have 8 KB or 16 KB of shared RAM. When the adapter is
   configured at 16 KB of shared RAM it gets better performance.

 Some adapter options available are common to all adapters being used; others
 are available only for specific adapters. We will discuss both the common and
 specific options.

 You can access the Adapter Options window by selecting Adapter Options from
 the Monitor menu of the DatagLANce Network Analyzer Control window. Two
 Adapter Options windows are provided:

 o Figure "Token-Ring DatagLANce Adapter Options" shows the Adapter Options
   window for the Token-Ring DatagLANce analyzer.

 o Figure "Ethernet DatagLANce Adapter Options" shows the Adapter Options
   window for the Ethernet DatagLANce analyzer.


  Token - RingDatagLANceAdapterOptions

 The top two lines of the Adapter Options window (below the menu bar) contain a
 description of the installed adapter, followed by the universally administered
 DLC adapter address.

 The Adapter Mode group box permits you to select between Promiscuous or Normal
 mode.  Promiscuous mode causes all frames on the network to be processed and
 monitored.  Normal mode causes only frames to the broadcast address or the
 universally administered DLC address of the adapter to be monitored.

 The Process Options group box permits you to select whether complete frames or
 the beginning of frames should be processed. Since large frames can require a
 considerable amount of processing time, this option permits you to limit the
 bytes of each frame being examined by the DatagLANce analyzer. Note this
 option differs from slicing a frame when capturing. (See Improving Capture
 Buffer and File Utilization.) This option limits the processing of bytes of a
 frame; slicing, when capturing, limits only the storage of the bytes of a
 frame.

 The Adapter Filter Options offer choices for limiting the frames being
 processed to a subset of network traffic. For the Token-Ring DatagLANce
 analyzer, the Adapter Filter Options allow you to select the types of frames
 processed and whether to process frames with or without specific addresses.
 These options are available only when the adapter is in Promiscuous mode. The
 Frame Types radio buttons allow you to limit processing to both MAC and LLC
 frames, LLC frames only, or MAC frames only.

 The Frame Addresses radio buttons enable you to limit processing to frames
 with specific DLC addresses. Selecting the Process Frames for All Addresses
 radio button will process all frames regardless of address. Selecting the
 Process Frames Matching Addresses radio button will process all frames whose
 source or destination address matches one of the selected addresses. Selecting
 the Do not Process Frames Matching Addresses radio button will cause the
 DatagLANce analyzer not to process frames whose source or destination address
 matches one of the selected addresses.

 The Select Frame Addresses for Processing push button opens the window that
 permits you to select the addresses. This window works like the Destination
 Addresses Event Detector window (see Figure "Destination Addresses Event
 Detector Options") except for a capacity limit of 10 specified addresses.

 The Enable Congestion Handling check box enables you to activate a congestion
 handling function. With this function, the DatagLANce analyzer can discard
 frames if the adapter becomes congested. This option attempts to prevent the
 DatagLANce analyzer from locking up under extreme network load conditions.


  Ethernet DatagLANce Adapter Options

 For the Ethernet DatagLANce analyzer, the only options that differ are the
 adapter filter options. These options are available in either Promiscuous or
 Normal mode.

 The Process Broadcast Frames check box causes the DatagLANce analyzer to
 process frames going to the broadcast destination address.

 The Process Multicast Frames check box causes the DatagLANce analyzer to
 process frames that are going to group destination addresses.

 The Process Runts check box causes the DatagLANce analyzer to process frames
 that are less than 64 bytes long.

 The Process Frames with Errors check box causes the DatagLANce analyzer to
 process frames that have errors.  You must also choose the Process Runts
 option in order to process collision fragments.


ΓòÉΓòÉΓòÉ 7.18. Summary ΓòÉΓòÉΓòÉ

This chapter described in detail the DatagLANce Monitoring functions. Using
these functions, you can now monitor events and activity on your network, look
for performance and network problems, and fine-tune your network.

When problems occur, it might be necessary to view the messages that travel on
the network in more detail. The next chapter, Capturing Frames from the
Network, describes how to instruct the DatagLANce analyzer to collect these
messages. Analyzing Captured Frames discusses the analysis of the collected
frames.


ΓòÉΓòÉΓòÉ 8. Capturing Frames from the Network ΓòÉΓòÉΓòÉ

When network problems arise, determining the cause of the problem can be a
difficult task. The DatagLANce Network Analyzer helps you by enabling you to
capture frames that are being transmitted on the network.


ΓòÉΓòÉΓòÉ 8.1. Overview of DatagLANce Frame Capture Capability ΓòÉΓòÉΓòÉ

The DatagLANce Network Analyzer can:

 o Select the size of the memory capture buffer using the BUFSIZE= parameter on
   the DatagLANce Network Analyzer Device Driver statement in the CONFIG.SYS
   file. See The BUFSIZE= Parameter.

 o Capture frames to the memory capture buffer or directly to a capture file.

 o Select which frames are to be captured using a frame capture filter.

 o Slice frames that are captured to maximize capture buffer or capture file
   utilization.

 o Start capturing only when a specific condition occurs, such as time of day
   or a frame event.

 o Trigger the capture on a specific frame event, stopping the capture after a
   certain amount of data has been captured following the trigger event.

 These functions are discussed in detail in the following sections.


ΓòÉΓòÉΓòÉ 8.2. The Capture Menu ΓòÉΓòÉΓòÉ

The DatagLANce Network Analyzer control window contains a menu that permits
selection of the capture options. This menu is labeled Capture and is shown in
Figure "DatagLANce Capture Menu".


DatagLANce Capture Menu

The Capture menu contains the following items:

 Disabled
      No frames are to be captured. When selected, this option permits certain
      other monitoring functions to be performed that cannot be done while
      capturing frames.

 Frames
      Capturing functions are enabled.

 Capture to Buffer
      Selects a memory buffer as the capture destination. See Capturing to the
      Capture Buffer Versus Capturing to File for more information.

 Capture to File
      Selects a disk file as the capture destination. See Capturing to the
      Capture Buffer Versus Capturing to File for more information.

 Capture Full Frames
      Specifies the number of bytes to save from each frame captured. See
      Improving Capture Buffer and File Utilization for more information.

 Slice Frames
      Specifies the number of bytes to save from each frame captured. See
      Improving Capture Buffer and File Utilization for more information.

 Start Capture
      Determines what condition starts the capture. See Selecting When to Start
      Capturing: The Capture Start Event for more information.

 Frame Capture Filter
      Selects which frames to capture, once the capture has begun. See Figure
      "Frame Capture Filter" for more information.

 Trigger/Stop Capture
      Selects when to stop or trigger the capture. See Selecting When to Stop
      Capturing: The Trigger/Stop Capture Options for more information.

 These menu choices are discussed in more detail in the following sections.


ΓòÉΓòÉΓòÉ 8.3. Selecting Frames to Be Captured: The Frame Capture Filter ΓòÉΓòÉΓòÉ

The Frame Capture Filter enables you to request the capture of frames from a
subset of network traffic. Specify this subset by logically combining the
DatagLANce event detectors into a Frame Capture Filter.

When you select Frame Capture Filter from the Capture menu of the DatagLANce
Network Analyzer control window, the window shown in Figure "Frame Capture
Filter" is displayed.


Frame Capture Filter

The Enable check box activates the frame capture filter. When the filter is
enabled, only frames for which the frame capture filter equation in the list
box is TRUE, are captured. When the filter is not enabled, all frames will be
captured. See Understanding Event Equations for information about editing the
equation.


ΓòÉΓòÉΓòÉ 8.4. Selecting When to Start Capturing: The Capture Start Event ΓòÉΓòÉΓòÉ

The Capture Start Event causes the DatagLANce analyzer to start capturing after
monitoring has begun. To specify this event, select the Start Capture choice
from the Capture menu in the DatagLANce Network Analyzer control window. When
you select this menu choice, the window shown in Figure "Start Capture Options"
is displayed.


Start Capture Options

The options for starting a capture are:

 Start Capture Immediately
      Starts the capture immediately when the DatagLANce analyzer begins
      monitoring.

 Start Capture on User Control Only
      Starts the capture only when the user clicks the Start push button in the
      Capture Status/Control window. See Figure "Capture Status/Control
      Window".

 Start Capture at Date/Time
      Starts the capture when the DatagLANce time clock matches the date and
      time specified in the edit fields next to this option.

 Start Capture
      Starts the capture when the event equation in the list box below this
      option is true. For more information on editing event equations, see
      Understanding Event Equations. If you select the After Start Date/Time
      check box, the capture starts on the first event specified by the event
      equation after the date and time specified in the edit fields above this
      check box.

 The Capture Start Event is defined as the condition on which the capture
 starts. It is specified by selecting one of the preceding four options. Frames
 are not captured until the start event occurs (or you override this start
 event by manually forcing the capture to start). When the capture starts, the
 DatagLANce analyzer captures all frames matching the Frame Capture Filter. See
 Figure "Frame Capture Filter".

 In the next section, we discuss the options for stopping the capture as well
 as a special function called triggering the capture.


ΓòÉΓòÉΓòÉ 8.5. Selecting When to Stop Capturing: The Trigger/Stop Capture Options ΓòÉΓòÉΓòÉ

Once capturing begins, all frames matching the Frame Capture Filter are
captured. Capturing continues until you tell the DatagLANce analyzer to stop
capturing frames or until some event occurs that automatically causes the
capture to stop. You specify the Capture Stop Event by selecting the
Trigger/Stop Capture choice from the Capture menu of the DatagLANce Network
Analyzer control window. When you select this menu choice, the window in Figure
"Trigger/Stop Capture Options" is displayed.


Trigger/Stop Capture Options

The options for stopping a capture are:

 Stop Capture on User Control Only
      Stops the capture only when the user clicks on the Stop push button in
      the Capture Status/Control window. See Figure "Capture Status/Control
      Window".

 Stop Capture when Capture Buffer Full
      Stops the capture when the capture buffer (or file to which frames are
      being captured) is full.

 Stop Capture at Date/Time
      Stops the capture when the DatagLANce time clock matches the date and
      time specified in the edit fields next to this option.

 Trigger
      Instructs the DatagLANce analyzer to look for a frame that matches the
      event equation in the list box beneath this option and then to begin the
      process of stopping the capture. For more information about editing event
      equations, see Understanding Event Equations.

 Stop on Alarm
      See Configuring Alarms: The Alarm Options for more information.

 The Capture Trigger Event is defined as the first frame seen that matches this
 equation. When this frame is identified by the DatagLANce analyzer, it is
 marked as the Trigger Frame and the capture is stopped some time after this
 frame.

 All frames captured can be stored in the DatagLANce capture buffer or directly
 to a file. These options and the advantages of each are discussed in Capturing
 to the Capture Buffer Versus Capturing to File.

 When you capture to the capture buffer (as opposed to the capture file), you
 can specify the position of the Trigger Frame in the buffer by using the
 vertical scroll bar at the bottom left of the window labeled Trigger Position
 in Capture Buffer. This option permits you to specify how much data to capture
 before and after the Trigger Frame.

 When you capture to a file, the capture always stops when the trigger frame
 has been identified.


ΓòÉΓòÉΓòÉ 8.6. Capturing to the Capture Buffer Versus Capturing to File ΓòÉΓòÉΓòÉ

The DatagLANce analyzer has two options for storing the captured frames. Each
option has particular advantages over the other in frame capture ability. These
advantages are discussed in this section.

The Capture menu of the DatagLANce Network Analyzer control window (see Figure
"DatagLANce Capture Menu") permits you to select where captured frames are
stored during a capture:

 Capture to Buffer
      Causes the frames captured to be stored in the DatagLANce capture buffer.
      The user defines the size of the buffer.  See DatagLANce Device Driver
      Options. When the Stop Capture when Buffer Full stop option is not
      enabled the DatagLANce analyzer continuously stores frames in this buffer
      until the capture stops (see Selecting When to Stop Capturing: The
      Trigger/Stop Capture Options), When the buffer is full, the oldest
      entries are discarded to make space for the new entries. (The buffer
      wraps.) When a capture stops, a wrapped buffer is full and contains the
      most recently captured frames.

 Capture to File
      Causes frames to be captured directly to a capture file on one of the
      system's available disk drives. This option permits the capturing more
      data than the capture buffer can handle. Writing to the file is not as
      fast as writing to memory (that is, to the capture buffer) and increases
      the probability of missed frames.  To reduce the number of frames missed
      due to the time required for writing data to the capture file, the
      capture buffer is used to store the frames temporarily. This permits the
      DatagLANce analyzer to handle bursts of traffic faster than it can write
      to the file for short periods of time without missing any frames. When
      the capture buffer becomes full, frames will be discarded until there is
      sufficient room to write the next frame to the file.

 When you select the Capture to File choice from the Capture menu of the
 DatagLANce Network Analyzer control window, the window shown in Figure
 "Capture to File Options" is displayed.


  Capture to File Options

 The Maximum Allowed File Size option sets a size limit for the capture file.
 When the capture data exceeds this limit, the DatagLANce analyzer will either
 stop the capture or write over the earlier frames recorded depending on the
 trigger/stop capture option selected. See Selecting When to Stop Capturing:
 The Trigger/Stop Capture Options. You can change the file size by using the
 scroll bars next to the Maximum Allowed File Size edit field or by entering it
 directly in the edit field. K stands for kilobytes, and M stands for
 megabytes.

 If you choose a file size less than the capture buffer size, the DatagLANce
 analyzer will use the capture buffer size for the maximum file size.

     Warning: The operating system requires enough disk space for its swapper
     file. It is your responsibility to supply sufficient disk space to
     accommodate a growing swapper file and a growing capture file. Refer to
     SWAP in the online OS/2 Command Reference.

 The Priority of File Writing options select the importance given to devoting
 processor time to writing the file. Time-Critical priority will cause the
 DatagLANce analyzer to write as much capture data to the file as fast as it
 can. Fixed High priority is lower priority than Time-Critical, but higher than
 normal priority. Normal priority is the standard priority given by the
 operating system to all system applications.

 The Pathname edit field permits you to select the name of the capture file.

 When you have completed the entries on this screen, click on the OK push
 button or double-click on the file name with mouse button 1.

 In summary:

 o Use of a buffer permits the use of a trigger point.

 o Capturing to a file permits you to capture up to the limit of the available
   disk space on your computer. Although not as fast as capturing to the
   buffer, this option permits you to gather larger amounts of capture data.


ΓòÉΓòÉΓòÉ 8.7. Improving Capture Buffer and File Utilization ΓòÉΓòÉΓòÉ

In the last section we talked about storing captured frames in the capture
buffer or in a file on disk. Each destination for frame data has advantages
over the other, but they also have disadvantages in capacity or performance. In
this section, we discuss ways to overcome performance and capacity limitations
by controlling the amount of data captured.

There are two ways to improve capture buffer and disk utilization:

 o Capture only the frame traffic you need and ignore the rest. This was
   discussed in Figure "Frame Capture Filter". This technique improves capture
   buffer and file utilization by not capturing frames that clutter up the
   buffer. The frames captured will be a subset of the original traffic and
   only that subset needs to be analyzed.

 o Discard data from the end of frames. The headers at the beginning of each
   frame contain most of the useful information about that frame. By slicing
   the frame at 176 bytes, for example, the DatagLANce analyzer eliminates some
   of the less important frame data from the capture data. As long as the slice
   size is smaller than the size of the frames being captured, slicing
   increases both the number of frames captured and the capture speed.

 The Capture menu of the DatagLANce Network Analyzer has two menu choices that
 allow you to select the number of bytes to save from each frame captured:

 Capture Full Frames
      Causes all bytes in every captured frame to be saved.

 Slice Frames at xx bytes
      Specifies that a maximum of xx data bytes will be saved from the
      beginning of every captured frame. When you select this menu choice, the
      window shown in Figure "Slice Frames Options" is displayed.


  SliceFramesOptions

 This window lets you select to save from 88 bytes up to the full frame, in
 multiples of 88 bytes, from each captured frame. Select the slice size by
 clicking on the appropriate radio button or by specifying the slice size in
 the slice edit field. This number sets the maximum number of bytes saved from
 each captured frame.

 Specifying a frame capture filter and slicing frames can help minimize the
 amount of information you need to sort through after a capture as well as
 overcome the frame-storing limitations of the capture buffer and capture file.


ΓòÉΓòÉΓòÉ 8.8. Displaying Capture Status and Controlling the Capture ΓòÉΓòÉΓòÉ

After you have entered your capture options, the DatagLANce analyzer is
prepared to capture frames. Each time you start the DatagLANce Monitor
function, the DatagLANce analyzer will begin looking for the Capture Start
Event (see Controlling the DatagLANce Network Analyzer).

The Capture Status/Control window, shown in Figure "Capture Status/Control
Window", provides an example of key information about your capture. To display
this window, select the Capture Status/Control choice from the Window menu in
the DatagLANce Network Analyzer control window.


Capture Status/Control Window

The Capture Status group box contains messages indicating significant capture
times and events. Status displays one of the following capture status
conditions:

 Disabled
 Waiting for Start
 Started
 Triggered
 Stopped
 Beneath Status is the elapsed time indicator showing the amount of time in
 days, hours, minutes, and seconds that the DatagLANce analyzer spent capturing
 data.

 The Buffer/File Status group box displays the current capture buffer or file
 status. A bar graph displays the extent to which the buffer or file is full.
 Displayed beneath this bar graph and to the left is the percentage full in
 numeric format. The percentage full indicator changes to WRAPPED when the
 buffer or file has reached its capacity and the capture function must
 overwrite the oldest data captured to accommodate the most recent entries. A
 vertical bar moves within the bar graph to indicate the position of the most
 recent data. The number of frames captured is displayed beneath the bar graph
 to the right. If the buffer or file has wrapped, this count is larger than the
 number of frames that are left in the buffer or file since the earlier frames
 have been overwritten.

 When you choose to trigger on an event and capture past the trigger, the
 DatagLANce analyzer performs the following steps:

  1. Fills the capture buffer to the percentage full that you specified for
     data before the trigger

  2. Overwrites the oldest capture data with the newest capture data (wraps)
     until the trigger condition occurs

  3. Senses and captures the trigger condition

  4. Completes filling the capture buffer

  5. Stops the capture

 At the bottom of the Capture Status/Control window are three push buttons:

 o The left button is a capture control button that at various times will
   display Start, Stop or New. It permits you to start or stop a capture
   unconditionally, or to start a new capture while the DatagLANce analyzer
   continues to monitor.

 o The middle push button, Timestamps, displays a window indicating when the
   capture started, triggered, and stopped, if you click on it after a capture
   has occurred.

 o The rightmost push button, Analysis, starts a protocol analysis session for
   the frames just captured. After your capture has finished, click on this
   push button to see those frames.

   The DatagLANce protocol analysis software accepts data for analysis from
   either the capture buffer or the capture file. If you have an active
   protocol analysis session but are not currently analyzing frame data, the
   DatagLANce analyzer uses that session for analysis. Otherwise, the
   DatagLANce analyzer starts a new protocol analysis session for you.
   Initialization of the new session will take some time to complete. For
   efficiency, it is a good idea to keep one session of the DatagLANce protocol
   analysis software running in the background.


ΓòÉΓòÉΓòÉ 8.9. Improving Capture Performance ΓòÉΓòÉΓòÉ

Since the DatagLANce analyzer monitors the network and captures frames at the
same time, all statistics based on network activity are available while
capturing. This monitoring can take a great deal of processing time from your
DatagLANce analyzer. If you do not need complete monitoring, you can reduce the
amount of traffic being processed by using the adapter options available for
your adapter. See Improving Monitoring Performance: The Adapter Options for a
complete discussion of adapter options available. In addition, active
applications - like traffic statistics, Network Glance, filters for custom
events, and non-DatagLANce background applications - can reduce system
performance. By limiting the size of each frame processed, limiting the number
of frames, and shutting off unneeded applications, you can increase capture
performance.


ΓòÉΓòÉΓòÉ 8.10. Summary ΓòÉΓòÉΓòÉ

This chapter has described in detail the DatagLANce analyzer's Capturing
functions. Using these functions, you can now configure the DatagLANce analyzer
to start capturing frames from the network, select only those frames that you
would like captured, and stop the capture at the appropriate time.

You have seen how the Capture Status/Control window displays capture status
information and permits you to control the capture and start protocol analysis.
Analyzing Captured Frames discusses how to use the DatagLANce protocol analysis
software.


ΓòÉΓòÉΓòÉ 9. Analyzing Captured Frames ΓòÉΓòÉΓòÉ

After a capture has been completed, the next step is to view the captured
frames. This chapter discusses the functions and analysis capabilities of the
DatagLANce Network Analyzer's protocol analysis software.

This software permits you to analyze DatagLANce token-ring, Ethernet, and FDDI
(collected by an FDDI DatagLANce analyzer) capture data. The DatagLANce
analyzer also lets you analyze a variety of token-ring and Ethernet capture
files recorded in other formats. This chapter documents the protocol analysis
functions.


ΓòÉΓòÉΓòÉ 9.1. Starting a DatagLANce Protocol Analysis Session ΓòÉΓòÉΓòÉ

After a DatagLANce capture has taken place, click on the Analysis button on the
Capture Status/Control window of the DatagLANce Network Analyzer software and
invoke the DatagLANce protocol analysis software to analyze the capture data
stored in the capture buffer or capture file.

Alternatively, the Analysis! menu choice on the DatagLANce Network Analyzer
Window can be used to start a protocol analysis session to analyze the data
captured.  If a capture has not been performed, a protocol analysis session
will be started for you to analyze a capture file.

If you want to do analysis when the DatagLANce Network Analyzer software is not
running, you can run the DatagLANce protocol analysis software directly from
the DatagLANce Icon View window on the OS/2 Desktop (Figure "DatagLANce - Icon
View Window").


DatagLANce - Icon View Window

When you select the Protocol Analysis icon, the DatagLANce protocol analysis
software will be started. The next step is to open the capture file to be
analyzed.


ΓòÉΓòÉΓòÉ 9.2. Opening a Capture Data File for Analysis ΓòÉΓòÉΓòÉ

When first invoked, the DatagLANce protocol analysis software loads,
initializes, and waits for a capture file to be opened. The Open Capture Data
File choice in the File menu of the DatagLANce Protocol Analysis window permits
you to open a capture file for analysis. Selecting this menu choice causes the
window in Figure "Open Capture Data File" to be displayed.


Open Capture Data File

The Files list box displays all of the capture data files in the directory
Path. This directory can be changed by selecting any of the directories in the
Directories list box.

The Format group box permits you to select the file format that you would like
to analyze. The following file formats are supported by the DatagLANce
analyzer:

 DGC       IBM DatagLANce Network Analyzer family

           Older FDDI DatagLANce files were named with an .FNC file extension
           instead of the .DGC extension, but the format is unchanged. To
           analyze these frames, rename the file or enter *.FNC in the Filename
           edit field and select the OK push button.

 TR0       IBM Trace and Performance Program

           The Trace and Performance Program was the predecessor to the
           DatagLANce analyzer, The DatagLANce analyzer can analyze the trace
           files that it stored. This program created files with extensions
           (.TR0 -.TR9 and .TRA -.TRX).

 PDA       Protools' Foundation Manager

           The token-ring and Ethernet capture files created by Protools'
           Network Control Series** (Foundation Manager** and Cornerstone
           Agent**) products.

 TRC       Network General's Token-Ring Sniffer

           Analyze captured files created by Network General's Token-Ring
           Sniffer product.

           Note:  Ensure that the file is not saved in compressed format.

 ENC       Network General's Ethernet Sniffer

           Analyze captured files created by Network General's Ethernet Sniffer
           product.

           Note:  Ensure that the file is not saved in compressed format.

 TR1       Novell LANalyzer** file format

           The DatagLANce analyzer will analyze the token-ring and Ethernet
           capture files created by Novell's LANalyzer and LANalyzer for
           Windows** products.

 When a radio button in this group is selected, the appropriate files will be
 displayed in the Files list box.

 After you select the file to be analyzed from the Files list box, click on the
 OK push button or double-click, with mouse button 1, on the name of the file.


ΓòÉΓòÉΓòÉ 9.3. The Frame Summary: A Summary of Frames Captured ΓòÉΓòÉΓòÉ

When the capture buffer or a capture data file is first opened, the DatagLANce
analyzer displays the frames in summary form, (see Figure "Frame Summary
Window").


Frame Summary Window

Each frame that has been captured is summarized as a single record on a line of
the frame summary window. Frame type, destination and source addresses, size,
and interpretation are displayed in columns.

The menu bar provides access to pull-down menus with choices that perform
different analysis functions on the frame records. These functions are
discussed in the following sections.

A selected record is highlighted in reverse video in this window. This record
is important because menu choices perform specific actions on this record.
Select a record by clicking on the record with mouse button 1 or by using the
cursor movement keys (up and down arrows, home, end) from the keyboard.

Click on the vertical scroll bar (on the right side of this window) to move
anywhere within the captured data. You can also use the PgUp and PgDn keys on
the keyboard to move throughout the captured data.

You can use the horizontal scroll bar to scroll left and right to display
information that does not fit into the window. The Display menu (discussed in
the next section) is used to hide summary fields that are not of interest. On
the keyboard, the left and right arrow keys also scroll the display
horizontally.


ΓòÉΓòÉΓòÉ 9.3.1. Selecting Frame Summary Information to Be Displayed ΓòÉΓòÉΓòÉ

In the Display menu on the Frame Summary window, shown in Figure "Frame Summary
Display Options", you can select the information to be displayed about each
frame.


Frame Summary Display Options

The right column of this menu contains choices that affect how the data is
displayed and the format of the data.

The left column lists choices you can select to display. Click on each item you
want to display.  When you select an item, a check mark is displayed next to
it. A field can be displayed or hidden by selecting the appropriate menu choice
for the field. Each of these display field options is discussed in this
section.

 Flags
      Appears in the leftmost column of the summary. Displays flags concerning
      the frame being displayed on that line. Each flag is a single character
      and has the following meanings:

    T    The Trigger Frame. See Selecting When to Stop Capturing: The
         Trigger/Stop Capture Options for more information.

    R    The Reference Frame. See Frame Offset Versus Frame Record Number for
         more information.

    M    The Marked Frame. See Measuring Relative Time between Frames for more
         information.

    N    A Bookmark; n is a number 1-8. See Bookmarks for more information.

    E    Error. This frame contains a CRC or CRC/alignment error. See Frame
         Detail: Detailed Protocol Analysis for more information.

    !    Missed frames. One or more frames were missed before this frame was
         captured. The number of frames missed before the frame was captured is
         displayed in the Frames Missed field.

 Frames Missed
      The column entitled Missed displays the total number of frames that were
      missed between this and the previous captured frames.

      The DatagLANce analyzer can miss frames under two conditions: (1) The
      capture buffer is filled before being able to write to a file. See
      Improving Capture Buffer and File Utilization for information about
      overcoming this limitation. (2) The network adapter becomes congested. In
      this case, the frames missed count is the approximate number of frames
      that were missed or dropped before or after this frame. The DatagLANce
      analyzer sometimes drops frames in an attempt to reduce network traffic.
      See Improving Monitoring Performance: The Adapter Options and Improving
      Capture Performance.

 Frame Offset/Number
      If Byte Offset is selected in the Display menu, this information is
      titled Offset and displays in hexadecimal the number of bytes from the
      beginning of the capture file to the beginning of this frame.

      If Record Number is selected in the Display menu, this information is
      titled Number and displays the record number of the frame relative to the
      reference frame. This is discussed in more detail in Frame Offset Versus
      Frame Record Number.

 Frame Control (token-ring and FDDI)
      The column entitled FC displays the frame control byte of the frame in
      hexadecimal (see Frame Control Field (Token-Ring)).

 Frame Type
      The column entitled Type displays an interpretation of the frame control
      (token-ring and FDDI) in terms of the type of the frame (for example, LLC
      or MAC). For Ethernet, this field will be displayed as either 802.3 (for
      IEEE 802.3 frame format) or Ether (for Ethernet DIX V2 frame format). See
      Frame Formats for details on these formats.

 Destination Address
      The column entitled Destination displays the destination address of the
      frame.

      The Address Field Width option in the Display menu selects the width of
      this field.

      The DLC Addresses, Network Addresses, and Highest Address Level choices
      in the Display menu select whether the address displayed will be the DLC
      address (MAC station address), the network address (specific to the
      network-layer protocol within the frame), or the highest address level
      that is encapsulated in the frame.

      If the Numeric Addresses choice is selected in the Display menu, this
      address will be displayed numerically. For DLC addresses, the address is
      displayed in hexadecimal with colons or hyphens between each byte in the
      address to distinguish between MSB and LSB (canonical) address
      representations, respectively.

      If you select the Symbolic Names choice in the Display menu, the
      DatagLANce analyzer will display the symbolic name for the address, if
      one is available. See Symbolic Names Support for more information.

 Source Address
      The column entitled Source displays the source address of the frame. The
      menu choices that affect Destination Address also affect this column.

 Frame Size
      The column entitled Size displays the size of the frame in bytes.

      The size of a frame is the number of data bytes within the frame. This
      differs from frame length (see Network Statistics: Network Performance at
      A Glance) because control information (start and end delimiters)
      associated with the frame is not counted.

      Note:  For the Token-Ring DatagLANce analyzer, the frame check sequence
      is not available for display and is not counted in this number.

 Frame Status (token-ring and FDDI)
      The column entitled FS displays the frame status indicators.

      For FDDI, it is displayed in the form EAC? where E stands for Error
      Detected (CRC Error), A stands for Address Recognized, C stands for Frame
      Copied, and ? stands for user frame status.

      Each status indicator is displayed as an R (reset) or S (set). Reset
      indicates that the action has not occurred. Set indicates that the action
      has completed successfully. If any of these frame status indicators is
      missing, it is displayed as a blank.

      Usually FDDI frames do not have a user frame status indicator. If a frame
      does have one or more user frame status indicators, only the first is
      displayed in the summary. The remainder can be viewed in the frame's
      detail. (See Frame Detail: Detailed Protocol Analysis.)

      For token-ring, this field is displayed in the form AC, where A stands
      for Address Recognized and C stands for Frame Copied.

      Each status indicator is displayed as an R (reset) or S (set). Reset
      indicates that the action has not occurred. Set indicates that the action
      has completed successfully.

 Absolute Time
      The column entitled Time-stamp displays the arrival time of a frame.

      It is displayed in the form: MM/DD/YY HH:MN:SS.mmm uuu nnn where MM is
      month, DD is day of month, YY is year, HH is hour, MN is minutes, SS is
      seconds, mmm is milliseconds, uuu is microseconds, and nnn is
      nanoseconds. For more information on time-stamps, see The High-Resolution
      Time-Stamp Option.

 Delta Time
      The column entitled Delta Time (msec) displays the arrival time
      difference between frames in milliseconds.  The first frame in the
      summary does not have a delta time-stamp.

 Relative Time
      The column, entitled Relative Time (sec) displays the arrival time
      difference between each frame and the Marked Frame. This is discussed in
      Measuring Relative Time between Frames.

 Interpretation
      The column entitled Interpretation displays a summary of the protocol
      interpretation for the frame.

      If the All Protocol Levels choice is selected in the Display menu, a
      summary of all protocol headers in the frame is displayed, from lowest
      level to highest level. Each level has a different color to distinguish
      it from the others.

      If the Highest Level Only choice has been selected in the Display menu, a
      summary of only the highest level protocol interpreted for the frame is
      displayed.

      If the Specific Protocols Only choice has been selected in the Display
      menu, only the specific protocols selected (see Displaying Specific
      Protocols in the Frame Summary) are displayed.


ΓòÉΓòÉΓòÉ 9.3.2. Frame Offset Versus Frame Record Number ΓòÉΓòÉΓòÉ

The DatagLANce analyzer has two methods of displaying the location of a frame
within the capture data, byte offset, and record number.

The byte offset of a frame is displayed when the Byte Offset choice is selected
from the Display menu in the Frame Summary window. Figure "Frame Summary with
Byte Offsets of Frames Displayed" shows the Frame Summary window when the byte
offsets of frames are displayed.


Frame Summary with Byte Offsets of Frames Displayed

The byte offset of each frame record is displayed in the Offset column. Note
that this display does not easily show how close the frames are to one another,
or whether any frames occur between the frames displayed. See Figure "Display
Filter Equation Edit Window" for information on how to further filter the
frames to display only a subset of the captured frames. Figure "Frame Summary
with Record Numbers of Frames Displayed" shows the Frame Summary Display when
the record numbers of frames are displayed.


Frame Summary with Record Numbers of Frames Displayed

In this window it is easy to see the number of frames that occur between the
frames that are shown. The record number of each frame is shown in the Number
column. This record number is the number of a frame relative to the reference
frame.

The reference frame is a frame that the user defines as a point of reference
for record numbers. This frame is defined by selecting the Define Reference
Frame choice in the Analysis menu. Choosing this item causes the selected
record to be defined as the reference frame.

The reference frame always has a record number of zero, because the record
number of a frame is calculated relative to this frame. All the frames before
the reference frame have a negative record number, and all frames after the
reference frame have a positive record number. Also, an R is displayed in the
Flags column (if flags are displayed) identifying the reference frame.

The DatagLANce analyzer supports offset and record mode. When it is analyzing
those frames from the FDDI DatagLANce analyzer, it must calculate frame numbers
by using sequential searches. This option is available to avoid that processing
time.

In summary:

 o In byte offset mode, the DatagLANce analyzer enables movement within the
   captured data with minimal processing time, but forfeits the ability to
   identify the number of records between the frames displayed.

 o Record number mode gives you relative record numbers of frames, but can
   require significant calculation time (for example, for FDDI DatagLANce
   capture data) to determine these numbers based on what frame has been
   defined as the reference frame.


ΓòÉΓòÉΓòÉ 9.3.3. Measuring Relative Time between Frames ΓòÉΓòÉΓòÉ

The Delta Time frame summary display option shows the difference between two
adjacent frame time-stamps in the frame summary.

Figure "Frame Summary with Absolute and Delta Time-Stamps" illustrates a frame
summary with both absolute and delta time-stamps display options selected.


Frame Summary with Absolute and Delta Time-Stamps

This display shows the arrival time-stamps of each frame as well as the delta
time between these time-stamps.

The relative time of a frame is the difference in time between a frame's
absolute time stamp and the absolute time-stamp of the marked frame.

The marked frame is the frame from which relative time-stamps are calculated.
You can define this frame by selecting the frame to mark and selecting the Mark
Frame menu choice in the Analysis menu.

Once the marked frame has been defined (or redefined, since some frame is
always marked), the relative time of the frame that is marked becomes zero. All
frames before the marked frame have negative relative times and all frames
after the marked frame have positive relative times. An M is displayed in the
Flags column indicating the marked frame.


Frame Summary with Absolute and Relative Time-Stamps

Observe in Figure "Frame Summary with Absolute and Relative Time-Stamps" that
the difference in time between frame 258 (the frame we marked) and the frame
278 in the window is 0.07 seconds.

In summary:

 o The delta time of a frame is the difference between the absolute time-stamps
   of a frame and the frame displayed above it.

 o The relative time of a frame is the difference between the absolute
   time-stamps of a frame and the marked frame.


ΓòÉΓòÉΓòÉ 9.3.4. Bookmarks ΓòÉΓòÉΓòÉ

Bookmarks are frame summary entries that have been marked so that they can be
referenced and recalled easily.

A bookmark is defined by selecting the entry on the Frame Summary window to
mark and then selecting a number in the Define Bookmark submenu of the Analysis
menu. The number of the bookmark then is displayed in the Flags column. If the
frame is defined as the marked frame, its bookmark number is not displayed
because bookmark numbers appear in the same column as the M for marked frame.

Bookmarks are useful for the following reasons:

 o When moving within the captured data. By marking a frame with a bookmark,
   you can move back to that frame sometime in the future by selecting the
   bookmark number within the Jump to Bookmark submenu of the Search menu. You
   can also do this by pressing the numerical key on your keyboard that
   corresponds to the number of the bookmark you want.

 o When printing or saving frame data, you can use bookmarks to avoid entering
   the record offset or record number of the start and end frames to print or
   save. See Printing Frame Data and Saving Frame Data for more information
   about printing and saving frames.


ΓòÉΓòÉΓòÉ 9.3.5. Moving within the Frame Summary: Jump ΓòÉΓòÉΓòÉ

One method of moving within the capture data is by dragging the vertical scroll
bar in the Frame Summary window to the position desired within the capture
data. This gets us to the general vicinity of where we want to go, but when 1.4
GB of data is being analyzed, one notch of the scroll bar control might be 32
MB of data.

To make things easier, the DatagLANce analyzer permits you to jump to specific
frames within the data. This is accomplished by selecting the appropriate jump
option from the Frame Summary window's Search menu. The jump options available
in this menu are described in the following information:

 Jump to First Frame
      Jumps to the first frame in the capture data.

 Jump to Last Frame
      Jumps to the last frame in the capture data.

 Jump to Marked Frame
      Jumps to the marked frame.

 Jump to Reference frame
      Jumps to the reference frame.

 Jump to Trigger Frame
      Jumps to the trigger frame. If there is no trigger frame within the
      captured data (the user stopped the capture before the trigger was
      detected or the capture was not set up to trigger), this menu choice is
      grayed.

 Jump to Bookmark
      Jumps to any of the bookmarks that are defined. Undefined bookmark
      numbers are grayed.

 Jump to Frame
      Jumps to a specific frame offset (if in byte offset mode), specific frame
      record number (if in record number mode), or any of the above options.

 When the Jump to Frame menu choice in the Search menu is selected, the window
 in Figure "Jump to Frame Options Window" is displayed.


  Jump to Frame Options Window

 If the display is in the byte offset mode, the offset of a frame can be
 entered in the edit field of the list box.  If not, the record number of a
 frame can be entered in the field.

 Any of the options in the list box can also be selected. The contents of the
 combination box vary depending on whether a trigger frame exists and whether
 the reference frame or any bookmarks have been defined.


ΓòÉΓòÉΓòÉ 9.4. Displaying Specific Protocols in the Frame Summary ΓòÉΓòÉΓòÉ

The Interpretation field in the Frame Summary window displays a summary of the
protocol interpretation for the frame. When the Highest Level Only choice is
selected from the Display menu, the Interpretation field gives a good
indication of what higher protocol layer actions are occurring.

Sometimes, however, you might be interested in examining only a specific
protocol within the protocol stack. By selecting the Specific Protocols Only
choice from the Display menu, you can select which protocols to display/hide in
the Frame Summary window. When you select this choice from the menu, the window
in Figure "Specific Protocols to Display in Frame Summary Options" is
displayed.


Specific Protocols to Display in Frame Summary Options

The list box entitled, Available Protocol List, shows the available protocols
that are supported for protocol decoding. Most of the protocols are displayed
in the Frame Summary window, but some appear only in the Frame Detail window
(see Frame Detail: Detailed Protocol Analysis).

The Add push button adds the protocol selected in the list box labeled
Available Protocol List to the list box labeled Protocols to Display/Hide. The
Delete push button deletes the protocol selected in the Protocols to
Display/Hide list box. The Clear push button will clear the Protocols to
Display/Hide list box.

The Display Only These Protocols radio button specifies that only the protocols
in the Protocols to Display/Hide list box should be displayed in the Frame
Summary Window.

The Hide These Protocols radio button specifies that all protocols except the
protocols in the Protocols to Display/Hide list box should be displayed in the
Frame Summary Window.

The OK push button accepts the options specified, refreshing the Frame Summary
window to display/hide the protocols selected.

Note:  If you are interested in filtering the frames displayed by the protocols
selected, see Figure "Display Filter Equation Edit Window".


ΓòÉΓòÉΓòÉ 9.5. Frame Detail: Detailed Protocol Analysis ΓòÉΓòÉΓòÉ

The Frame Summary presents the frames that were captured in a summarized form.
Only one line per frame is used to present the information contained within
that frame. If you want a breakdown of the information in a frame to protocols
(detailed protocol decode), choose the Frame Detail display. This window is
displayed by selecting the Frame Detail option from the Display menu in the
Frame Summary window or by double-clicking on a record in the Frame Summary
window with mouse button 1. Figure "Frame Detail Window" shows the Frame Detail
window.


Frame Detail Window

The frame selected in the Frame Summary window is displayed in detail in this
window. Each protocol header in the frame is decoded in detail and in a
different color. The protocols supported by DatagLANce analysis are described
in Protocols Decoded.

Use the vertical and horizontal scroll bars, page, or cursor movement keys on
the keyboard to move within this window.

The Prev and Next menu selections cause the frame detail of the previous or
next frame in the frame summary to be displayed. Use the Window menu or the Tab
key to move between windows.

The highlighted line within the window is selected by using the scroll bar,
cursor keys, or by clicking on it with mouse button 1. This highlighted line is
linked to the Frame Hexdump display. Bytes that are interpreted on this line
(if there are any) are also highlighted in the Hexdump window. For information
on the Frame Hexdump, see Frame Hexdump: Dumped Frame Data.


ΓòÉΓòÉΓòÉ 9.5.1. Dumping Information Fields ΓòÉΓòÉΓòÉ

Some fields within the detailed protocol decode of a frame contain user data or
a format that can not be decoded. These information fields are presented in a
form that describes the number of bytes of data in the field but does not
display them. Selecting this field highlights the bytes in the Frame Hexdump
display. The Dump Information Fields option is also available to place a
hexadecimal and character dump of this data directly into the frame detail
display.


ΓòÉΓòÉΓòÉ 9.5.1.1. Frame Detail Display Options ΓòÉΓòÉΓòÉ

The Display menu of the Frame Detail window contains the following selections:

 Dump Information Fields
      Turns on or off the dumping of the information fields within the frame's
      detail. The fields are dumped in hexadecimal in their respective places
      for frames containing large information fields.

 ASCII characters and EBCDIC characters
      Selects whether the information fields that are dumped display the
      character dump of the data in ASCII or EBCDIC. These menu choices also
      control how other header fields within the frame are interpreted. (Telnet
      Data can be in either ASCII or EBCDIC.)

 Quick Filter
      Sets up a quick filter. (See Quick Filter: The Quick Equation Writer.)


ΓòÉΓòÉΓòÉ 9.6. Frame Hexdump: Dumped Frame Data ΓòÉΓòÉΓòÉ

Although Frame Summary displays a summary of the frames captured and Frame
Detail displays a detailed protocol decode of the frames captured, it might be
useful to examine the actual bytes of a frame that was captured. This can be
accomplished by using the Frame Hexdump display. This window is displayed by
selecting the Frame Hexdump choice from the Display menu in the Frame Summary
window or by double-clicking on any line within the Frame Detail window. Figure
"Frame Hexdump Window" shows the Frame Hexdump window.


Frame Hexdump Window

The data bytes in the frame selected in the Frame Summary window are displayed
in a dump format in this window.

Each line of this window displays 16 bytes of frame data in both hexadecimal
and ASCII or EBCDIC (selected from the Display menu). The data is displayed in
the color corresponding to the protocol header decoded in the Frame Detail
display. The offset of each line of frame data is displayed to the left in
hexadecimal.

Use the vertical and horizontal scroll bar, page, or the cursor movement keys
on the keyboard to move within this window.

The Prev and Next menu selections cause the frame hexdump of the previous or
next frame in the frame summary to be displayed. The Window menu or the Tab key
can be used to move between windows.

As a line is selected in the Frame Detail display the interpreted bytes on that
line are highlighted in the Frame Hexdump window. This is illustrated in Figure
"Frame Data Highlighted in Frame Hexdump".


Frame Data Highlighted in Frame Hexdump


ΓòÉΓòÉΓòÉ 9.7. Selecting Frames to Be Displayed: The Display Filter ΓòÉΓòÉΓòÉ

The Frame Capture Filter permits you to select which frames you want to
capture. This enables you to maximize the capture buffer and disk utilization
by capturing only the frames needed. This could be a large number of frames
involving communication among many stations using many protocols. See Figure
"Frame Capture Filter" for information about the Frame Capture Filter.

The Display Filter permits you to further filter the captured data so only a
subset of the captured frames are displayed. This filter is specified by
selecting the Display Filter choice from the Analysis menu in the Frame Summary
window. Figure "Display Filter Equation Edit Window" shows the Display Filter
Equation Edit window.


Display Filter Equation Edit Window

The Enable check box activates the display filter when it is selected.

A frame is displayed if it passes the event equation displayed in the list box
in this window. Editing this equation is discussed in Understanding Event
Equations.

The DatagLANce protocol analysis software supplies 8 event detectors per
analysis session.

Note:  The fastest way to set up the Display Filter is to use the Quick Filter
function. This function is activated by selecting Quick Filter from the Search
menu of the Frame Summary window. See Quick Filter: The Quick Equation Writer
for a description of this function.

The AND Frame Contains Protocols Selected for Display check box permits you to
filter out frames that do not contain specific protocols selected for display.
The Enable check box must be checked in order for this check box to take
effect.

The View/Select Protocols push button gives you access to the list of protocols
selected for display (as does the Specific Protocols Only menu choice in the
Display menu of the Frame Summary Window). The operation of the window that
appears after clicking this push button is discussed in Displaying Specific
Protocols in the Frame Summary.


ΓòÉΓòÉΓòÉ 9.8. Finding Text ΓòÉΓòÉΓòÉ

The Display Filter discussed in the previous section permits you to view a
subset of the captured data by selecting frames to be displayed; this is done
by logically combining eight event detectors. But suppose you would like to
find a frame containing information that is not searched for explicitly by the
event detectors, but that can be found within the Frame Summary or Frame Detail
interpretation of a frame. This can be accomplished by using the Find Text
option of the DatagLANce protocol analysis software.

Select the Find Text choice in the Analysis menu of the Frame Summary window to
begin the search. When you select this option, the window shown in Figure "Find
Text Options" is displayed.


Find Text Options

The Find group box has two radio buttons, Previous and Next. These radio
buttons select the text-search direction (backward or forward in the text) from
the selected record in the Frame Summary window.

The Search group box selects which text is searched. Summary Text specifies
that text in the Frame Summary window is searched. Detail Text specifies that
text in the Frame Detail window is searched.

The Filtered Frames Only check box specifies whether only frames matching the
Display Filter should be searched (see Figure "Display Filter Equation Edit
Window"). When this option is unchecked, the DatagLANce analyzer searches all
frames.

Match and Don't Match specify whether to match the search text or find the
first frame whose summary or detail text does not contain the search text.

Case Sensitive and Case Insensitive specify whether the text search is case
sensitive.

The text you want to find is entered in the Search Text edit field. The options
selected on this window determine the parameters of the search.

Selecting OK causes the search to begin. When the search has been completed,
you can search for the same text again by selecting Find Previous or Find Next
from the Search menu in the Frame Summary window.


ΓòÉΓòÉΓòÉ 9.9. Printing Frame Data ΓòÉΓòÉΓòÉ

Sometimes it is useful to obtain a hardcopy of one or more captured frames. The
DatagLANce analyzer permits you to print any or all of the captured frames in
its three frames presentation forms: Summary, Detail, and Hexdump. This
function is accomplished by selecting the Print choice from the File menu in
the Frame Summary window. When this menu choice is selected, the window shown
in Figure "Print Options" is displayed.


Print Options

The From and To fields allow either a frame byte offset (if in byte offset
mode) or a frame record number (if in record mode) to be specified. These list
boxes also allow selection of First, Last, Marked, Reference, Trigger, and any
bookmarks that have been defined.

The check boxes in the Formats group box specify the formats in which to print
data.

The Filtered Frames Only check box specifies whether only frames matching the
Display Filter should be printed (see Figure "Display Filter Equation Edit
Window").

The Device or Pathname edit field permits specification of the device or path
name for printing. A standard device is denoted with a trailing colon (for
example, PRN:). The full path name of a file must be specified or the file is
printed in the directory specified by Current Path. If the file specified does
not have an extension, an extension of .PRN is appended to the path name.

When you click on the OK push button, the frames in the range specified are
printed.


ΓòÉΓòÉΓòÉ 9.10. Saving Frame Data ΓòÉΓòÉΓòÉ

The DatagLANce analyzer permits you to save any or all of the frames that have
been captured to a file stored on the system disk. This file can be archived or
copied like any other OS/2 file. The save function is invoked by selecting the
Save choice from the File menu in the Frame Summary window. When this menu
choice is selected, the window shown in Figure "Save Options" is displayed.


Save Options

The From and To fields allow either a frame byte offset (if in byte offset
mode) or a frame record number (if in record mode) to be specified. These list
boxes also allow selection of First, Last, Marked, Reference, Trigger, and any
bookmarks that have been defined.

The Filtered frames only check box specifies whether only frames matching the
Display Filter should be saved (see Figure "Display Filter Equation Edit
Window").

The Format group box selects the format of the file from the following:

 DatagLANce
      IBM DatagLANce Network Analyzer file format.

 TAP
      IBM Trace and Performance Program file format.

 Found Mgr
      The Protools' Foundation Manager file format.

 Sniffer
      Network General's Token-Ring or Ethernet Sniffer file format.

 LANalyzer
      The Novell LANalyzer file format.

 ASCII text
      An ASCII text file format suitable for single-frame traffic generation
      (see Single Frame Traffic Generation).

 Specify the path name in the Pathname edit field at the bottom of this window.
 The full path name of a file must be specified, if not, the file is saved in
 the directory shown next to Current Path. The file should be entered without
 an extension because an extension, consistent with the format selected, is
 automatically appended to the path name.

 When you click on the OK push button, the frames specified are saved.


ΓòÉΓòÉΓòÉ 9.11. Editing the Capture Description ΓòÉΓòÉΓòÉ

You can give captured data files a description up to 127 characters in length.
When the Capture Description choice is selected from the File menu in the Frame
Summary window, the window shown in Figure "Edit Capture Description" is
displayed.


Edit Capture Description

The description of the capture can be edited in the Capture description edit
field. A descriptive name such as Mike Ferrell's Capture Data or Capture
Displaying File Server Station Failure on May 18th, 1992 can be entered in this
field.

Clicking on the OK push button in this window causes the new capture
description to be saved to the file being analyzed. From an OS/2 command prompt
you can then issue the command: TYPE <filename> and see the capture
description. To see the capture descriptions of all DatagLANce files in the
directory issue the command: TYPE *.DGC.


ΓòÉΓòÉΓòÉ 9.12. Starting a New Capture ΓòÉΓòÉΓòÉ

Network troubleshooting is a multi-step process. It can take several captures
of frames to isolate the problem on the network. The DatagLANce protocol
analysis software makes it easy to analyze capture data and then capture new
data.

The Start a New Capture option in the File menu of the Frame Summary window
closes the current protocol analysis session and instructs the DatagLANce
Network Analyzer software to start a new capture using the last capture filter
that was used. Setting up the capture filter is discussed in Figure "Frame
Capture Filter".

The Start a New Capture using Display Filter option in the File menu of the
Frame Summary window closes the current protocol analysis session and instructs
the DatagLANce Network Analyzer software to start a new capture using the
current Protocol Analysis Display Filter. The capture filter is matched to the
display filter to allow you to capture only the frames that you selected for
displaying in this DatagLANce Protocol Analysis session. This option permits
you to capture traffic, select the frames that you want to display, and then
capture only those frames during the next capture. This powerful option saves
you time by automatically reconfiguring the DatagLANce Network Analyzer
software for you.

Note:  This option does not support filtering frames by protocols selected for
display (see Figure "Display Filter Equation Edit Window"). All frames that are
displayed with this option OFF will be captured (for example, frames matching
the Display Filter event equation only).


ΓòÉΓòÉΓòÉ 9.13. Summary ΓòÉΓòÉΓòÉ

This chapter described in detail the DatagLANce protocol analysis functions.
Using these functions, you can analyze frames captured by the DatagLANce
analyzer and other analyzers. Looking at captured frames with detailed protocol
decodes can be helpful when troubleshooting network problems and fine-tuning a
network.


ΓòÉΓòÉΓòÉ 10. Traffic Generation and Playback ΓòÉΓòÉΓòÉ

The performance of a network can be affected by traffic load. The DatagLANce
Traffic Generation and Playback functions allow you to:

  1. Observe how other network stations respond to delays caused by background
     network loading

  2. Allow you to test the response of individual stations, bridges, gateways,
     and/or routers in handling additional traffic of a specific type

  3. Allow you to play back traffic into the DatagLANce Network Analyzer
     applications for analysis of specific network problems

     Warning: Adding traffic to your network might seriously degrade network
     performance. You should use these functions with caution; the DatagLANce
     Network Analyzer was designed to help you find network problems, not cause
     them.


ΓòÉΓòÉΓòÉ 10.1. Overview of DatagLANce Traffic Generation and Playback Capability ΓòÉΓòÉΓòÉ

With the DatagLANce Network Analyzer, you have the power to load and play back
onto your network by:

 o Generating the same frame repeatedly, specifying:

    - Frame destination DLC address

    - Frame size

    - Interval between frames

    - Maximum number of frames to transmit

    - Frame contents

    - Whether the frame should contain errors

 o Playing back network traffic captured by the DatagLANce Network Analyzer
   onto the network.
 o Playing back network traffic captured by the DatagLANce Network Analyzer
   into the analyzer for re-analysis.
 o Measuring the approximate transmit wait time of a token-ring network.

 Each of these functions is discussed in detail in the following sections.


ΓòÉΓòÉΓòÉ 10.2. Single Frame Traffic Generation ΓòÉΓòÉΓòÉ

The traffic generation function permits you to repeatedly transmit the same
frame onto the network for the purpose of loading the network or measuring the
effect on the performance of a station, bridge, gateway, or router.

This function can be activated when the DatagLANce Network Analyzer is not
monitoring by selecting the Single Frame Traffic Generation choice from the
Transmit menu on the DatagLANce Network Analyzer window.

Figure "Single Frame Traffic Generation Options" shows the options window that
is displayed when you select this menu choice.


Single Frame Traffic Generation Options

The destination address of the frame to transmit can be manually specified in
the To DLC Address edit field or selected by clicking on its symbolic name in
the List of Station Names list box.

The Size edit field is used to select the size of the frame. For Ethernet, the
actual length of the frame generated will be 4 bytes longer than the size
specified to account for the frame check sequence.  For token-ring, the actual
length of the frame generated will be 7 bytes longer than specified to account
for the start and end delimiters, the frame status indicators, and the frame
check sequence.

The Delay edit field is used to select the time to wait between frame
transmissions. Entering zero in this field specifies to transmit as fast as the
DatagLANce Network Analyzer can transmit.

The Number of Frames combination box is used to select the maximum number of
frames to transmit. Unlimited will cause frames to be transmitted until you
stop traffic generation.

The Load push button is used to select to load an ASCII text file containing
the frame to transmit. Below is a sample ASCII text file that defines a frame
for DatagLANce.

*
* Sample frame defined in an ASCII text file (extension is .TXT)
* Lines starting with asterisks are comment lines
*
* $BEGIN_FRAME indicates start of frame data
$BEGIN_FRAME
*
* $SIZE indicates frame size (regardless of bytes defined below)
$SIZE 256
*
* Here is the frame data (this is a token-ring frame)
10 40 10 00 5A 6D C9 A2 10 00 5A 6B 92 BC F0 F0
02 02 0E 00 FF EF 16 02 00 00 00 00 6E 06 FE 06
FF 53 4D 42 72 00 00 00 00 08 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 26 00 00 00 12 76
00 3A 00 02 50 43 20 4E 45 54 57 4F 52 4B 20 50
52 4F 47 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D
41 4E 31 2E 30 00 02 4C 4D 31 2E 32 58 30 30 32
00 02 58 45 4E 49 58 20 43 4F 52 45 00
*
* $END_FRAME  indicates end of frame data
$END_FRAME

If a file contains multiple frames, only the first frame in the file will be
loaded.

For token-ring frames, the first two bytes are the access control and frame
control bytes. Because these bytes cannot be specified on the traffic
generation panel, the only way to specify them is by defining them in an ASCII
file and loading the file. While this permits you to specify token-ring MAC
frames for transmission, the token-ring adapter does not allow some token-ring
MAC frames to be transmitted.

The source address of the frame within the file will always be overridden with
the source address of the adapter being used for the DatagLANce function.

The first 256 bytes of frame data can be specified/edited in the First 256
Bytes of Frame Data edit field. These bytes are considered to start after the
source address of the frame. Only hexadecimal characters can be specified in
the edit field, however spaces are allowed for clarification. Any characters
exceeding the 256-byte maximum are ignored.

The last four bytes of each frame transmitted will be forced to be a sequence
number. Each time you start transmission, this sequence number starts with 1
and is incremented by for each frame transmitted. If the size specified in the
Size edit field is less than 256 bytes, this sequence number will replace any
frame data specified in the last 4 bytes.

The Data Starts with RI Field check box specifies whether the frame data
specified in the First 256 Bytes of Frame Data edit field starts with Source
Routing Indicators.

The Transmit with FCS Error check box specifies whether to transmit the frame
with an FCS error. This permits you to inject errors onto the network at the
rate specified in the Delay edit field.

Click on OK to accept the options specified. The Traffic Generation
Status/Control window, as shown in Figure "Traffic Generation Status/Control
Window", is displayed.


Traffic Generation Status/Control Window

At the bottom of this window the left-most push button controls starting and
stopping traffic generation.

The Options push button returns you to the previous options panel so that you
can change the traffic generation parameters.

The Done push button exits traffic generation.

The remainder of the window shows the status of transmission. During
transmission, the two bar graphs indicate network traffic generated by the
DatagLANce Network Analyzer.


ΓòÉΓòÉΓòÉ 10.3. Playback onto the Network ΓòÉΓòÉΓòÉ

The DatagLANce analyzer's play back onto the network function permits you to
playback frames stored in a capture file onto the network. This function
permits you to simulate network traffic to test how other stations respond to
the background traffic.

This function is activated by selecting the Playback onto Network choice from
the Transmit menu of the DatagLANce Network Analyzer window.

Figure "Playback onto Network Options" shows the options window that is
displayed when you select this menu choice.


Playback onto Network Options

The File to Playback edit field specifies the pathname of the file to play back
onto the network. The Select push button permits selection of the file name.

The Continuous Playback check box will cause the entire contents of the file to
be transmitted repeatedly until you stop transmission by selecting the OK push
button.

For the Token-Ring DatagLANce Network Analyzer, the Inhibit Transmission of
Token-Ring MAC Frames check box selects not to transmit any MAC frames
contained within the file (some MAC frames cannot be transmitted by the
adapter; this applies to the remaining MAC frames).

Unlike single frame traffic generation, which replaces the source address of
each frame transmitted with the source address of the adapter being used for
the DatagLANce function, playback onto the network will transmit each frame as
it was received, with the source address intact.

When OK is selected, the DatagLANce analyzer will display the Playback
Status/Control window. This window operates similarly to the Traffic Generation
Status/Control window (see Single Frame Traffic Generation).


ΓòÉΓòÉΓòÉ 10.4. Playback into the Network Analyzer ΓòÉΓòÉΓòÉ

The DatagLANce analyzer's playback into the network analyzer function permits
you to play back frames stored in a capture file into the network analyzer for
analysis. This function lets you re-analyze network traffic again and again
using all of the available functions of the DatagLANce Network Analyzer
software.

This function is activated by selecting the Playback into Analyzer choice from
the Transmit menu of the DatagLANce Network Analyzer window.

Figure "Playback into Analyzer Options" shows the options window that is
displayed when you select this menu choice.


Playback into Analyzer Options

The File to Playback edit field specifies the pathname of the file to play back
into the analyzer. The Select push button permits selection of the file name.

The Continuous Playback check box will cause the entire contents of the file to
be played back repeatedly until you stop the monitor.

When OK is selected, the DatagLANce analyzer will start the playback when you
select the Go! choice on the DatagLANce Network Analyzer window. Play back will
continue until end-of-file is reached or you stop the DatagLANce Network
Analyzer by clicking Stop! on the DatagLANce Network Analyzer window.

To turn off playback, select Disabled from the Transmit menu of the DatagLANce
Network Analyzer window.


ΓòÉΓòÉΓòÉ 10.5. The Measure Transmit Wait Time Function ΓòÉΓòÉΓòÉ

The Measure Transmit Wait Time function of the DatagLANce Network Analyzer
measures the amount of time it takes for a network station to acquire a free
token for transmission on a token-ring network.

As the physical size of the token-ring network grows, the longer it takes for a
free token to circle the ring. Also, as the number of stations on the
token-ring network grows and as each station is actively trying to transmit a
frame, the longer it takes for a free token to circle the ring. Thus transmit
wait time is related to the latency of a token-ring network as well as the
number of active stations on the token-ring.

The DatagLANce Network Analyzer measures transmit wait time by transmitting 20
small frames per second as fast as it can transmit, measuring the time between
transmit initiation and transmit completion.  After adjusting the time by the
time it takes to transmit the frame, the DatagLANce Network Analyzer then
averages all 20 times to approximate the transmit wait time.

This function can be enabled by selecting the Measure Transmit Wait Time choice
from the Transmit menu of the DatagLANce Network Analyzer window (You must stop
the monitor first, if you are currently monitoring). The DatagLANce Network
Analyzer will first insert onto the token-ring network and then display the
window appearing in Figure "Transmit Wait Time Window".


Transmit Wait Time Window

The current transmit wait time is shown at the top of this window. If an error
occurred while trying to transmit, the current transmit wait time will be
displayed as TRANSMIT ERROR.

Statistics on the maximum, average, and minimum wait time are displayed in the
Statistics group box.

The OK push button ends the measure transmit wait time function and exits this
window.


ΓòÉΓòÉΓòÉ 11. Frame Formats ΓòÉΓòÉΓòÉ

This appendix serves as a reference for frame formats. Further information can
be found in the respective specifications.


ΓòÉΓòÉΓòÉ 11.1. Token-Ring Frame Formats ΓòÉΓòÉΓòÉ


ΓòÉΓòÉΓòÉ 11.1.1. Frame PDU Format (Token-Ring) ΓòÉΓòÉΓòÉ

Figure "Frame PDU Format for Token-Ring" shows the Frame PDU format for
token-ring.


Frame PDU Format for Token-Ring

          |ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ FCS Coverage ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé SD Γöé AC Γöé FC Γöé  DA  Γöé  SA  Γöé  RI  Γöé IF  Γöé FCS Γöé ED Γöé FS Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÿ

 SD    Start delimiter (1 byte)

 AC    Access control field (1 byte)

 FC    Frame control (1 byte)

 DA    Destination address (6 bytes)

 SA    Source address (6 bytes)

 RI    Routing information (optional, variable length)

 IF    Information (optional, variable length)

 FCS   Frame check sequence (8 data symbols)

 ED    End delimiter (1 byte)

 FS    Frame status (1 byte)


ΓòÉΓòÉΓòÉ 11.1.1.1. Access Control Field (Token-Ring) ΓòÉΓòÉΓòÉ

Figure "Access Control Field for Token-Ring" shows the Access Control field for
token-ring.


Access Control Field for Token-Ring

   ΓöîΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓöÉ
BitΓöé0Γöé1Γöé2Γöé3Γöé4Γöé5Γöé6Γöé7Γöé
   Γö£ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓöñ
   ΓöéPΓöéPΓöéPΓöéTΓöéMΓöéRΓöéRΓöéRΓöé
   ΓööΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓöÿ

 P     Priority bits

 T     Token bit

 M     Monitor bit

 R     Reservation bit


ΓòÉΓòÉΓòÉ 11.1.2. Frame Control Field (Token-Ring) ΓòÉΓòÉΓòÉ

The Frame Control (FC) field for token-ring is a 1-byte data field that
designates the frame type as well as certain MAC and information frame
functions. The bit definitions in this byte are shown in Figure "Token-Ring
Frame Control Byte Bit Definitions".


Token-Ring Frame Control Byte Bit Definitions

   ΓöîΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓöÉ
BitΓöé0Γöé1Γöé2Γöé3Γöé4Γöé5Γöé6Γöé7Γöé
   Γö£ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓöñ
   ΓöéFΓöéFΓöérΓöérΓöéZΓöéZΓöéZΓöéZΓöé
   ΓööΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓöÿ

 F         Frame type bits

    00 MAC frame

    01 LLC frame

    10 Undefined frame

    11 Undefined frame

 rr        Reserved bits

 ZZZZ      Control bits

    0000
          MAC frame is normally buffered

    0001 to 1111
          MAC frame is express buffered

          An express-buffered frame must be delivered immediately. It can be
          copied to the ring station's express buffer when the normal frames
          buffers are full.


ΓòÉΓòÉΓòÉ 11.2. Token-Ring Addresses ΓòÉΓòÉΓòÉ

The token-ring address format is most significant bit (MSB). The MSB is
transmitted onto the network first.


ΓòÉΓòÉΓòÉ 11.2.1. Token-Ring Destination Addresses ΓòÉΓòÉΓòÉ

Figure "Destination Address Bit Definitions" shows the bit definitions for
token-ring destination addresses.


Destination Address Bit Definitions

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 48 bits ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
ΓöéI/GΓöéU/LΓöé . . . . . .  ΓöéFAIΓöé . . . . . . . . Γöé
ΓööΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
        |ΓöÇΓöÇ 6 bits ΓöÇΓöÇ|   |ΓöÇΓöÇΓöÇ 39 bits ΓöÇΓöÇΓöÇ|

 I/G  Individual or group bit

 U/L  Universal or local bit

 FAI  Functional address indicator


ΓòÉΓòÉΓòÉ 11.2.2. Token-Ring Source Addresses ΓòÉΓòÉΓòÉ

Figure "Source Address Bit Definitions" shows the bit definitions for source
addresses.


Source Address Bit Definitions

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 48 bits ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé RII Γöé U/L Γöé . . . . . . . . . . . . . . Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
            |ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 46 bits ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|

 RII  Routing information indicator

      The Routing Information Indicator bit specifies the presence of a routing
      information field within the frame. This field is used for source routing
      and immediately follows the source address. The format is shown in Figure
      "Routing Information Field Format".

 U/L  Universal or local bit


ΓòÉΓòÉΓòÉ 11.3. Routing Fields ΓòÉΓòÉΓòÉ


ΓòÉΓòÉΓòÉ 11.3.1. Routing Information Field ΓòÉΓòÉΓòÉ

Figure "Routing Information Field Format" shows the format of the routing
information field.


Routing Information Field Format

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ RI Field ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé  RC   Γöé  SN1  Γöé  ...  Γöé  SNn  Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ

 RC   Routing control field (2 bytes)

 SNn  Segment number (up to eight 2-byte segments)


ΓòÉΓòÉΓòÉ 11.3.2. Routing Control Field (Detail) ΓòÉΓòÉΓòÉ

Figure "Routing Control Field (Detail)" shows the routing control field.


Routing Control Field (Detail)

   |ΓöÇΓöÇΓöÇ Routing Control Field ΓöÇΓöÇΓöÇ|
   ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
   Γöé    Byte 1     Γöé    Byte 2     Γöé
   Γö£ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö╝ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓö¼ΓöÇΓöñ
BitΓöé0Γöé1Γöé2Γöé3Γöé4Γöé5Γöé6Γöé7Γöé0Γöé1Γöé2Γöé3Γöé4Γöé5Γöé6Γöé7Γöé
   Γö£ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓö╝ΓöÇΓöñ
   ΓöéBΓöéBΓöéBΓöéLΓöéLΓöéLΓöéLΓöéLΓöéDΓöéFΓöéFΓöéFΓöérΓöérΓöérΓöérΓöé
   ΓööΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓö┤ΓöÇΓöÿ

 B    Broadcast indicator bits

 L    Length bits

 D    Direction bit

 F    Largest frame bits

 r    Reserved bits


ΓòÉΓòÉΓòÉ 11.3.3. Routing Designator (Detail) ΓòÉΓòÉΓòÉ

Figure "Route Designator (Detail)" shows the routing designator.


Route Designator (Detail)

|ΓöÇΓöÇΓöÇΓöÇ Route Designator ΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé      RN       Γöé    BN      Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
|ΓöÇΓöÇ 12 bits ΓöÇΓöÇ|ΓöÇ 4 bits ΓöÇ|

 RN   Ring number

 BN   Bridge number


ΓòÉΓòÉΓòÉ 11.4. MAC Frame Format (Token-Ring) ΓòÉΓòÉΓòÉ

Figure "MAC Frame Format" shows the MAC frame format.


MAC Frame Format

ΓöîΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé SD Γöé AC Γöé FC Γöé DA Γöé SA Γöé RI Γöé IF Γöé FCS Γöé ED Γöé FS Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÿ

 SD
           Start delimiter (1 byte)

 AC
           Access control field (1 byte)

 FC
           Frame control (1 byte)

 DA
           Destination address (6 bytes)

 SA
           Source address (6 bytes)

 RI
           Routing information (optional, variable length)

 IF
           Information field (optional, variable length)

 FCS
           Frame check sequence (4 bytes)

 ED
           Ending delimiter (1 byte)

 FS
           Frame status (1 byte)


ΓòÉΓòÉΓòÉ 11.5. LLC Frame Format (Token-Ring Only) ΓòÉΓòÉΓòÉ

Figure "LLC Frame Format" shows the LLC Frame Format.


LLC Frame Format

ΓöîΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé SD Γöé AC Γöé FC Γöé  DA  Γöé  SA  Γöé RI Γöé LPDU Γöé FCS Γöé ED Γöé FS Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÿ

 SD       Start delimiter (1 byte)

 AC       Access control field (1 byte)

 FC       Frame control (1 byte)

 DA       Destination address (6 bytes)

 SA       Source address (6 bytes)

 RI       Routing information field (optional, variable length)

 LPDU     LLC protocol data unit (3 or more bytes)

 FCS      Frame check sequence (4 bytes)

 ED       End delimiter (1 byte)

 FS       Frame status (1 byte)


ΓòÉΓòÉΓòÉ 11.6. Ethernet Frame Formats ΓòÉΓòÉΓòÉ

The following sections show Ethernet frame formats.


ΓòÉΓòÉΓòÉ 11.6.1. Frame PDU Format (Ethernet DIX V2) ΓòÉΓòÉΓòÉ

Figure "Frame PDU Format for Ethernet DIX V2" shows the frame PDU format for
Ethernet DIX V2. This format is commonly known as Ethernet and was available
before IEEE 802.3. Both frame types can exist on a single LAN, but two
communicating stations cannot mix Ethernet DIX V2 and Ethernet 802.3 unless
their hardware permits it.


Frame PDU Format for Ethernet DIX V2

ΓöîΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé PA Γöé SF Γöé  DA  Γöé  SA  Γöé T Γöé RI Γöé INFO Γöé PAD Γöé FCS Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ

 PA    Preamble (62 bits of alternating 1 and 0)

 SF    Start of frame (2 bits, 11)

 DA    Destination address (6 bytes)

 SA    Source address (6 bytes)

 T     Type (2 bytes)

 RI    Routing information field (optional, variable length)

 INFO  Information (optional, variable length)

 PAD   PAD characters (optional; pad characters added if necessary to make the
       frame 64 bytes in length)

 FCS   Frame check sequence (4 bytes)


ΓòÉΓòÉΓòÉ 11.6.2. Frame PDU Format (IEEE 802.3) ΓòÉΓòÉΓòÉ

Figure "Frame PDU Format for IEEE 802.3" shows the frame PDU format for IEEE
802.3.


Frame PDU Format for IEEE 802.3

ΓöîΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé PA Γöé SF Γöé  DA  Γöé  SA  Γöé L Γöé RI Γöé INFO Γöé PAD Γöé FCS Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ

 PA    Preamble (62 bits of alternating 1 and 0)

 SF    Start of frame (2 bits, 11)

 DA    Destination address (6 bytes)

 SA    Source address (6 bytes)

 L     Length (2 bytes)

 RI    Routing information (optional, variable length)

 INFO  Information (optional, variable length; if present, starts with IEEE
       802.3 LLC header)

 PAD   PAD characters (optional, pad characters added if necessary to make
       frame 64 bytes in length)

 FCS   Frame check sequence (4 bytes)


ΓòÉΓòÉΓòÉ 11.7. Ethernet Addresses ΓòÉΓòÉΓòÉ

The Ethernet address format is canonical or least-significant bit (LSB) first.


ΓòÉΓòÉΓòÉ 11.7.1. Ethernet Destination Addresses ΓòÉΓòÉΓòÉ

Figure "Destination Address Bit Definitions for Ethernet" shows the bit
definitions for Ethernet destination addresses.


Destination Address Bit Definitions for Ethernet

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 48 bits ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé . . . . ΓöéU/LΓöéI/GΓöé . . . . . . . . . . . Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
|ΓöÇΓöÇΓöÇ 8 bits ΓöÇΓöÇΓöÇΓöÇ|

 U/L  Universal or local bit

 I/G  Individual or group bit


ΓòÉΓòÉΓòÉ 11.7.2. Ethernet Source Addresses ΓòÉΓòÉΓòÉ

Figure "Source Address Bit Definitions" shows the bit definitions for Ethernet
source addresses.


Source Address Bit Definitions

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 48 bits ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé . . . . ΓöéU/LΓöéRIIΓöé . . . . . . . . . . . Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
|ΓöÇΓöÇΓöÇ 8 bits ΓöÇΓöÇΓöÇΓöÇ|

 U/L  Universal or local bit

 RII  Routing information indicator

      The Routing Information Indicator bit specifies the presence of a routing
      information field within the frame. This field is used for source routing
      and immediately follows the Length field (Ethernet 802.3) or Type field
      (Ethernet DIX V2) source address.

      The RII bit in the SA is located in the LSB, since that bit is the first
      bit a station must receive.


ΓòÉΓòÉΓòÉ 11.7.3. Routing Information Field (Ethernet) ΓòÉΓòÉΓòÉ

The routing information field is not usually found in an Ethernet frame. It is
found only if the network is connected through a bridge to another network with
source routing.  For more information about the routing information field, see
Routing Information Field.


ΓòÉΓòÉΓòÉ 11.7.4. LLC Protocol Data Unit (LPDU) ΓòÉΓòÉΓòÉ

Figure "LLC Protocol Data Unit (LPDU) Format" shows the format of the LPDU.


LLC Protocol Data Unit (LPDU) Format

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ LPDU Header ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
Γöé  DSAP  Γöé  SSAP  Γöé  Control Field   Γöé  Information Field  Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|ΓöÇ 1 or 2 bytes ΓöÇ|ΓöÇ 0 or more bytes ΓöÇ|
  1 byte   1 byte

 DSAP
                   For the format of this field, see Figure "DSAP Field". The
                   destination service access point.

 SSAP
                   For the format of this field, see Figure "SSAP Field". The
                   source service access point.

 Control field
                   The format of the LPDU information field. Figure
                   "Information Transfer Format Control Field" shows the
                   Information Transfer Format control field.

 Information field
                   The LPDU information


ΓòÉΓòÉΓòÉ 11.7.4.1. DSAP Field (Detail) ΓòÉΓòÉΓòÉ

The DSAP field is the destination access point for which the LPDU is intended.
The field processes within the communicating node. The format of this field is
shown in Figure "DSAP Field".


DSAP Field

              DSAP Field
    ΓöîΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÉ
Bit Γöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7  Γöé
    Γö£ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöÇΓöñ
    Γöé D Γöé D Γöé D Γöé D Γöé D Γöé D Γöé U ΓöéI/G Γöé
    ΓööΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÿ

 D    DSAP bits

 U    User-defined address bit

 I/G  Individual/group bit


ΓòÉΓòÉΓòÉ 11.7.4.2. SSAP Field (Detail) ΓòÉΓòÉΓòÉ

The SSAP field is the source service access point for which the LPDU is
intended. The field processes within the communicating node. The format of this
field is shown in Figure "SSAP Field".


SSAP Field

              SSAP Field
    ΓöîΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÉ
Bit Γöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7  Γöé
    Γö£ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöÇΓöñ
    Γöé S Γöé S Γöé S Γöé S Γöé S Γöé S Γöé U ΓöéC/R Γöé
    ΓööΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÿ

 S    SSAP bits

 U    User-defined address bit

 C/R  Command/response bit


ΓòÉΓòÉΓòÉ 11.7.4.3. Control Field (Detail) ΓòÉΓòÉΓòÉ

The Control field in the LPDU header defines the format of the LPDU information
field. The Control field can contain an Information Transfer Format Control
field, a Supervisory Format Control field, or an Unnumbered Format Control
field. Figure "Information Transfer Format Control Field" shows the Information
Transfer Format control field.


Information Transfer Format Control Field

   ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ  ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
   Γöé           Byte 1              Γöé  Γöé           Byte 2              Γöé
   Γö£ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöñ  Γö£ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöñ
BitΓöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7 Γöé  Γöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7 Γöé
   Γö£ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöñ  Γö£ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöñ
   Γöé           N(S)            Γöé 0 Γöé  Γöé            N(R)           ΓöéP/FΓöé
   ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÿ  ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÿ

 N(S) Transmitter send sequence number

 N(R) Transmitter receive sequence number

 P/F  Poll/final bit


ΓòÉΓòÉΓòÉ 11.7.4.3.1. Supervisory Format Control Field ΓòÉΓòÉΓòÉ

Figure "Supervisory Format Control Field" shows the Supervisory Format control
field.


Supervisory Format Control Field

   ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ  ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
   Γöé           Byte 1              Γöé  Γöé           Byte 2              Γöé
   Γö£ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöñ  Γö£ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöñ
BitΓöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7 Γöé  Γöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7 Γöé
   Γö£ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöñ  Γö£ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöñ
   Γöé 0 Γöé 0 Γöé 0 Γöé 0 Γöé S   S Γöé 0 Γöé 1 Γöé  Γöé            N(R)           ΓöéP/FΓöé
   ΓööΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÿ  ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÿ

 S    Supervisory function bits

    00   Receiver Ready (RR)

    01   Receiver Not Ready (RNR)

    10   Reject (REJ)

 N(R) Transmitter receive sequence number

 P/F  Poll/final bit


ΓòÉΓòÉΓòÉ 11.7.4.3.2. Unnumbered Format Control Field ΓòÉΓòÉΓòÉ

Figure "Unnumbered Format Control Field" shows the Unnumbered Format control
field.


Unnumbered Format Control Field

    ΓöîΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÉ
Bit Γöé 0 Γöé 1 Γöé 2 Γöé 3 Γöé 4 Γöé 5 Γöé 6 Γöé 7 Γöé
    Γö£ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓö╝ΓöÇΓöÇΓöÇΓöñ
    Γöé M   M   M ΓöéP/FΓöé M   M Γöé 1 Γöé 1 Γöé
    ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÿ

 M     Modifier function bits

    000 00 Unnumbered information (UI)

    000 11 Disconnected mode (DM)

    010 00 Disconnect (DISC)

    011 00 Unnumbered acknowledgment (UA)

    011 11 Set Asynchronous Balance Mode Extended (SABME)

    100 01 Frame Reject (FRMR)

    101 11 Exchange identification (XID)

    111 00 Test (TEST)

 P/F   Poll/final bit


ΓòÉΓòÉΓòÉ 11.7.4.4. SNAP Header ΓòÉΓòÉΓòÉ

An extension to the IEEE 802.2 LLC header, known as the Sub-Network Access
Protocol (SNAP), has been defined by the Internet community. The SNAP header
immediately follows the LLC header. The DSAP and SSAP fields in the LLC header
are both set to X'AA' and the control field is set to X'03' (Unnumbered
Information). Figure "SNAP Header Format" shows the format of the SNAP header.


SNAP Header Format

|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ SNAP Header ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|
ΓöîΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö¼ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÉ
ΓöéProtocol ID or Org. Code  Γöé Ethertype     Γöé  Higher Layer Information Γöé
ΓööΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓö┤ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÿ
|ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ 3 bytes ΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇΓöÇ|ΓöÇΓöÇ 2 bytes ΓöÇΓöÇ|

 Protocol ID or Organization Code
      Always 3 bytes of 0s.

 Ethertype
      The next layer protocol that follows the SNAP header (2 bytes).


ΓòÉΓòÉΓòÉ 11.8. Frame Check Sequence ΓòÉΓòÉΓòÉ

The Frame check sequence is the last 4 bytes of the frame. It is a CRC checksum
used to verify the information within the frame.

For token-ring networks, when a station detects that a frame has been corrupted
by computing a checksum different from that of the checksum specified, it sets
the Error Detected (E) frame status indicator at the end of the frame. The
frame check sequence is not in the captured data for token-ring.


ΓòÉΓòÉΓòÉ 11.9. Ending Delimiter (Token-Ring Only) ΓòÉΓòÉΓòÉ

The ending delimiter is a single byte. The last 2 bits represent the
Intermediate Frame (I) and the Error Detected (E) bits.

If the I bit is one, the frame is the first or an intermediate frame of a
multiple-frame transmission using a single token. The error bit is set by a
station that detects an error.


ΓòÉΓòÉΓòÉ 11.10. Frame Status (Token-Ring Only) ΓòÉΓòÉΓòÉ

The Frame Status field is a single byte following the end delimiter of a Frame
PDU. The first 2 bits in each 8 bits are mandatory, indicating Address
Recognized (A) and Frame Copied (C). The rest of the bits are reserved and set
to 0s.


ΓòÉΓòÉΓòÉ 12. Protocols Decoded ΓòÉΓòÉΓòÉ

The DatagLANce analyzer interprets the following protocol suites:

  1. FDDI Protocol Suite

    o MAC, SMT(6.2 & 7.2), BPDU, LLC, SNAP, LOOP, RI

  2. Token-Ring Protocol Suite

    o MAC, BPDU, LLC, SNAP, LOOP, RI

  3. Ethernet/802.3 Protocol Suite

    o Ethernet DIX V2, IEEE 802.3, BPDU, LLC, SNAP, LOOP, RI

  4. IBM Protocol Suite

    o NETBIOS, SNA, RPL, SMB, IBMRT, IBMNM, MPTN

  5. TCP/IP Protocol Suite

    o IP, TCP, UDP, ARP, RARP, ICMP, IGMP, SNMP, CMOT, TFTP, FTP, TELNET, SMTP,
      DNS, NetBIOS(TCP), SMB, RWHO, RLOGIN, RPRINT, REXEC, RSHELL, TRLR, BOOTP,
      OSPF, IGRP, RIP, GGP, BGP, EGP

  6. SUN NFS Protocol Suite

    o RPC, NFS, PMAP, MOUNT, NIS, RSTAT, ND

  7. XNS Protocol Suite

    o IDP, SPP, Error, RIP, Echo, PEP, NBP, SMB, 3+, Netmap TCP, Netmap XNS,
      U-B, PUP, PUP ARP

  8. Novell NetWare Protocol Suite

    o IPX, SPX, RIP, Echo, Error, NetBIOS, NDIAG, NSECURE, NCP, SAP, LSP, NLP,
      NWDOG, NBCAST

  9. DECnet Protocol Suite

    o DRP, NSP, SCP, FOUND, DAP, NICE, CTERM, MOP, LAT, LAVC, SCS, SMB

 10. AppleTalk Protocol Suite

    o LAP, AARP, DDP, NBP, ATP, ZIP, RTMP, AEP, PAP, ASP, ADSP, AFP

 11. Banyan VINES Protocol Suite

    o VLLC, VFRP, VIP, VIPC, VSPP, VARP, VRTP, VICP, VECHO, VLOOP, VRPC, VECHS,
      VROUTE, VPCB, VMAIL, VFTP, VFILE, VSRV, VSTRTK, VTALK, VNMGT, VANG, SMB

 12. ISO Protocol Suite

    o ES-IS, CLNP, OSI TP, SMB

 13. X.25 Protocol Suite

    o X.25 layer 3


ΓòÉΓòÉΓòÉ 13. Selecting User Preferences ΓòÉΓòÉΓòÉ

The DatagLANce analyzer permits you to select the method by which addresses are
displayed and the size of the fixed font that is displayed in some windows. You
can make these choices by selecting Preferences from the File menu of the
DatagLANce Network Analyzer control window or the Frame Summary window. When
this menu choice is selected, the window shown in Figure "User Preferences
Window" is displayed.


User Preferences Window

The Address Format group permits you to select the format in which all station
addresses are displayed. MSB represents most-significant bit first format. Both
token-ring and FDDI represent DLC addresses in this format. For Ethernet users
or those more familiar with IEEE canonical (least-significant bit first)
format, the Canonical (LSB) radio button will cause all addresses to display in
LSB format.

MSB addresses are represented using colons (:) between each byte of the
address. Canonical addresses are represented using hyphens (-) between each
byte of the address.

Following are some sample addresses in MSB and Canonical formats:

 MSB format        Canonical format

 10:00:5A:11:22:33 08-00-5A-88-44-CC

 00:00:55:8B:1F:D9 00-00-AA-D1-F8-9B

 The Address Format switches also select the default format for address entry.
 On windows that require an address specification such as the Destination
 Addresses Event Detector Configuration window, you can enter an address in one
 of the formats above or with the colons or hyphens omitted. If the colons or
 hyphens are omitted, the DatagLANce analyzer will consider the address to be
 in the format specified using the preferred Address Format selected in this
 window.

 The Fixed Font Size edit field permits you to select the size of the fixed
 font displayed in windows such as Frame Summary, and Ring Map. The size can be
 selected by entering a number in the edit field or by using the adjacent
 scroll arrows. The new font size is displayed to the right of the edit field.

 For windows that do not contain fixed fonts (such as the Network Statistics
 window), the font size can be varied by changing the size of the window.

 The Protocol Scanning group box represents protocol scanning options. Some
 frames that the DatagLANce analyzer interprets are dependant on information
 frames previous or ahead of the frame being interpreted. Protocol scanning is
 used to search for this information. This can be time consuming, if a large
 number of frames appear between the frame being interpreted and the frame
 containing the information that is needed.

 The Disabled button turns off protocol scanning. This option maximizes
 interpretation speed at the expense of some interpretation information.

 The Enabled button turns on protocol scanning.  The number of frames scanned
 is limited to the number specified in the edit field. By increasing this
 number, you can guarantee that a frame is fully interpreted. By decreasing
 this number, you can limit scans for protocol information, and still get full
 decodes on most frames.

 To avoid confusion, the Protocol Scanning preference is not saved in
 DatagLANce configurations. It is always reset to the defaults every time you
 load a DatagLANce Network Analyzer application, but remain active as long as
 you stay within the application.

 When you click on the OK push button, the new user preferences take effect.


ΓòÉΓòÉΓòÉ 14. Symbolic Names Support ΓòÉΓòÉΓòÉ

The DatagLANce analyzer makes it easy to identify stations on your network by
allowing you to assign symbolic names to these stations. There are two methods
for assigning symbolic names to station addresses.

 o Symbolic Names can be learned by the DatagLANce analyzer

 o Symbolic Names can be manually specified


ΓòÉΓòÉΓòÉ 14.1. Learning Symbolic Names for Station Addresses ΓòÉΓòÉΓòÉ

The Look for Symbolic Names menu choice in the File menus of the Frame Summary
window of the DatagLANce protocol analysis software and the Network Glance
window of the DatagLANce Network Analyzer application permits the DatagLANce
analyzer to learn symbolic names for station addresses. Figure "DatagLANce
Protocol Analysis File Menu" shows the File menu for the Token-Ring Frame
Summary window.


DatagLANce Protocol Analysis File Menu

When you select the Look for Symbolic Names menu choice, the DatagLANce
analyzer will start searching the captured or glanced frames for symbolic
names. When a name is found that the DatagLANce analyzer can relate to a
station address, the DatagLANce analyzer will automatically add the symbolic
name to the symbolic names list.


ΓòÉΓòÉΓòÉ 14.2. Manually Specifying Symbolic Names for Station Addresses ΓòÉΓòÉΓòÉ

Symbolic names can be manually specified by selecting Edit Symbolic Names from
the File menu of windows such as the DatagLANce Network Analyzer Control and
the Frame Summary windows. When this menu choice is selected, the window shown
in Figure "Edit Symbolic Names Window" is displayed.


Edit Symbolic Names Window

With the Address Level list box, you can select the level and type of symbolic
names to be edited. The address levels supported are as follows:

 DLC (Data Link Control)
           Specifies a DLC (or MAC) station address

           For example: 10:00:5A:11:22:33 (MSB format), 08-00-5A-88-44-CC (LSB
           format), or 10005A112233 (assumed to be the format selected for user
           preferences, see Figure "User Preferences Window")

 DLC Manufacturer ID
           Specifies the manufacturer IDs for adapter addresses

           For example: 10:00:5A (MSB format) or 08-00-5A (LSB format).

 IP (TCP/IP)
           Specifies TCP/IP network addresses

           For example: 9.67.102.37, 0.0.0.0, and 255.255.255.255

 IPX (Novell)
           Specifies a Novell IPX network address

           For example: 11223344.5566778899AA and FFFFFFFF.FFFFFFFFFFFF

 IDP (XNS)
           Specifies an XNS IDP network address

           For example: 045C819D.10005A112233 and FFFFFFFF.FFFFFFFFFFFF

 DRP (DECnet)
           Specifies a DECnet network address

           For example: 9.256 and 63.1023

 DDP (AppleTalk)
           Specifies an AppleTalk network address

           For example: 9.0, 63.255, and 65535.255

 VIP (VINES)
           Specifies a Banyan VINES network address

           For example: 11223344.5566 and FFFFFFFF.FFFF

 CLNP (ISO)
           Specifies an ISO network address

           For example: 11223344 and 4700040001000108000200E10E01

 In the Station Name edit field you can specify the symbolic name for the
 station entered in the address field. Symbolic names can be up to 32
 characters long.

 In the Manufacturer Name edit field (displayed when the DLC Manufacturer ID
 address level is selected) you can specify the manufacturer name for the
 manufacturer ID specified in the Manufacturer ID edit field. Manufacturer
 names can be up to 8 characters long.

 Depending on what is selected in the Symbolic Name Type combination box, the
 List of Symbolic Names list box displays the current list of symbolic names.
 You can use the buttons beneath this list box to edit the list:

 o The Add push button adds the Symbolic Manufacture ID/Station Address
   specified in the edit fields to this list. A maximum 512 symbolic
   manufacturer IDs and a maximum of 963 symbolic stations for DLC and network
   addresses (together) can be entered.

 o The Delete push button removes a symbolic name from the list.

 o The Clear push button clears all symbolic names from the list. For symbolic
   addresses, the list is re-initialized to the default addresses stored in the
   file STATDEF.SYM for the selected address level.

 When you click on OK, the changes to the list of symbolic names are accepted.

 Note:  All DatagLANce analyzer programs use one common set of symbolic names
 files. When the symbolic names are edited, they are re-read from this file in
 case another program has modified this list. Thus it is possible to refresh
 the symbolic names list in multiple analysis sessions by entering and exiting
 this window.


ΓòÉΓòÉΓòÉ 14.3. Symbolic Names File Formats ΓòÉΓòÉΓòÉ

The DatagLANce Analyzer creates two files from which it gets its symbolic names
information for station addresses. These files are standard ASCII text files so
you can edit them.

The manufacturer IDs are stored in the file DGNAMANU.SYM in the \DGNA
directory. Each line in this file can be specified by one of the following
formats:

manufid "IBM     " = 10:00:5A
manufid "IBM     " = MSB 10005A
manufid "IBM     " = 08-00-5A
manufid "IBM     " = LSB 08005A

The first parameter on the line identifies this line as a manufacturer ID
specification. The second parameter specifies the manufacturer name in quotes.
An equal sign follows the second parameter. The last parameter is the
manufacturer ID. Colons (:) and dashes (-) are used to differentiate MSB and
LSB (canonical) representations respectively. If colons and dashes are not
used, you must specify MSB or LSB before the ID.

The default manufacturer IDs are stored in the file MANUDEF.SYM. If you would
like to restore the default manufacturer IDs, simply copy this file over
DGNAMANU.SYM.

Symbolic station names are stored in the file DGNASTAT.SYM in the \DGNA
directory. Each line in this file can be specified by one of the following
formats:

stat "ENCOOK1"                  = DLC     10:00:5A:F8:16:56
stat "ENCOOK1"                  = DLC_MSB 10005AF81656
stat "ENCOOK1"                  = DLC     08-00-5A-1F-68-6A
stat "ENCOOK1"                  = DLC_LSB 08005A1F686A
stat "h82rs006.raleigh.ibm.com" = IP      9.67.192.244
stat "LP10512F"                 = IPX     01000000.0080A110512F
stat "3+Open File Server"       = IDP     01465837.02608C245987
stat "CHERA1"                   = DRP     49.157
stat "Tetris"                   = ATALK   8451.97
stat "VINES Server"             = VINES   01000003.0001
stat "10MAN2"                   = ISO     5031304D414E32

The first parameter on the line identifies this line as a station names
specification. The second parameter specifies the station name in quotes. An
equal sign follows the second parameter. The third parameter defines the
address type. The fourth parameter is the station network address.

For DLC addresses, Colons (:) and dashes (-) are used to differentiate MSB and
LSB (canonical) representations respectively. If colons and dashes are not
used, you must specify MSB or LSB before the address.

The default symbolic station names are stored in the file STATDEF.SYM. These
names are restored when you select to clear the selected address level on the
Edit Symbolic Names Window (see ).


ΓòÉΓòÉΓòÉ 15. Configurations ΓòÉΓòÉΓòÉ

The DatagLANce analyzer enables you to save its program configurations and
recall them in the future. Any user preferences selected, window arrangements,
and event detector configurations are saved in each of the configurations.

You can save a configuration by selecting a menu choice in the DatagLANce
analyzer software application. There are two ways to load DatagLANce analyzer
configurations. We will discuss saving and loading configurations in the next
sections.


ΓòÉΓòÉΓòÉ 15.1. Saving Configurations ΓòÉΓòÉΓòÉ

You can save a configuration by selecting Save Configuration from the File menu
of the DatagLANce Network Analyzer control window or the DatagLANce Protocol
Analysis window.

Selecting the Save Configuration choice causes the window shown in Figure "Save
Configuration Options Window" to be displayed.


Save Configuration Options Window

The configuration path name should be specified without an extension.


ΓòÉΓòÉΓòÉ 15.2. Loading Configurations from the Menu ΓòÉΓòÉΓòÉ

You can load a configuration by selecting the Load Configuration choices from
the File menu of the DatagLANce Network Analyzer control window or the
DatagLANce Protocol Analysis window.

Selecting the Load Configuration choice causes the window shown in Figure "Load
Configuration Options Window" to be displayed.


Load Configuration Options Window

The Files list box displays the list of configurations available in the
directory specified in the Path field. You can use the Directories list box to
change to another directory.

The configuration, STARTUP, is the configuration that is loaded each time the
program is started. This configuration can be changed by saving the desired
configuration into this configuration. Also, when the program is exited, a
window is shown asking whether to save the current configuration of the program
as the startup configuration. Answering YES on this window also changes this
configuration.


ΓòÉΓòÉΓòÉ 15.3. Loading Configuration from the OS/2 Workplace Shell ΓòÉΓòÉΓòÉ

You can load a configuration by clicking on OS/2 workplace shell icons. When
the DatagLANce analyzer software is installed, the installation program will
create a program-specific group of workplace shell icons for each DatagLANce
analyzer media installed. The Ethernet DatagLANce group is entitled Ethernet
DatagLANce and the Token-Ring DatagLANce group is entitled Token-Ring
DatagLANce. This group icon can be found on your OS/2 desktop. When this group
is opened, by double-clicking on it with mouse button 1, the window shown in
Figure "DatagLANce analyzer Configuration Icons" will be displayed.


DatagLANce analyzer Configuration Icons

Each of the icons in this group will cause the DatagLANce analyzer to load the
configuration that the icon describes. If the appropriate DatagLANce analyzer
application is not running, it will be loaded.

You can copy the Template icon for your own custom configurations. Click on
this icon with mouse button 2 and a menu is displayed.  Select the Copy... menu
choice and a window is displayed.  Enter, in the New name edit field, the name
that you want to give your new configuration icon (for example, My
Configuration). Also, select the folder into which you want to copy this icon
(you might want to keep all DatagLANce analyzer configuration icons in the same
group). Then, click on the Copy push button at the bottom of the window when
you have specified the name.

Once the new icon is displayed in the window, update its properties to load
your configuration. Click on this icon with mouse button 2 and a menu is
displayed. Click on the arrow next to the Open choice and a submenu is
displayed. Click on the Settings choice. The Settings window for the icon will
then be displayed. Change the /Cyourconfighere text in the Parameters edit
field to /CMYCONFIG (where MYCONFIG is the name under which you saved the
configuration). There should be no space between the /C and the configuration
name in the Parameters edit field. Then close the window by double-clicking on
the box at the top left corner of the window.

You can also design your own icon for this configuration by bringing up the
Settings window again for the configuration and clicking on the General tab on
the right side of the window. The window will change so you can change the
icon. See your OS/2 User's Guide for more information or click on the Help push
button.


ΓòÉΓòÉΓòÉ 15.4. Configuration Files - Naming Conventions ΓòÉΓòÉΓòÉ

DatagLANce analyzer configurations are a collection of multiple files. The
naming conventions for these files are:

 Application                             Naming Convention

 Token-Ring DatagLANce Network Analyzer  <config name>.W??

 Ethernet DatagLANce Network Analyzer    <config name>.Y??

 DatagLANce Protocol Analysis            <config name>.P??

 The ?? in the file name extension indicates that there are multiple file names
 that start with the extension character.

 To copy a configuration onto a diskette, move to the directory in which the
 configuration is stored (usually \DGNA). Then copy all files that begin with
 the configuration name and the first letter of the extension.


ΓòÉΓòÉΓòÉ 16. History Statistics File Formats ΓòÉΓòÉΓòÉ

The DatagLANce analyzer can record history statistics into a file in a binary
format. The format of this binary file is defined by the IBM C/2 include file
shown in the following example:

/******************************************************************************
**
** Description: DatagLANce Token-Ring/Ethernet
**              History Statistics File Structure Definitions
**
**  Programmers:  Must use the /Zpe compiler switch to pack structures!
**
*******************************************************************************/
#include <time.h>

#ifndef MAX_HISTORY_EVENT_STATISTICS

#define MAX_HISTORY_EVENT_STATISTICS  12

struct HISTORY_STAT_FILE_HEADER_STRUCT
{
  char description[64]; /* "Network History Statistics recorded Jan 03 08:00:00 1991.\z*/
  int version;          /* Version of software that created this file */
  int reserved[31];     /* Reserved words */
};

struct HISTORY_STATISTICS_STRUCT
{
  time_t          timestamp;       /* timestamp (in secs since 01/01/70)         */

  unsigned long   unused;

  unsigned long   error[4];       /* error[0] = Soft Errors or CRC/Align Errs */
                                  /* error[1] = Ring Purges or Collisions     */
                                  /* error[2] = Beacon Frames or Runts        */
                                  /* error[3] = Oversized Frames              */

  unsigned long   reserved[2];    /* reserved                     */


  struct
  {
    unsigned long  frames;  /* total event frames seen over interval */
    unsigned long  bytes;   /* Bytes in the frames counted */
  } event_statistics[MAX_HISTORY_EVENT_STATISTICS];

  /* 0 = unused
     1 = unused
     2 = unused
     3 = any frame
     4 = captured frame
     5 = unused
     6 = unused
     7-11 = custom events 0-4
   */
};
#endif

The HISTORY_STAT_FILE_HEADER_STRUCT structure defines the file header.
Following the file header are one or more records defined by the
HISTORY_STATISTICS_STRUCT structure.

By using this C include file, you can write a custom program to manipulate the
data contained in DatagLANce binary format history statistics files.


ΓòÉΓòÉΓòÉ 17. Capture Data File Formats ΓòÉΓòÉΓòÉ

This appendix describes the format of the capture data files created by the
Token-Ring and Ethernet DatagLANce Network Analyzers. The following information
is supplied to help you read capture data files written by the Token-Ring and
Ethernet DatagLANce analyzers. The format of these binary files is defined by
the IBM C/2 include file shown in the following example:

,
/******************************************************************************
**
** Description: DatagLANce Token-Ring/Ethernet
**              Capture Data File Structure Definitions
**
**  Programmers:  Must use the /Zpe compiler switch to pack structures!
**
*******************************************************************************/

/* DatagLANce file header (exactly 512 Bytes) */

struct dataglance_file_header_struct
{
  char           description[128] ;    /* Description of Capture in ASCII - Terminated by ctrl-Z         */
  unsigned short version;              /* Version of Software that created the file (i.e. 0x0100 = 1.00) */
  unsigned char  type;                 /* Type of data contained in file (2=Token-Ring, 3=Ethernet)      */
  unsigned char  flags;                /* Flags field                                                    */
                                       /* .... ...1 = File wrapped                                       */
                                       /* .... .1.. = Timestamp is in local time (not GMT)               */
                                       /* 0000 0.0. = Reserved                                           */
  unsigned char  reserved[12];         /* Reserved bytes                                                 */
  unsigned long  start_timestamp_sec;  /* Capture start timestamp (in secs since 1970)                   */
  unsigned long  start_timestamp_nsec; /* Capture start timestamp (in nanoseconds)                       */
  unsigned char  reserved2[8];         /* Reserved bytes                                                 */
  unsigned long  first_data_block;     /* First data block if wrapped (1 block=512 Bytes) not including  */
                                       /* this header                                                    */
  unsigned long  last_data_block;      /* Last data block if wrapped not including this header           */
  unsigned long  wrapped_size;         /* Data size if wrapped - exact number of bytes valid in file     */
                                       /* starting with byte at first data block (i.e. not including     */
                                       /* this file header).                                             */
  unsigned char  reserved3[340];       /* Reserved - pads header to 512 bytes exactly                    */
};

/* file records                                                                   */
/*                                                                                */
/* Each 128 bytes of the file following the file header are fixed format records. */
/* These records were designed to be compatible with the buffers found on the     */
/* Token-Ring Adapter so that no reformatting would need to be done when          */
/* capturing to the buffer or the disk.                                           */
/*                                                                                */

struct dataglance_frame_record_header
{
  unsigned char  marker;               /* Record marker                                                  */
                                       /* 1... .... = Start of frame record                              */
                                       /* .1.. .... = Frames missed field valid                          */
                                       /* ..1. .... = High resolution timestamp used                     */
                                       /* .... .1.. = Frame Status Indicators Valid (Token-Ring Only)    */
                                       /* .... .0.. = Frame Status Indicators Not Valid (Token-Ring Only)*/
                                       /* .... 1... = Frame is the trigger frame for the capture         */
                                       /* ..00 ..00 = Reserved                                           */
  unsigned char  receive_status;       /* Receive status                                                 */
                                       /* Token-Ring:  Receive Frame Status                              */
                                       /*   x... x... = Address recognized indicator                     */
                                       /*   .x.. .x.. = Frame copied indicator                           */
                                       /* Ethernet:    Receive Status                                    */
                                       /*   ..1. .... = Broadcast or Multicast Frame                     */
                                       /*   ..0. .... = Non-broadcast/Non-multicast frame                */
                                       /*   .... .00. = No error in frame                                */
                                       /*   .... .01. = FCS error in frame                               */
                                       /*   .... .11. = Frame Alignment and FCS error in frame           */
  unsigned short frame_size;           /* Frame size (after slicing if slicing was active)               */
  unsigned short original_frame_size;  /* Original frame length (before slicing) - if zero, is unknown   */
  unsigned short timestamp[3];         /* Frame Timestamp - tick timestamps should be added to           */
                                       /* capture start timestamp found in the header                    */
                                       /* Token-Ring:                                                    */
                                       /*   NOT high resolution timestamp format:                        */
                                       /*    USHORT    10 millisecond ticks since last second            */
                                       /*    ULONG     Timestamp in seconds since 1970                   */
                                       /*   High resolution timestamp format (units in 840 nanosec ticks)*/
                                       /*    USHORT    Timestamp high                                    */
                                       /*    USHORT    Timestamp low                                     */
                                       /*    USHORT    Timestamp middle                                  */
                                       /* Ethernet:                                                      */
                                       /*   NOT high resolution timestamp format (units in 32 msec ticks)*/
                                       /*    USHORT 1  Timestamp high                                    */
                                       /*    USHORT 1  Timestamp low                                     */
                                       /*    USHORT 1  Timestamp middle                                  */
                                       /*   High resolution timestamp format (units in 840 nanosec ticks)*/
                                       /*    USHORT 1  Timestamp high                                    */
                                       /*    USHORT 1  Timestamp low                                     */
                                       /*    USHORT 1  Timestamp middle                                  */
  unsigned long  frame_number;         /* Capture frame number (unique for each frame in file)           */
  unsigned short frames_missed;        /* Number of Frames missed before or after this frame             */
                                       /* (valid only if marker bit set)                                 */
  unsigned char  reserved[22];         /* Reserved                                                       */
  unsigned char  data[88];             /* First 88 bytes of frame data                                   */
};

struct dataglance_frame_continuation_record
{
  unsigned char  marker;               /* Record marker                                                  */
                                       /* 0000 0000 = Frame record continuation                          */
  unsigned char  reserved[39]          /* Reserved                                                       */
  unsigned char  data[88];             /* Subsequent 88 bytes of frame data                              */
};

/* NOTE:  DatagLANce capture data files should ALWAYS be an even multiple of 128 bytes */


ΓòÉΓòÉΓòÉ 18. DatagLANce Alarms: SNMP Traps and Pager Codes ΓòÉΓòÉΓòÉ

This chapter discusses details on the SNMP MIB variables that the DatagLANce
Network Analyzer will send to a network management station when an alarm
occurs, and pager codes that DatagLANce will send to your pager. For details on
these alarm options see Configuring Alarms: The Alarm Options.


ΓòÉΓòÉΓòÉ 18.1. SNMP Traps from the DatagLANce Network Analyzer:  The MIB Definition ΓòÉΓòÉΓòÉ

The following information defines the SNMP MIB variables that the DatagLANce
analyzer will send as traps to a network management station.

DATAGLANCE-MIB DEFINITIONS ::= BEGIN

IMPORTS
       enterprises            FROM RFC1155-SMI
       Counter                FROM RFC1155-SMI ;

-- IBM MIB

ibm                           OBJECT IDENTIFIER ::= { enterprises 2 }

  -- IBM Products MIB

  ibmProd                       OBJECT IDENTIFIER ::= { ibm 6 }

    -- DatagLANce Network Analyzer MIB

    datagLANce                    OBJECT IDENTIFIER ::= { ibmProd 56 }

      -- Ethernet DatagLANce Traps Group

      traps                         OBJECT IDENTIFIER ::= { datagLANce 1 }

        -- Ethernet DatagLANce Network Analyzer Traps

        -- The following traps can be issued by a Ethernet DatagLANce
        -- Network Analyzer

        ethernetTraps                 OBJECT IDENTIFIER ::= { traps 1 }

          customEvent1Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 1 counts"
              ::= { ethernetTraps 1 }

          customEvent2Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 2 counts"
              ::= { ethernetTraps 2 }

          customEvent3Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 3 counts"
              ::= { ethernetTraps 3 }

          customEvent4Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 4 counts"
              ::= { ethernetTraps 4 }

          customEvent5Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 5 counts"
              ::= { ethernetTraps 5 }

          networkInactiveTime OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "network inactive time in seconds"
              ::= { ethernetTraps 6 }

          allFramesUtilization OBJECT-TYPE
              SYNTAX INTEGER (0 .. 100)
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "all frames utilization (percent)"
              ::= { ethernetTraps 7 }

          allFramesCounts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "all frames counts"
              ::= { ethernetTraps 8 }

          crcAlignmentErrors OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of CRC/Alignment errors"
              ::= { ethernetTraps 9 }

          collisions OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of collisions, where
                 collisions = collision fragments + jabbers"
              ::= { ethernetTraps 10 }

          runtFrames OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of runt frames"
              ::= { ethernetTraps 11 }

          oversizedFrames OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of oversized frames"
              ::= { ethernetTraps 12 }

        -- Token-Ring DatagLANce Network Analyzer Traps

        -- The following traps can be issued by a Token-Ring DatagLANce
        -- Network Analyzer

        tokenRingTraps                OBJECT IDENTIFIER ::= { traps 2 }

          customEvent1Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 1 counts"
              ::= { tokenRingTraps 1 }

          customEvent2Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 2 counts"
              ::= { tokenRingTraps 2 }

          customEvent3Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 3 counts"
              ::= { tokenRingTraps 3 }

          customEvent4Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 4 counts"
              ::= { tokenRingTraps 4 }

          customEvent5Counts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "DatagLANce custom event 5 counts"
              ::= { tokenRingTraps 5 }

          networkDownTime OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "network down time in seconds"
              ::= { tokenRingTraps 6 }

          networkInactiveTime OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "network inactive time in seconds"
              ::= { tokenRingTraps 7 }

          allFramesUtilization OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "all frames utilization (percent)"
              ::= { tokenRingTraps 8 }

          allFramesCounts OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "all frames counts"
              ::= { tokenRingTraps 9 }

          softErrors OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of soft errors"
              ::= { tokenRingTraps 10 }

          ringPurges OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of ring purges"
              ::= { tokenRingTraps 11 }

          beaconFrames OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of beacon frames"
              ::= { tokenRingTraps 12 }

          oversizedFrames OBJECT-TYPE
              SYNTAX Counter
              ACCESS not-accessible
              STATUS mandatory
              DESCRIPTION
                "count of oversized frames"
              ::= { tokenRingTraps 13 }
END


ΓòÉΓòÉΓòÉ 18.2. DatagLANce Alarm Pager Codes ΓòÉΓòÉΓòÉ

The option to append an alarm code to the command sent to your modem (see
Configuring Alarms: The Alarm Options) permits you to have the alarm code
appear on your pager when it is beeped by the DatagLANce Network Analyzer.

The alarm code has the following format:

<priority> <media type> <alarm>

This alarm code indicates the priority of the alarm, the media to which the
alarm applies, and the alarm that occurred. When specifying the dial pager
modem command in a multi-DatagLANce Network Analyzer environment, we recommend
that you append a network segment indicator code (i.e. 0001 for segment 1) to
the end of the command specified to identify the network segment from which the
alarm originated. The specifics of the alarm code fields are listed below.

<priority> can be 0 - returned to normal thresholds
                  1 - inform
                  2 - warning
                  3 - minor
                  4 - major
                  5 - critical

<media type> can be 1 - ethernet
                    2 - token-ring

<alarm code> is specific to media type:

  Ethernet:
           01 - Custom Event 1 Counts
           02 - Custom Event 2 Counts
           03 - Custom Event 3 Counts
           04 - Custom Event 4 Counts
           05 - Custom Event 5 Counts
           06 - Network Inactive Time
           07 - All Frames Utilization
           08 - All Frames Counts
           09 - CRC/Alignment Errors
           10 - Collisions
           11 - Runt Frames
           12 - Oversized Frames

  Token-Ring
           01 - Custom Event 1 Counts
           02 - Custom Event 2 Counts
           03 - Custom Event 3 Counts
           04 - Custom Event 4 Counts
           05 - Custom Event 5 Counts
           06 - Network Down Time
           07 - Network Inactive Time
           08 - All Frames Utilization
           09 - All Frames Counts
           10 - Soft Errors
           11 - Ring Purges
           12 - Beacon Frames
           13 - Oversized Frames
Some example alarm codes are shown below:

5110  (Critical collision rate on an ethernet segment)
5208  (Critical Network Utilization occurring on a token-ring segment)
0208  (Network Utilization has returned to normal on a token-ring segment)


ΓòÉΓòÉΓòÉ 18.2.1. Alarm Pager Codes `Card' ΓòÉΓòÉΓòÉ

The following is the same alarm pager code information, in a convenient `card'
format.  Feel free to copy it and put it in your pocket for your convenience.

The alarm code has the following format:

<priority> <media type> <alarm>

<priority> can be 0 - returned to normal thresholds
                  1 - inform
                  2 - warning
                  3 - minor
                  4 - major
                  5 - critical

<media type> can be 1 - ethernet
                    2 - token-ring

<alarm code> is specific to media type:

Ethernet:
   01 - Custom Event 1 Counts
   02 - Custom Event 2 Counts
   03 - Custom Event 3 Counts
   04 - Custom Event 4 Counts
   05 - Custom Event 5 Counts
   06 - Network Inactive Time
   07 - All Frames Utilization
   08 - All Frames Counts
   09 - CRC/Alignment Errors
   10 - Collisions
   11 - Runt Frames
   12 - Oversized Frames

Token-Ring:
   01 - Custom Event 1 Counts
   02 - Custom Event 2 Counts
   03 - Custom Event 3 Counts
   04 - Custom Event 4 Counts
   05 - Custom Event 5 Counts
   06 - Network Down Time
   07 - Network Inactive Time
   08 - All Frames Utilization
   09 - All Frames Counts
   10 - Soft Errors
   11 - Ring Purges
   12 - Beacon Frames
   13 - Oversized Frames


ΓòÉΓòÉΓòÉ 19. Command Line Interface to the DatagLANce Network Analyzer ΓòÉΓòÉΓòÉ

This chapter discusses details on the DatagLANce Command Line Interface.


ΓòÉΓòÉΓòÉ 19.1. DatagLANce Network Analyzer Application Command Line Options ΓòÉΓòÉΓòÉ

The following sections discuss the command-line options to all of the
DatagLANce Applications.


ΓòÉΓòÉΓòÉ 19.1.1. DatagLANce Application Launcher ΓòÉΓòÉΓòÉ

DGLAUNCH <application name> [application options]

The DatagLANce Application Launcher checks to see if a DatagLANce application
is running. If it is not running (or not being used), the application is
started with the application options specified.  If it is running, DGLAUNCH
communicates with the application via DDE (Dynamic Data Exchange) to send the
options.

DGLAUNCH should be used to invoke all DatagLANce Network Analyzer applications
(i.e. TRMON and ENMON) since multiple instances of DatagLANce Network Analyzer
applications cannot be executed for the same network interface. This program
should be executed from the directory where you installed the DatagLANce
Network Analyzer software.

<application name> may be DGPA, TRMON or ENMON


ΓòÉΓòÉΓòÉ 19.1.2. DatagLANce Protocol Analysis ΓòÉΓòÉΓòÉ

DGPA [/SMALLCFG] [/Wdirectory] [/Cconfigname] [/TYPE:filetype] [/T]
     [/DLC:type] [/Ffile or /Bbuffer]

/SMALLCFG             Save compressed configurations.  These configurations
                      take less disk space but require more time to load.
/Wdirectory           The working directory for this application.  The
                      application expects to find the configuration that
                      it will load in this directory.
/Cconfigname          The name of the application configuration to load.
                      If this option is not specified "startup" will be
                      assumed as the configuration name.  This configuration
                      is loaded ONLY if the protocol analysis session is
                      not already running.
/TYPE:filetype        This option selects the default format of data to be
                      analyzed. <filetype> can be DGC (DatagLANce), TAP
                      (Trace and Performance), PDA (Protools* Foundation
                      Manager*), TRC (Sniffer* Token-Ring), ENC (Sniffer*
                      Ethernet) or LZ (Novell* LANalyzer*).
                      This option can be used with /F to indicate
                      the type of data stored in the file specified.
                      DGC is assumed if this option is omitted.
/T                    Causes the DatagLANce Protocol Analysis software to
                      jump to the trigger frame in the capture data when it
                      is opened.  /F or /B must be specified.
/DLC:type             Specifies the default network type to assume when
                      loading the configuration.  <type> can be TR
                      (Token-Ring), EN (Ethernet) or FDDI.  This option
                      will cause the application to avoid having to re-load
                      the event detectors after it determines what type
                      of data is contained in the file.
/Ffile                Specifies the file source to analyze.  <file> should be
                      the full pathname of the file if <file> is not in the
                      application's working directory.
/Bbuffer              Specifies the capture buffer source to analyze.
                      <buffer> can be DGTRx$ (Token-Ring Capture Buffer) or
                      DGENx$ (Ethernet Capture Buffer). x represents the
                      network interface number (0 = single interface),

Examples:

  DGPA /FENDEMO.DGC
  DGPA /TYPE:TRC  /FTRDEMO5.TRC
  DGPA /CMYCONFIG /BDGTR0$
  DGPA /T /BDGEN0$


ΓòÉΓòÉΓòÉ 19.1.3. Ethernet/Token-Ring DatagLANce Network Analyzer ΓòÉΓòÉΓòÉ

ENMON [/SMALLCFG] [/Wdirectory] [/Cconfigname] [/NOMSG] [/GO] [/NC] [/I:x]
      [/STOP] [/EXIT]
TRMON [/SMALLCFG] [/Wdirectory] [/Cconfigname] [/NOMSG] [/GO] [/NC] [/I:x]
      [/STOP] [/EXIT]

/SMALLCFG             Save compressed configurations.  These configurations
                      take less disk space but require more time to load.
/Wdirectory           The working directory for this application.  The
                      application expects to find the configuration that
                      it will load in this directory.
/Cconfigname          The name of the application configuration to load.
/NOMSG                Assume YES, OK, or RETRY when all message boxes appear.
                      This option enables non-interactive mode invocations
                      of the software (see below).
                      WARNING: For the Token-Ring DatagLANce Network Analyzer
                      this option causes the ring speed verification
                      message box to be suppressed.  Make sure the ring speed
                      is set correctly (manually or in the configuration).
/GO                   Start the monitor immediately when the program is
                      launched.  /NOMSG should be used to suppress any
                      message boxes that might pop up.
/NC                   Start a new capture. The application must be running.
/I:x                  Selects the network interface to use.  Zero (single
                      adapter interface) is assumed if omitted.
/STOP                 Stop the monitor.  /NOMSG should be used to
                      suppress any message boxes that might pop up.
/EXIT                 Exit the application. Application must not be
                      monitoring/capturing. /NOMSG should be used to
                      suppress any message boxes that might pop up.

Examples:
  Note we recommend that you use DGLAUNCH to run these applications.  Two
  copies of these applications cannot be started, and DGLAUNCH ensures that
  only one copy will be started.

  DGLAUNCH TRMON /CCAPTURE
  DGLAUNCH ENMON /CSTARTUP /NOMSG /GO


ΓòÉΓòÉΓòÉ 19.2. Controlling the DatagLANce Network Analyzer from a Remote Location ΓòÉΓòÉΓòÉ

There are at least two methods to access the DatagLANce Network Analyzer
remotely:

  1. IBM's Distributed Console Access Facility, Version 1.1 or later.

     This IBM Program Product allows you to control DatagLANce remotely over a
     modem, LAN, or WAN connection using the OS/2 interface.  It is like
     sitting in front of the DatagLANce Network Analyzer, but at a remote
     location.  All DatagLANce graphics functions are supported and the system
     is under your complete control.

     Contact your local IBM dealer for ordering information.

  2. TCP/IP Telnet (or any other remote-login software product)

     IBM's TCP/IP for OS/2 product, if installed on the remote DatagLANce
     Network Analyzer, will allow you to telnet to the machine and issue
     commands at an OS/2 prompt.  This interface is text-based only, but allows
     you to start and stop the DatagLANce Network Analyzer.  See "DatagLANce
     Utilities" for a description of the DGCMD utility.


ΓòÉΓòÉΓòÉ 19.3. DatagLANce Utilities ΓòÉΓòÉΓòÉ

A number of utilities are included with the DatagLANce Network Analyzer
software:

 o Modification of configurations from the command line

   This utility allows you to change one or more DatagLANce configurations
   using one command.  The video scheme and address format (MSB or LSB) can be
   changed as well as the ring speed for Token-Ring DatagLANce configurations.
   This utility can be found in the directory where you installed the
   DatagLANce Network Analyzer software (usually \DGNA).

      Utility Command Syntax:
      -----------------------
      DGCFGMOD - DatagLANce Configuration Options Modifier Utility
      Syntax:
        DGCFGMOD appname configname [RINGSPEED:x] [ADDRESSES:y] [COLOR or MONO]
                                    [VGA2XGA or XGA2VGA]
          where x is 4 or 16
          where y is MSB or LSB
          appname can be TRMON, ENMON, or DGPA
          configname may contain wildcards
      Examples: DGCFGMOD TRMON STARTUP RINGSPEED:16 ADDRESSES:MSB
                DGCFGMOD TRMON * RINGSPEED:4
                DGCFGMOD ENMON STARTUP ADDRESSES:LSB
                DGCFGMOD DGPA  STARTUP ADDRESSES:LSB
                DGCFGMOD DGPA * COLOR
                DGCFGMOD TRMON * VGA2XGA

      Description of options:

      RINGSPEED:x
      - Sets the ring speed for Token-Ring DatagLANce configurations

      ADDRESSES:y
      - Selects the preference for address formats.
        LSB selects canonical addresses.

      MONO
      - Selects that the configuration will be used on monochrome video

      COLOR
      - Selects that the configuration will be used on color video

      VGA2XGA
      - Converts TRMON and ENMON configurations to support XGA video resolution
        from a configuration that has VGA resolution

      XGA2VGA
      - Converts TRMON and ENMON configurations to support VGA video resolution
        from a configuration that has XGA resolution

 o Conversion of configurations

   This utility allows you copy Ethernet DatagLANce configurations to
   Token-Ring DatagLANce configurations and vice-versa.  Even though this
   utility can assist you in the conversion process, you must make sure that
   media-specific events (such as beacon frames for token-ring, collisions for
   Ethernet) and alarms are applicable to both networks. Event detectors
   configured for pattern matches should also be examined after conversion to
   make sure the pattern will match the media's frame formats. This utility can
   be found in the directory where you installed the DatagLANce Network
   Analyzer software (usually \DGNA).

      Utility Command Syntax:
      -----------------------
      DGCFGCPY - DatagLANce Configuration Copy/Conversion Utility
      DGCFGCPY sourceapp configname targetapp [OVERWRITE]
        sourceapp can be TRMON or ENMON
        targetapp should be opposite (i.e. sourceapp=TRMON, targetapp=ENMON)
        configname may contain wildcards
      Examples: DGCFGCPY TRMON CAPTURE ENMON
                DGCFGCPY ENMON * TRMON

 o Command line invocation of the DatagLANce Network Analyzer Applications
   (supporting TELNET)

   This utility lets you start and stop the DatagLANce Network Analyzer
   applications from an OS/2 command file as well as a TELNET session (if OS/2
   TCP/IP and another network adapter is installed).  This utility uses the
   DGLAUNCH program and options described in "DatagLANce Network Analyzer
   Command Line Options" in this file to make a simple interface to allow you
   to control the DatagLANce Network Analyzer from the command line.

   Before using this utility you must create configurations to use when
   invoking DatagLANce.  You can use any of the supplied DatagLANce
   configuration or create your own.

   This utility should be run from the directory where you installed the
   DatagLANce Network Analyzer software.

   Note:  All verfication message boxes are disabled by this utility. Therefore
   be aware that associated current data and data files will be overwritten
   without notice.

     Warning: For Token-Ring, you must guarrantee that the ring speed is set
     correctly!  If DatagLANce enters the ring at the wrong ring speed the ring
     will go down and stay down until you stop the analyzer. Use the DGCFGMOD
     command to make sure the ring speed is correct (see above) BEFORE starting
     the TRMON application using the LAUNCH command. If the application has
     already been started, use the EXIT command first before using DGCFGMOD to
     set the ring speed.

          Utility Command Syntax:
          -----------------------
          DGCMD appname command [options]
            where appname is TRMON or ENMON
              (or TRMON1/TRMON2 ENMON1/ENMON2 if dual interfaces installed)
            command and [options] are:
              LAUNCH [configname]
              START
              STOP
              PRINT [ REPORT  reportcode [outputfile [/CSV]] or
                      TRAFFIC #entries   [outputfile [/CSV]] ]
              SORT  [ TOTAL or TO or FROM or TOANDFROM or BOTH or ASCENDING or
                      DESCENDING or sortcode ]
              EXIT

          Description of options:

            LAUNCH [configname]
            - starts the application (if it is not already started) and causes the
              application to load the configuration configname. STARTUP will be
              loaded if configname is omitted.

            START
            - Causes DatagLANce to start monitoring/capturing.

            STOP
            - Causes DatagLANce to stop monitoring/capturing.

            PRINT REPORT  reportcode [outputfile [/CSV]]
            - Prints a DatagLANce report.  Output will be to PRN: if outputfile
              is omitted. /CSV can be used to output comma-separated-variable format
              to the file specified.

              reportcode can be one of the following:
                0   Cumulative Network Statistics
                1   Cumulative Event Statistics
                2   Event Distribution (% of Frames)
                3   Event Distribution (% of Bytes)
                4   Event Distribution (% of Utilization)
                5   Event Distribution (All)
                6   All Frames History (Peaks Only)
                7   All Frames History
                8   Captured Frames History
                9   Custom Event 1 History
               10   Custom Event 2 History
               11   Custom Event 3 History
               12   Custom Event 4 History
               13   Custom Event 5 History

              If traffic analysis is enabled the following reportcodes print
              the reports below, depending on which traffic analysis was
              performed:

              DLC Station Analysis:
              128   Top 10 Talkers (DLC Addresses)
              129   Top 10 Listeners (DLC Addresses)
              130   Busiest 10 Stations (DLC Addresses)
              131   Top 10 Errors
              132   Station List (DLC Addresses)

              DLC Traffic Matrix Analysis:
              128   Top 10 DLC Station Pairs (Frames)
              129   Top 10 DLC Station Pairs (Bytes)

              Network Station Analysis:
              128   Top 10 Talkers (Network Addresses)
              129   Top 10 Listeners (Network Addresses)
              130   Busiest 10 Stations (Network Addresses)
              131   Station List (Network Addresses)

              Protocol Matrix Analysis:
              128   Top 10 Protocol Pairs (Frames)
              129   Top 10 Protocol Pairs (Bytes)

              Dynamic Protocol Distribution Analysis:
              128   Frame Length Distribution
              129   Top 10 Protocols (Frames)
              130   Top 10 Protocols (Bytes)
              131   Major Protocol Distribution (Frames)
              132   Major Protocol Distribution (Bytes)
              133   All Protocols (Frames)
              134   All Protocols (Bytes)

              Source Routing Traffic Analysis:
              128   Top 10 Routes (Frames)
              129   Top 10 Routes (Bytes)
              130   All Routes (Frames)
              131   All Routes (Bytes)
              132   Source Routing Length Distribution
              133   Source Routing Type Distribution

              Token-Ring Soft Error Analysis:
              128   Top 10 Soft Errors (Breakdown)
              129   All Soft Errors (Breakdown)


            PRINT TRAFFIC #entries [outputfile [/CSV]]
            - Prints the traffic statistics accumulated. The fields printed are
              those selected for display in the traffic statistics window, so make
              sure your configuration is setup to display all the information you
              want printed.  #entries is the maximum number of traffic statistics
              entries to print (starting with first). Output will be to PRN: if
              outputfile is omitted. /CSV can be used to output
              comma-separated-variable format to the file specified. Using the SORT
              command (see below) you can cause the traffic statistics to be sorted
              in a special way before printing.

            SORT  [ TOTAL or TO or FROM or TOANDFROM or BOTH or ASCENDING or
                    DESCENDING or sortcode ]
            - Re-sorts the traffic statistics accumulated using the option specified.
              sortcode is a number from 0 to 31.  All sort codes don't apply to
              all traffic analysis options.  The following are some common
              sort codes:

              0  station address
              1  partner address
              2  status (DLC station analysis)
              3  frames
              4  bytes
              5  avg frame rate
              6  avg byte rate
              7  avg size
              8  avg utilization
              9  percent frame traffic
              10 percent byte traffic
              12 first activity
              13 last activity
              14 elapsed activity
              16 errors (DLC station analysis)
              17 largest frame size
              18 smallest frame size
              20 station DLC address (protocol matrix analysis)
              21 partner DLC address (protocol matrix analysis)
              22 major protocol
              23 minor protocol
              24 source routing length (protocol matrix analysis)
              25 source ring number (protocol matrix analysis)
              26 destination ring number (protocol matrix analysis)

            EXIT
            - closes and exits the application. Any changes to the configuration
              will automatically be saved (including SORT options for traffic
              statistics).  You must issue a STOP command before EXIT to insure that
              the program is exits when you issue this command.

     Usage notes:

    - Use CALL before DGCMD in OS/2 command files.

    - Use the DGSLEEP utility to allow for sufficient time between commands
      (especially large print jobs).  The syntax is:

                 DGSLEEP HH:MM    where HH is hour (0-23) and MM is minute (0-59)
              or DGSLEEP seconds


ΓòÉΓòÉΓòÉ 19.4. Example Scenarios for the DatagLANce Command Line Interface ΓòÉΓòÉΓòÉ

      1. Setting up the DatagLANce Network Analyzer to startup automatically,
         monitor a network daily, print daily reports, and copy those reports
         to a central file server.  This scenario requires another adapter for
         network communication and file-sharing software (such as NFS, OS/2 LAN
         Requester, etc.).

         For this example we created a Token-Ring DatagLANce configuration
         called MONITOR with DLC Station Traffic Analysis enabled.

         a. Create/modify STARTUP.CMD in C:\OS2:

                        <issue the command log onto the network and mount the central file
                         server as drive P:>

                        rem Change to the DatagLANce directory
                        C:
                        CD \DGNA

                        rem Make sure the ring speed is set correctly
                        CALL DGCFGMOD TRMON MONITOR RINGSPEED:16

                        rem Load MONITOR configuration (customized by user)
                        CALL DGCMD TRMON LAUNCH MONITOR

                        rem This label will cause us to loop forever (when we go to it later)
                        :LOOP

                        rem Start monitoring the network
                        CALL DGCMD TRMON START

                        rem Go to sleep until 11:45 PM at night using DGSLEEP utility
                        DGSLEEP 23:45

                        rem When we wake up, let's stop the monitor
                        CALL DGCMD TRMON STOP

                        rem Print desired reports
                        CALL DGCMD TRMON PRINT REPORT 0 NETSTAT.PRN
                        DGSLEEP 30
                        CALL DGCMD TRMON PRINT REPORT 7 HISTORY.PRN
                        DGSLEEP 30
                        CALL DGCMD TRMON PRINT REPORT 131 TOPERRS.PRN
                        DGSLEEP 30

                        rem Print desired traffic statistics (top 100 talkers, listeners)
                        rem sort by frames
                        CALL DGCMD TRMON SORT 0
                        DGSLEEP 30
                        rem sort by top talkers
                        CALL DGCMD TRMON SORT FROM
                        DGSLEEP 30
                        rem print top 100 talkers
                        CALL DGCMD TRMON PRINT TRAFFIC 100 TALKERS.PRN
                        DGSLEEP 30
                        rem sort by top listeners
                        CALL DGCMD TRMON SORT TO
                        DGSLEEP 30
                        rem print top 100 listeners
                        CALL DGCMD PRINT TRAFFIC 100 LISTENRS.PRN
                        DGSLEEP 30

                        rem Backup reports in this DatagLANce's directory on the file server
                        rem These commands make sure only last 10 days reports are saved
                        IF EXIST P:\REPORTS\DG_1\*.10   DEL P:\REPORTS\DG_1\*.10
                        IF EXIST P:\REPORTS\DG_1\*.9 RENAME P:\REPORTS\DG_1\*.9 *.10
                        IF EXIST P:\REPORTS\DG_1\*.8 RENAME P:\REPORTS\DG_1\*.8 *.9
                        IF EXIST P:\REPORTS\DG_1\*.7 RENAME P:\REPORTS\DG_1\*.7 *.8
                        IF EXIST P:\REPORTS\DG_1\*.6 RENAME P:\REPORTS\DG_1\*.6 *.7
                        IF EXIST P:\REPORTS\DG_1\*.5 RENAME P:\REPORTS\DG_1\*.5 *.6
                        IF EXIST P:\REPORTS\DG_1\*.4 RENAME P:\REPORTS\DG_1\*.4 *.5
                        IF EXIST P:\REPORTS\DG_1\*.3 RENAME P:\REPORTS\DG_1\*.3 *.4
                        IF EXIST P:\REPORTS\DG_1\*.2 RENAME P:\REPORTS\DG_1\*.2 *.3
                        IF EXIST P:\REPORTS\DG_1\*.1 RENAME P:\REPORTS\DG_1\*.1 *.2
                        IF EXIST P:\REPORTS\DG_1\*.PRN RENAME P:\DGNA\REPORTS\DG_1\*.PRN *.1

                        rem Now copy the reports to appropriate directory
                        COPY *.PRN P:\REPORTS\DG_1

                        rem Start the monitoring/report process again
                        GOTO LOOP

         b. Run STARTUP or reboot OS/2 (STARTUP will automatically run when the
            system is started).

      2. Using TELNET and FTP to do remote captures on DatagLANce from another
         DatagLANce network analyzer.

         For this scenario we have two Ethernet DatagLANce Network Analyzers,
         with two network adapters in each (one for DatagLANce one for network
         communication). One DatagLANce (remotely located) is configured to
         accept TELNET sessions and FTP requests.  Each DatagLANce Network
         Analyzer has OS/2 TCP/IP installed.

         a. Configure the local DatagLANce to capture the desired traffic on
            the remote DatagLANce.  Make sure that you select Capture to File.
            For this example we will assume that your configuration will be
            named CAPTURE and that you will capture to the file ETHERNET.DGC.

         b. FTP all files of the configuration (see Appendix E of the User's
            Guide concerning configuration files) to the remote DatagLANce.
            Make sure that you place the configuration files in the same
            directory as the DatagLANce Network Analyzer software is installed
            (use the FTP CD command to change to the correct directory).  Use
            the FTP MPUT command to MPUT CAPTURE.Y?? (all files for the
            Ethernet DatagLANce CAPTURE configuration) to the remote
            DatagLANce.

         c. TELNET to the remote DatagLANce. Move to the directory where the
            DatagLANce Network Analyzer software is installed.

         d. Issue the following commands:

                        DGCMD ENMON LAUNCH CAPTURE
                        DGCMD ENMON START
                        <wait for the capture to stop or the event
                        that you are capturing to occur>
                        DGCMD ENMON STOP

         e. FTP ETHERNET.DGC to the local DatagLANce and analyze it with the
            DatagLANce Protocol Analysis software.

      3. Monitoring a network's statistics and history using DatagLANce and
         TELNET.

         This scenario will use a TELNET session to keep watch on a network
         monitored by a remote DatagLANce Network Analyzer.  The remote
         DatagLANce Network Analyzer has two network adapters (one for the
         DatagLANce function and one for TCP/IP communication).  OS/2 TCP/IP is
         also installed on the remote DatagLANce.  For this scenario we assume
         that the remote DatagLANce is a Token-Ring DatagLANce and that
         DatagLANce is already monitoring on the remote LAN (the commands are
         not displayed in this scenario for launching and starting the
         application, see the previous scenarios).

         a. Create SHOWSTAT.CMD on the remote DatagLANce Network Analyzer:

                        CALL DGCMD PRINT REPORT 0 NETSTAT.PRN
                        DGSLEEP 30
                        TYPE NETSTAT.PRN

         b. Create SHOWHIST.CMD on the remote DatagLANce Network Analyzer:

                        CALL DGCMD PRINT REPORT 7 HISTORY.PRN
                        DGSLEEP 30
                        TYPE HISTORY.PRN

         c. TELNET into the remote DatagLANce and move to the directory that
            the DatagLANce Network Analyzer software is installed.

         d. Type SHOWSTAT or SHOWHIST as desired.  Note you could modify the
            command files to continuously loop displaying statistics as they
            refresh.


ΓòÉΓòÉΓòÉ 20. List of Abbreviations ΓòÉΓòÉΓòÉ

     ARP        Address Control Message Protocol

     ANSI       American National Standards Institute

     ASCII      American National Standard Code for Information Exchange

     BPDU       Bride Protocol Data Unit

     CRC        Cyclic redundancy check

     DA         Destination Address

     DARPA      Defense Advanced Research Projects Agency

     DDN        Defense Data Network

     DISC       Disconnect

     DLC        Data link control

     DM         Disconnected Mode

     DOS        Disk Operating System

     DSAP       Destination service access point.

     EBCDIC     Extended binary-coded decimal interchange code

     FCS        Frame check sequence

     FDDI       Fiber Distributed Data Interface

     FIFO       First-in first-out

     FRMR       Frame Reject

     FS         Frame Status

     GB         Gigabyte

     ICMP       Internet Control Message Protocol

     ID         Identifier

     IEEE       Institute of Electrical and Electronics Engineers

     IP         Internet Protocol

     ISA        Industry Standard Architecture

     ISO        International Organization for Standardization

     I/O        Input/output

     LSB        Least significant bit

     KB         Kilobyte

     MB         Megabyte

     LAN        Local area network

     LED        Light emitting diode

     LLC        Logical Link Control

     LPDU       Logical Link Control Protocol Data Unit

     LSAP       Link service access point

     MAC        Media access control

     Mbps       Megabits per second

     MBps       Megabytes per second

     MHz        Megahertz

     MSB        Most significant bit

     msec       Milliseconds

     NAUN       Nearest active upstream neighbor

     NetBIOS    Network Basic Input/Output System

     NFS        Network File System

     OEM        Original equipment manufacturer

     OSI        Open Systems Interconnection

     OS/2       Operating System/2*

     PC         Personal computer

     PDU        Protocol Data Unit

     PS/2       Personal System/2

     RAM        Random access memory

     REJ        Reject

     RNR        Receiver Not Ready

     RR         Receiver Ready

     SA         Source address

     SAA*       Systems Application Architecture*

     SABME      Set Asynchronous Balance Mode Extended

     SAP        Service access point

     SCSI       Small Computer System Interface

     SNA        Systems Network Architecture

     SNAP       Sub-Network Access Protocol

     SSAP       Source service access point

     TAP        Trace and performance

     TCP        Transmission Control Protocol

     TCP/IP     Transmission Control Protocol/Internet Protocol

     TTL        Transistor-transistor logic

     UA         Unnumbered Acknowledgment

     UDP        User Datagram Protocol

     UI         Unnumbered Information

     XID        Exchange Identification

     XNS        Xerox** networking systems

     X.25       Packet-switched networks

     цsec       microsecond


ΓòÉΓòÉΓòÉ 21. Glossary ΓòÉΓòÉΓòÉ

This glossary defines the terms and abbreviations used in this book. It
includes terms and definitions from the IBM Dictionary of Computing
(Information Processing, Personal Computing, Telecommunications, Office
Systems, IBM-Specific Terms), SC20-1699.

     o The symbol (A) identifies definitions from the American National
       Dictionary for Information Processing Systems, copyright 1982 by the
       Computer and Business Equipment Manufacturers Association (CBEMA).

     o The symbol (I) identifies definitions from the ISO
       Vocabulary-Information Processing and ISO Vocabulary-Office Machines,
       developed by the International Organization for Standardization,
       Technical Committee 97, Subcommittee 1.

     o The symbol (T) identifies definitions from draft international
       standards, draft proposals, and working papers in development by the
       International Organization for Standardization, Technical Committee 97,
       Subcommittee 1.


ΓòÉΓòÉΓòÉ 21.1. absolute time ΓòÉΓòÉΓòÉ

absolute time

In DatagLANce Protocol Analysis, the arrival time-stamp of a frame that has
been captured. This time-stamp is to a resolution of 80 nanoseconds.


ΓòÉΓòÉΓòÉ 21.2. active ΓòÉΓòÉΓòÉ

active

      1. Able to communicate on the network. A token-ring network adapter is
         active if it is able to transmit and receive on the network.

      2. Operational.

      3. Pertaining to a node or device that is connected or is available for
         connection to another node or device.

      4. Currently transmitting or receiving.


ΓòÉΓòÉΓòÉ 21.3. active monitor ΓòÉΓòÉΓòÉ

active monitor

A function in a single adapter on a token-ring network that initiates the
transmission of tokens and provides token error recovery facilities. Any active
adapter on the ring has the ability to provide the active monitor function if
the current active monitor fails.


ΓòÉΓòÉΓòÉ 21.4. adapter ΓòÉΓòÉΓòÉ

adapter

In a LAN, within a communicating device, a circuit card that, with its
associated software and/or microcode, enables the device to communicate over
the network.


ΓòÉΓòÉΓòÉ 21.5. address ΓòÉΓòÉΓòÉ

address

      1. In data communication, the IEEE-assigned unique code or the unique
         locally administered code assigned to each device or workstation
         connected to a network.

      2. A character, group of characters, or a value that identifies a
         register, a particular part of storage, a data source, or a data sink.
         The value is represented by one or more characters. (T)

      3. To refer to a device or an item of data by its address. (A)

      4. The location in the storage of a computer where data is stored.

      5. In word processing, the location, identified by the address code, of a
         specific section of the recording medium or storage. (T)


ΓòÉΓòÉΓòÉ 21.6. analog ΓòÉΓòÉΓòÉ

analog

Pertaining to data consisting of continuously variable physical quantities. (A)
Contrast with digital.


ΓòÉΓòÉΓòÉ 21.7. architecture ΓòÉΓòÉΓòÉ

architecture

A logical structure that encompasses operating principles including services,
functions, and protocols. See computer architecture, network architecture,
Systems Application Architecture (SAA), Systems Network Architecture (SNA).


ΓòÉΓòÉΓòÉ 21.8. asynchronous ΓòÉΓòÉΓòÉ

asynchronous

      1. Pertaining to two or more processes that do not depend upon the
         occurrence of a specific event such as a common timing signal. (T)

      2. In Fiber Distributed Data Interface (FDDI) rings, a type of data
         traffic that does not need bounded access delay to the medium and
         guaranteed throughput.


ΓòÉΓòÉΓòÉ 21.9. attach ΓòÉΓòÉΓòÉ

attach

To make a device a part of a network logically.

      Note Not to be confused with connect, which implies physically connecting
     a device to a network.


ΓòÉΓòÉΓòÉ 21.10. attaching device ΓòÉΓòÉΓòÉ

attaching device

Any device that is physically connected to a network and can communicate over
the network.


ΓòÉΓòÉΓòÉ 21.11. automatic single-route broadcast ΓòÉΓòÉΓòÉ

automatic single-route broadcast

A function used by some IBM bridge programs to determine the correct settings
for, and set the bridge single-route broadcast configuration parameters
dynamically, without operator intervention. As bridges enter and leave the
network, the parameter settings may need to change to maintain a single path
between any two LAN segments for single-route broadcast messages. See also
single-route broadcast.


ΓòÉΓòÉΓòÉ 21.12. bandwidth ΓòÉΓòÉΓòÉ

bandwidth

  1. The difference, expressed in hertz, between the highest and the lowest
     frequencies of a range of frequencies. For example, analog transmission by
     recognizable voice telephone requires a bandwidth of about 3000 hertz
     (3 kHz).

  2. The bandwidth of an optical link designates the information-carrying
     capacity of the link and is related to the maximum bit rate that a fiber
     link can support.


ΓòÉΓòÉΓòÉ 21.13. beacon ΓòÉΓòÉΓòÉ

beacon

  1. A frame sent by an adapter on a ring network indicating a serious ring
     problem, such as a broken cable. It contains the addresses of the
     beaconing station and its nearest active upstream neighbor (NAUN).

  2. To send beacon frames continuously. An adapter is beaconing if it is
     sending such a frame.


ΓòÉΓòÉΓòÉ 21.14. beaconing ΓòÉΓòÉΓòÉ

beaconing

An error-indicating function of token-ring adapters that assists in locating a
problem causing a hard error on a token-ring network.


ΓòÉΓòÉΓòÉ 21.15. binary ΓòÉΓòÉΓòÉ

binary

  1. Pertaining to a system of numbers to the base two; the binary digits are 0
     and 1. (A)

  2. Pertaining to a selection, choice, or condition that has two possible
     different values or states. (I) (A)


ΓòÉΓòÉΓòÉ 21.16. bit ΓòÉΓòÉΓòÉ

bit

Either of the binary digits:  a 0 or 1.


ΓòÉΓòÉΓòÉ 21.17. bridge ΓòÉΓòÉΓòÉ

bridge

  1. An attaching device that connects two LAN segments to allow the transfer
     of information from one LAN segment to the other. A bridge may connect the
     LAN segments directly by network adapters and software in a single device,
     or may connect network adapters in two separate devices through software
     and use of a telecommunications link between the two adapters.

  2. A functional unit that connects two LANs that use the same logical link
     control (LLC) procedures but may use the same or different medium access
     control (MAC) procedures. (T) Contrast with gateway and router.


ΓòÉΓòÉΓòÉ 21.18. bridge number ΓòÉΓòÉΓòÉ

bridge number

The bridge identifier that the user specifies in the bridge program
configuration file. The bridge number distinguishes among parallel bridges.
Parallel bridges connect the same two LAN segments.


ΓòÉΓòÉΓòÉ 21.19. broadband local area network (LAN) ΓòÉΓòÉΓòÉ

broadband local area network (LAN)

A local area network (LAN) in which information is encoded, multiplexed, and
transmitted through modulation of a carrier. (T)


ΓòÉΓòÉΓòÉ 21.20. broadcast ΓòÉΓòÉΓòÉ

broadcast

Simultaneous transmission of data to more than one destination.


ΓòÉΓòÉΓòÉ 21.21. broadcast frame ΓòÉΓòÉΓòÉ

broadcast frame

A frame that is simultaneously transmitted to more than one destination. A
broadcast frame is forwarded by all bridges, unless otherwise restricted.


ΓòÉΓòÉΓòÉ 21.22. buffer ΓòÉΓòÉΓòÉ

buffer

  1. A portion of storage used to hold input or output data temporarily.

  2. A routine or storage used to compensate for a difference in data rate or
     time of occurrence of events, when transferring data from one device to
     another. (A)


ΓòÉΓòÉΓòÉ 21.23. bus ΓòÉΓòÉΓòÉ

bus

  1. In a processor, a physical facility on which data is transferred to all
     destinations, but from which only addressed destinations may read in
     accordance with appropriate conventions. (I)

  2. A network configuration in which nodes are interconnected through a
     bidirectional transmission medium.

  3. One or more conductors used for transmitting signals or power. (A)


ΓòÉΓòÉΓòÉ 21.24. byte ΓòÉΓòÉΓòÉ

byte

  1. A string that consists of a number of bits, treated as a unit, and
     representing a character. (T)

  2. A binary character operated upon as a unit and usually shorter than a
     computer word. (A)

  3. A string that consists of a particular number of bits, usually 8, that is
     treated as a unit, and that represents a character.

  4. A group of 8 adjacent binary digits that represent one extended
     binary-coded decimal interchange code (EBCDIC) character.

  5. See n-bit byte.


ΓòÉΓòÉΓòÉ 21.25. cable loss (optical) ΓòÉΓòÉΓòÉ

cable loss (optical)

The loss in an optical cable equals the attenuation coefficient for the cabled
fiber times the cable length.


ΓòÉΓòÉΓòÉ 21.26. cable segment ΓòÉΓòÉΓòÉ

cable segment

A section of cable between components or devices on a network. A segment may
consist of a single patch cable, multiple patch cables connected together, or a
combination of building cable and patch cables connected together. See LAN
segment, ring segment.


ΓòÉΓòÉΓòÉ 21.27. checksum ΓòÉΓòÉΓòÉ

checksum

  1. The sum of a group of data associated with the group and used for checking
     purposes. (T)

  2. On a diskette, data written in a sector for error-detection purposes; a
     calculated checksum that does not match the checksum of data written in
     the sector indicates a bad sector.

     Note:  The data is either numeric or other character strings regarded as
            numeric for the purpose of calculating the checksum.


ΓòÉΓòÉΓòÉ 21.28. circuit ΓòÉΓòÉΓòÉ

circuit

  1. A logic device.

  2. One or more conductors through which an electric current can flow.


ΓòÉΓòÉΓòÉ 21.29. collision ΓòÉΓòÉΓòÉ

collision

An attempt by two units to send a message at one time on a single channel. In
some networks, the detection of a collision causes all senders to stop
transmissions, while in others the collision is noticed when the receiving
station fails to acknowledge the data.


ΓòÉΓòÉΓòÉ 21.30. command ΓòÉΓòÉΓòÉ

command

  1. A request for performance of an operation or execution of a program.

  2. A character string from a source external to a system that represents a
     request for system action.


ΓòÉΓòÉΓòÉ 21.31. computer architecture ΓòÉΓòÉΓòÉ

computer architecture

The organizational structure of a computer system, including hardware and
software. (A)


ΓòÉΓòÉΓòÉ 21.32. configuration ΓòÉΓòÉΓòÉ

configuration

  1. The arrangement of a computer system or network as defined by the nature,
     number, and chief characteristics of its functional units. More
     specifically, the term may refer to a hardware configuration or a software
     configuration. (I) (A)

  2. The devices and programs that make up a system, subsystem, or network.

  3. See also system configuration.


ΓòÉΓòÉΓòÉ 21.33. configuration file ΓòÉΓòÉΓòÉ

configuration file

The collective set of definitions that describes a configuration.


ΓòÉΓòÉΓòÉ 21.34. connect ΓòÉΓòÉΓòÉ

connect

In a LAN, to physically join a cable from a station to an access unit or
network connection point. Contrast with attach.


ΓòÉΓòÉΓòÉ 21.35. contention ΓòÉΓòÉΓòÉ

contention

In a LAN, a situation in which two or more data stations are allowed by the
protocol to start transmitting concurrently and thus risk collision. (T)


ΓòÉΓòÉΓòÉ 21.36. cumulative statistics ΓòÉΓòÉΓòÉ

cumulative statistics

Statistics that have been collected by the DatagLANce analyzer since the
beginning of a monitoring session.


ΓòÉΓòÉΓòÉ 21.37. current statistics ΓòÉΓòÉΓòÉ

current statistics

Statistics that have been collected by the DatagLANce analyzer during the last
screen refresh interval.


ΓòÉΓòÉΓòÉ 21.38. custom event ΓòÉΓòÉΓòÉ

custom event

A user-specified event equation that will cause all frames passing the equation
to be counted.


ΓòÉΓòÉΓòÉ 21.39. cyclic redundancy check (CRC) ΓòÉΓòÉΓòÉ

cyclic redundancy check (CRC)

Synonym for frame check sequence (FCS).


ΓòÉΓòÉΓòÉ 21.40. data ΓòÉΓòÉΓòÉ

data

  1. A representation of facts, concepts, or instructions in a formalized
     manner suitable for communication, interpretation, or processing by human
     or automatic means. (I) (A)

  2. Any representations such as characters or analog quantities to which
     meaning is or might be assigned. (A)


ΓòÉΓòÉΓòÉ 21.41. data link ΓòÉΓòÉΓòÉ

data link

  1. Any physical link, such as a wire or a telephone circuit, that connects
     one or more remote terminals to a communication control unit, or connects
     one communication control unit with another.

  2. The assembly of parts of two data terminal equipment (DTE) devices that
     are controlled by a link protocol, and the interconnecting data circuit,
     that enable data to be transferred from a data source to a data sink. (I)

  3. In SNA, see also link.

     Note:  A telecommunication line is only the physical medium of
            transmission. A data link includes the physical medium of
            transmission, the protocol, and associated devices and programs; it
            is both physical and logical.


ΓòÉΓòÉΓòÉ 21.42. data link control (DLC) layer ΓòÉΓòÉΓòÉ

data link control (DLC) layer

  1. In SNA or Open Systems Interconnection (OSI), the layer that schedules
     data transfer over a link between two nodes and performs error control for
     the link. Examples of DLC are synchronous data link control (SDLC) for
     serial-by-bit connection and DLC for the System/370* channel.

  2. See Systems Network Architecture (SNA).

  3. See also logical link control (LLC) sublayer, medium access control (MAC)
     sublayer.

     Note:  The DLC layer is usually independent of the physical transport
            mechanism and ensures the integrity of data that reach the higher
            layers.


ΓòÉΓòÉΓòÉ 21.43. data network ΓòÉΓòÉΓòÉ

data network

An arrangement of data circuits and switching facilities for establishing
connections between data terminal equipment. (I)


ΓòÉΓòÉΓòÉ 21.44. data rate ΓòÉΓòÉΓòÉ

data rate

See data transfer rate, line data rate.


ΓòÉΓòÉΓòÉ 21.45. data transfer rate ΓòÉΓòÉΓòÉ

data transfer rate

The average number of bits, characters, or blocks per unit of time passing
between equipment in a data-transmission session. (I) The rate is expressed in
bits, characters, or blocks per second, minute, or hour.


ΓòÉΓòÉΓòÉ 21.46. default ΓòÉΓòÉΓòÉ

default

Pertaining to an attribute, value, or option that is assumed when none is
explicitly specified.


ΓòÉΓòÉΓòÉ 21.47. datagram ΓòÉΓòÉΓòÉ

datagram

A particular type of information encapsulation at the network layer of the
adapter protocol. No explicit acknowledgment for the information is sent by the
receiver. Instead, transmission relies on the "best effort" of the link layer.


ΓòÉΓòÉΓòÉ 21.48. delimiter ΓòÉΓòÉΓòÉ

delimiter

  1. A character used to indicate the beginning or end of a character string.
     (T)

  2. A bit pattern that defines the beginning or end of a frame or token on a
     LAN.


ΓòÉΓòÉΓòÉ 21.49. destination ΓòÉΓòÉΓòÉ

destination

Any point or location, such as a node, station, or particular terminal, to
which information is to be sent.


ΓòÉΓòÉΓòÉ 21.50. destination address ΓòÉΓòÉΓòÉ

destination address

A field in the medium access control (MAC) frame that identifies the physical
location to which information is to be sent. Contrast with source address.


ΓòÉΓòÉΓòÉ 21.51. destination service access point (DSAP) ΓòÉΓòÉΓòÉ

destination service access point (DSAP)

The service access point for which a logical link control protocol data unit
(LPDU) is intended.


ΓòÉΓòÉΓòÉ 21.52. device ΓòÉΓòÉΓòÉ

device

  1. A mechanical, electrical, or electronic contrivance with a specific
     purpose.

  2. An input/output unit such as a terminal, display, or printer. See also
     attaching device.


ΓòÉΓòÉΓòÉ 21.53. device driver ΓòÉΓòÉΓòÉ

device driver

The code needed to attach and use a device on a computer or a network.


ΓòÉΓòÉΓòÉ 21.54. digital ΓòÉΓòÉΓòÉ

digital

  1. Pertaining to data in the form of digits. (A) Contrast with analog.

  2. Pertaining to data consisting of numerical values or discrete units.


ΓòÉΓòÉΓòÉ 21.55. disabled ΓòÉΓòÉΓòÉ

disabled

  1. Pertaining to a state of a processing unit that prevents the occurrence of
     certain types of interruptions.

  2. Pertaining to the state in which a transmission control unit or audio
     response unit cannot accept incoming calls on a line.


ΓòÉΓòÉΓòÉ 21.56. disconnected mode ΓòÉΓòÉΓòÉ

disconnected mode

  1. In synchronous data link control (SDLC), a response from a secondary
     station indicating that it is disconnected and wants to be online.

  2. Synonym for disconnected phase.


ΓòÉΓòÉΓòÉ 21.57. disconnected phase ΓòÉΓòÉΓòÉ

disconnected phase

A phase entered by data circuit-terminating equipment (DCE) when it detects
error conditions, recovers from a temporary internal malfunction, or receives a
disconnect (DISC) command from data terminal equipment (DTE). In the
disconnected phase, the DCE may initiate link setup but can transmit only
disconnected-mode responses to received frames. Synonymous with disconnected
mode (2).


ΓòÉΓòÉΓòÉ 21.58. Disk Operating System ΓòÉΓòÉΓòÉ

Disk Operating System

An operating system for computer systems that use disks and diskettes for
auxiliary storage of programs and data.


ΓòÉΓòÉΓòÉ 21.59. downstream ΓòÉΓòÉΓòÉ

downstream

  1. On an IBM Token-Ring Network, the direction of data flow.

  2. In the direction of data flow or toward the destination of transmission.
     Contrast with upstream.


ΓòÉΓòÉΓòÉ 21.60. drop ΓòÉΓòÉΓòÉ

drop

A cable that leads from a faceplate to the distribution panel in a wiring
closet. When the IBM Cabling System is used with the IBM Token-Ring Network, a
drop may form part of a lobe. See also lobe.


ΓòÉΓòÉΓòÉ 21.61. dump ΓòÉΓòÉΓòÉ

dump

  1. To write at a particular instant the contents of storage, or part of
     storage, onto another data medium for the purpose of safeguarding or
     debugging the data. (T)

  2. Data that has been dumped. (I) (A)


ΓòÉΓòÉΓòÉ 21.62. EBCDIC ΓòÉΓòÉΓòÉ

EBCDIC

Extended binary-coded decimal interchange code. A coded character set
consisting of 8-bit coded characters. (A)


ΓòÉΓòÉΓòÉ 21.63. enabled ΓòÉΓòÉΓòÉ

enabled

  1. On a LAN, pertaining to an adapter or device that is active, operational,
     and able to receive frames from the network.

  2. Pertaining to a state of a processing unit that allows the occurrence of
     certain types of interruptions.

  3. Pertaining to the state in which a transmission control unit or an audio
     response unit can accept incoming calls on a line.


ΓòÉΓòÉΓòÉ 21.64. end delimiter ΓòÉΓòÉΓòÉ

end delimiter

The last byte of a token or frame, consisting of a special, recognizable bit
pattern.


ΓòÉΓòÉΓòÉ 21.65. Ethernet network ΓòÉΓòÉΓòÉ

Ethernet network

A baseband LAN with a bus topology in which messages are broadcast on a coaxial
cable using a carrier sense multiple access/collision detection (CSMA/CD)
transmission method.


ΓòÉΓòÉΓòÉ 21.66. event ΓòÉΓòÉΓòÉ

event

A frame that matches some set of criteria. Example events include a TCP/IP
frame, frame containing a specific source address, or an SMT SRF frame
containing a specific source and destination address.


ΓòÉΓòÉΓòÉ 21.67. event detector ΓòÉΓòÉΓòÉ

event detector

A hardware or software module that identifies a frame as matching or not
matching a particular event's criteria. Event detectors are used in event
equations to select frames for monitoring, capturing, or displaying (see event
equation).


ΓòÉΓòÉΓòÉ 21.68. event equation ΓòÉΓòÉΓòÉ

event equation

An equation describing one or more events whose result is TRUE or FALSE for
every frame that is examined by the DatagLANce analyzer. Event Equations are
used to select events to monitor (Custom Event Equation), capture a frame
(Frame Capture Filter Equation), or display a frame in the protocol analysis
software (Display Filter Equation).


ΓòÉΓòÉΓòÉ 21.69. extended binary-coded decimal interchange code (EBCDIC) ΓòÉΓòÉΓòÉ

extended binary-coded decimal interchange code (EBCDIC)

A coded character set consisting of 8-bit coded characters.


ΓòÉΓòÉΓòÉ 21.70. fault ΓòÉΓòÉΓòÉ

fault

An accidental condition that causes a functional unit to fail to perform its
required function. (I) (A)


ΓòÉΓòÉΓòÉ 21.71. function ΓòÉΓòÉΓòÉ

function

A part of an IBM product that may be ordered separately by the customer.


ΓòÉΓòÉΓòÉ 21.72. Fiber Distributed Data Interface (FDDI) ΓòÉΓòÉΓòÉ

Fiber Distributed Data Interface (FDDI)

A high-performance, general-purpose, multi-station network designed for
efficient operation with a peak data transfer rate of 100 Mbps. It uses
token-ring architecture with optical fiber as the transmission medium over
distances of several kilometers.


ΓòÉΓòÉΓòÉ 21.73. field ΓòÉΓòÉΓòÉ

field

On a data medium or a storage medium, a specified area used for a particular
category of data; for example, a group of character positions used to enter or
display wage rates on a panel.  (T)


ΓòÉΓòÉΓòÉ 21.74. file ΓòÉΓòÉΓòÉ

file

A named set of records stored or processed as a unit. (T)


ΓòÉΓòÉΓòÉ 21.75. file name ΓòÉΓòÉΓòÉ

file name

  1. A name assigned or declared for a file.

  2. The name used by a program to identify a file.


ΓòÉΓòÉΓòÉ 21.76. file server ΓòÉΓòÉΓòÉ

file server

A high-capacity disk storage device or a computer that each computer on a
network can access to retrieve files that can be shared among the attached
computers.


ΓòÉΓòÉΓòÉ 21.77. filter ΓòÉΓòÉΓòÉ

filter

A device or program that separates data, signals, or material in accordance
with specified criteria. (A)


ΓòÉΓòÉΓòÉ 21.78. filtered frames ΓòÉΓòÉΓòÉ

filtered frames

Frames that arrive at a bridge adapter but are not forwarded across the bridge,
because of criteria specified in a filter program used with the bridge program.


ΓòÉΓòÉΓòÉ 21.79. first-in first-out (FIFO) ΓòÉΓòÉΓòÉ

first-in first-out (FIFO)

A queuing technique in which the next item to be retrieved is the item that has
been in the queue for the longest time. (A)


ΓòÉΓòÉΓòÉ 21.80. flag ΓòÉΓòÉΓòÉ

flag

A character or indicator that signals the occurrence of some condition, such as
the setting of a switch, or the end of a word. (A)


ΓòÉΓòÉΓòÉ 21.81. fixed disk drive ΓòÉΓòÉΓòÉ

fixed disk drive

In a personal computer system unit, a disk storage device that reads and writes
on rigid magnetic disks. It is faster and has a larger storage capacity than a
diskette and is permanently installed.


ΓòÉΓòÉΓòÉ 21.82. frame ΓòÉΓòÉΓòÉ

frame

  1. The unit of transmission in some LANs, including the IBM Token-Ring
     Network and the IBM PC Network. It includes delimiters, control
     characters, information, and checking characters. On a token-ring network,
     a frame is created from a token when the token has data appended to it. On
     a token bus network (IBM PC Network), all frames including the token frame
     contain a preamble, start delimiter, control address, optional data and
     checking characters, end delimiter, and are followed by a minimum silence
     period.

  2. A housing for machine elements.

  3. In synchronous data link control (SDLC), the vehicle for every command,
     every response, and all information that is transmitted using SDLC
     procedures. Each frame begins and ends with a flag.


ΓòÉΓòÉΓòÉ 21.83. frame alignment error ΓòÉΓòÉΓòÉ

frame alignment error

An error in a frame, indicated by a frame check sequence (FCS) indicator. When
excessive or missing bits occur during the reception of a frame, the frame is
misaligned.


ΓòÉΓòÉΓòÉ 21.84. frame check sequence (FCS) ΓòÉΓòÉΓòÉ

frame check sequence (FCS)

  1. A system of error checking performed at both the sending and receiving
     station after a block check character has been accumulated.

  2. A numeric value derived from the bits in a message that is used to check
     for any bit errors in transmission.

  3. A redundancy check in which the check key is generated by a cyclic
     algorithm. (T) Synonymous with cyclic redundancy check (CRC).


ΓòÉΓòÉΓòÉ 21.85. frame detail ΓòÉΓòÉΓòÉ

frame detail

In DatagLANce Protocol Analysis, a detail view of the frame selected in the
frame summary window.


ΓòÉΓòÉΓòÉ 21.86. frame hexdump ΓòÉΓòÉΓòÉ

frame hexdump

In DatagLANce Protocol Analysis, a hexadecimal view of the frame selected in
the frame summary window.


ΓòÉΓòÉΓòÉ 21.87. frame summary ΓòÉΓòÉΓòÉ

frame summary

In DatagLANce Protocol Analysis, a summary view of frames captured in which the
frame type, destination and source addresses, size, and interpretation of each
frame can be displayed.


ΓòÉΓòÉΓòÉ 21.88. function ΓòÉΓòÉΓòÉ

function

  1. A specific purpose of an entity, or its characteristic action. (A)

  2. In data communications, a machine action such as carriage return or line
     feed.


ΓòÉΓòÉΓòÉ 21.89. functional address ΓòÉΓòÉΓòÉ

functional address

In IBM network adapters, a special kind of group address in which the address
is bit-significant, each "on" bit representing a function performed by the
station (such as "Active Monitor," "Ring Error Monitor," "LAN Error Monitor,"
or "Configuration Report Server").


ΓòÉΓòÉΓòÉ 21.90. gateway ΓòÉΓòÉΓòÉ

gateway

A device and its associated software that interconnect networks or systems of
different architectures. The connection is usually made above the reference
model network layer. For example, a gateway allows LANs access to System/370
host computers. Contrast with bridge and router.


ΓòÉΓòÉΓòÉ 21.91. Glance ΓòÉΓòÉΓòÉ

Glance

A function of the DatagLANce analyzer that allows you to view traffic traveling
on your LAN without setting up to capture frames. Glance listens for frames for
the period of time selected or until its buffer is full and displays the frames
that were glanced in summary, detail and hexdump formats.


ΓòÉΓòÉΓòÉ 21.92. group ΓòÉΓòÉΓòÉ

group

  1. A set of related records that have the same value for a particular field
     in all records.

  2. A collection of users who can share access authorities for protected
     resources.

  3. A list of names that are known together by a single name.


ΓòÉΓòÉΓòÉ 21.93. group address ΓòÉΓòÉΓòÉ

group address

In a LAN, a locally administered address assigned to two or more adapters to
allow the adapters to copy the same frame. Contrast locally administered
address with universally administered address.


ΓòÉΓòÉΓòÉ 21.94. hard error ΓòÉΓòÉΓòÉ

hard error

An error condition on a network that requires that the source of the error be
removed or that the network be reconfigured before the network can resume
reliable operation. See also beaconing. Contrast with soft error.


ΓòÉΓòÉΓòÉ 21.95. hardware ΓòÉΓòÉΓòÉ

hardware

Physical equipment as opposed to programs, procedures, rules, and associated
documentation. (I) (A)


ΓòÉΓòÉΓòÉ 21.96. header ΓòÉΓòÉΓòÉ

header

The portion of a message that contains control information for the message such
as one or more destination fields, name of the originating station, input
sequence number, character string indicating the type of message, and priority
level for the message.


ΓòÉΓòÉΓòÉ 21.97. history statistics ΓòÉΓòÉΓòÉ

history statistics

Statistics collected versus time by the DatagLANce analyzer.


ΓòÉΓòÉΓòÉ 21.98. IBM Personal Computer Disk Operating System (DOS) ΓòÉΓòÉΓòÉ

IBM Personal Computer Disk Operating System (DOS)

A disk operating system based on MS-DOS.


ΓòÉΓòÉΓòÉ 21.99. inactive ΓòÉΓòÉΓòÉ

inactive

  1. Not operational.

  2. Pertaining to a node or device not connected or not available for
     connection to another node or device.

  3. Pertaining to a station that is only repeating frames or tokens, or both.


ΓòÉΓòÉΓòÉ 21.100. initialize ΓòÉΓòÉΓòÉ

initialize

In a LAN, to prepare the adapter (and adapter support code, if used) for use by
an application program.


ΓòÉΓòÉΓòÉ 21.101. insert ΓòÉΓòÉΓòÉ

insert

To make an attaching device an active part of a LAN.


ΓòÉΓòÉΓòÉ 21.102. interface ΓòÉΓòÉΓòÉ

interface

  1. A shared boundary between two functional units, defined by functional
     characteristics, common physical interconnection characteristics, signal
     characteristics, and other characteristics as appropriate. (I)

  2. A shared boundary. An interface may be a hardware component to link two
     devices or a portion of storage or registers accessed by two or more
     computer programs. (A)

  3. Hardware, software, or both, that links systems, programs, or devices.


ΓòÉΓòÉΓòÉ 21.103. interference ΓòÉΓòÉΓòÉ

interference

  1. The prevention of clear reception of broadcast signals.

  2. The distorted portion of a received signal.


ΓòÉΓòÉΓòÉ 21.104. jabber ΓòÉΓòÉΓòÉ

jabber

Transmission by a data station beyond the time interval allowed by the
protocol. (T)


ΓòÉΓòÉΓòÉ 21.105. jadder frame ΓòÉΓòÉΓòÉ

jadder frame

An Enternet frame composed of a portion of an original frame appended by
another.


ΓòÉΓòÉΓòÉ 21.106. LAN adapter ΓòÉΓòÉΓòÉ

LAN adapter

The circuit card within a communicating device (such as a personal computer)
that, together with its associated software, enables the device to be attached
to a LAN.


ΓòÉΓòÉΓòÉ 21.107. LAN multicast ΓòÉΓòÉΓòÉ

LAN multicast

The sending of a transmission frame intended to be accepted by a group of
selected data stations on the same LAN.


ΓòÉΓòÉΓòÉ 21.108. LAN segment ΓòÉΓòÉΓòÉ

LAN segment

  1. Any portion of a LAN (for example, a single bus or ring) that can operate
     independently but is connected to other parts of the establishment network
     via bridges.

  2. An entire ring or bus network without bridges. See cable segment, ring
     segment.


ΓòÉΓòÉΓòÉ 21.109. layer ΓòÉΓòÉΓòÉ

layer

  1. One of the seven levels of the Open Systems Interconnection reference
     model.

  2. In open systems architecture, a collection of related functions that
     comprise one level of hierarchy of functions. Each layer specifies its own
     functions and assumes that lower level functions are provided.

  3. In SNA, a grouping of related functions that are logically separate from
     the functions of other layers. Implementation of the functions in one
     layer can be changed without affecting functions in other layers.


ΓòÉΓòÉΓòÉ 21.110. limited broadcast ΓòÉΓòÉΓòÉ

limited broadcast

Synonym for single-route broadcast.


ΓòÉΓòÉΓòÉ 21.111. line data rate ΓòÉΓòÉΓòÉ

line data rate

The rate of data transmission over a telecommunications link.


ΓòÉΓòÉΓòÉ 21.112. link ΓòÉΓòÉΓòÉ

link

  1. The logical connection between nodes including the end-to-end link control
     procedures.

  2. The combination of physical media, protocols, and programming that
     connects devices on a network.

  3. In computer programming, the part of a program, in some cases a single
     instruction or an address, that passes control and parameters between
     separate portions of the computer program. (I) (A)

  4. To interconnect items of data or portions of one or more computer
     programs.

  5. In SNA, the combination of the link connection and link stations joining
     network nodes.


ΓòÉΓòÉΓòÉ 21.113. lobe ΓòÉΓòÉΓòÉ

lobe

In the IBM Token-Ring Network, the section of cable (which may consist of
several cable segments) that connects an attaching device to an access unit.


ΓòÉΓòÉΓòÉ 21.114. local area network (LAN) ΓòÉΓòÉΓòÉ

local area network (LAN)

A computer network located on a user's premises within a limited geographical
area.

Note:  Communication within a local area network is not subject to external
       regulations; however, communication across the LAN boundary may be
       subject to some form of regulation. (T)


ΓòÉΓòÉΓòÉ 21.115. locally administered address ΓòÉΓòÉΓòÉ

locally administered address

An adapter address that the user can assign to override the universally
administered address. Contrast with universally administered address.


ΓòÉΓòÉΓòÉ 21.116. logical link control protocol (LLC protocol) ΓòÉΓòÉΓòÉ

logical link control protocol (LLC protocol)

In a local area network, the protocol that governs the exchange of frames
between data stations independently of how the transmission medium is shared.
(T)


ΓòÉΓòÉΓòÉ 21.117. logical link control protocol data unit (LPDU) ΓòÉΓòÉΓòÉ

logical link control protocol data unit (LPDU)

The unit of information exchanged between network layer entities in different
nodes. The LPDU consists of the destination service access point (DSAP) and
source service access point (SSAP) address fields, the control field, and the
information field (if present).


ΓòÉΓòÉΓòÉ 21.118. logical link control (LLC) sublayer ΓòÉΓòÉΓòÉ

logical link control (LLC) sublayer

One of two sublayers of the ISO Open Systems Interconnection data link layer
(which corresponds to the SNA data link control layer), proposed for LANs by
the IEEE Project 802 Committee on Local Area Networks and the European Computer
Manufacturers Association (ECMA).  It includes those functions unique to the
particular link control procedures that are associated with the attached node
and are independent of the medium; this allows different logical link protocols
to coexist on the same network without interfering with each other.  The LLC
sublayer uses services provided by the medium access control (MAC) sublayer and
provides services to the network layer.


ΓòÉΓòÉΓòÉ 21.119. loop ΓòÉΓòÉΓòÉ

loop

A closed unidirectional signal path connecting input/output devices to a
network.


ΓòÉΓòÉΓòÉ 21.120. MAC frame ΓòÉΓòÉΓòÉ

MAC frame

Frames used to carry information to maintain the ring protocol and for exchange
of management information.


ΓòÉΓòÉΓòÉ 21.121. marked frame ΓòÉΓòÉΓòÉ

marked frame

In DatagLANce Protocol Analysis, the frame whose time-stamp is used in
calculating the relative time-stamp of a frame. See relative time.


ΓòÉΓòÉΓòÉ 21.122. medium access control (MAC) protocol ΓòÉΓòÉΓòÉ

medium access control (MAC) protocol

In a local area network, the part of the protocol that governs communication on
the transmission medium without concern for the physical characteristics of the
medium, but taking into account the topological aspects of the network, in
order to enable the exchange of data between data stations. (T)


ΓòÉΓòÉΓòÉ 21.123. medium access control sublayer (MAC sublayer) ΓòÉΓòÉΓòÉ

medium access control sublayer (MAC sublayer)

In a local area network, the part of the data link layer that applies medium
access control and supports topology-dependent functions. The MAC sublayer uses
the services of the physical layer to provide services to the logical link
control sublayer and all higher layers. (T)


ΓòÉΓòÉΓòÉ 21.124. megabit (Mb) ΓòÉΓòÉΓòÉ

megabit (Mb)

1 megabit = 1048576 bits.


ΓòÉΓòÉΓòÉ 21.125. megabyte (MB) ΓòÉΓòÉΓòÉ

megabyte (MB)

1 megabyte = 1048576 bytes.


ΓòÉΓòÉΓòÉ 21.126. message ΓòÉΓòÉΓòÉ

message

  1. A logical partition of the user device's data stream to and from the
     adapter.

  2. A group of characters and control bits transferred as an entity.


ΓòÉΓòÉΓòÉ 21.127. Micro Channel* ΓòÉΓòÉΓòÉ

Micro Channel*

The architecture used by IBM Personal System/2 computers, Models 50 and above.
This term is used to distinguish these computers from personal computers using
a PC I/O channel, such as an IBM PC, XT*, or an IBM Personal System/2 computer,
Model 25 or 30.


ΓòÉΓòÉΓòÉ 21.128. monitor ΓòÉΓòÉΓòÉ

monitor

  1. A functional unit that observes and records selected activities for
     analysis within a data processing system. Possible uses are to show
     significant departures from the norm, or to determine levels of
     utilization of particular functional units. (I) (A)

  2. Software or hardware that observes, supervises, controls, or verifies
     operations of a system. (A)


ΓòÉΓòÉΓòÉ 21.129. Multicast address ΓòÉΓòÉΓòÉ

Multicast address

See LAN multicast.


ΓòÉΓòÉΓòÉ 21.130. multitasking ΓòÉΓòÉΓòÉ

multitasking

  1. Pertaining to the concurrent execution of two or more tasks by a computer.

  2. Multiprogramming that provides for the concurrent performance, or
     interleaved execution, of two or more tasks.


ΓòÉΓòÉΓòÉ 21.131. name ΓòÉΓòÉΓòÉ

name

An alphanumeric term that identifies a data set, statement, program, or
cataloged procedure.


ΓòÉΓòÉΓòÉ 21.132. nanosecond (ns) ΓòÉΓòÉΓòÉ

nanosecond (ns)

One thousand millionth of a second.


ΓòÉΓòÉΓòÉ 21.133. n-bit byte ΓòÉΓòÉΓòÉ

n-bit byte

A string that consists of n bits. (T)


ΓòÉΓòÉΓòÉ 21.134. nearest active upstream neighbor (NAUN) ΓòÉΓòÉΓòÉ

nearest active upstream neighbor (NAUN)

For any given attaching device on an IBM Token-Ring Network, the attaching
device that is sending frames or tokens directly to it.


ΓòÉΓòÉΓòÉ 21.135. network ΓòÉΓòÉΓòÉ

network

  1. A configuration of data processing devices and software connected for
     information interchange.

  2. An arrangement of nodes and connecting branches. Connections are made
     between data stations. (T)


ΓòÉΓòÉΓòÉ 21.136. network architecture ΓòÉΓòÉΓòÉ

network architecture

The logical structure and operating principles of a computer network. (T) See
also systems network architecture (SNA) and Open Systems Interconnection (OSI)
architecture.

Note:  The operating principles of a network include those of services,
       functions, and protocols.


ΓòÉΓòÉΓòÉ 21.137. network layer ΓòÉΓòÉΓòÉ

network layer

  1. In the Open Systems Interconnection reference model, the layer that
     provides for the entities in the transport layer the means for routing and
     switching blocks of data through the network between the open systems in
     which those entities reside. (T)

  2. The layer that provides services to establish a path between systems with
     a predictable quality of service. See Open Systems Interconnection (OSI).


ΓòÉΓòÉΓòÉ 21.138. network status ΓòÉΓòÉΓòÉ

network status

The condition of the network.


ΓòÉΓòÉΓòÉ 21.139. node ΓòÉΓòÉΓòÉ

node

  1. Any device, attached to a network, that transmits and/or receives data.

  2. An endpoint of a link, or a junction common to two or more links in a
     network.

  3. In a network, a point where one or more functional units interconnect
     transmission lines.


ΓòÉΓòÉΓòÉ 21.140. noise ΓòÉΓòÉΓòÉ

noise

  1. A disturbance that affects a signal and that can distort the information
     carried by the signal. (T)

  2. Random variations of one or more characteristics of any entity, such as
     voltage, current, or data. (A)

  3. Loosely, any disturbance tending to interfere with normal operation of a
     device or system. (A)


ΓòÉΓòÉΓòÉ 21.141. open ΓòÉΓòÉΓòÉ

open

  1. To make an adapter ready for use.

  2. A break in an electrical circuit.

  3. To make a file ready for use.


ΓòÉΓòÉΓòÉ 21.142. Open Systems Interconnection (OSI) ΓòÉΓòÉΓòÉ

Open Systems Interconnection (OSI)

  1. The interconnection of open systems in accordance with specific ISO
     standards. (T)

  2. The use of standardized procedures to enable the interconnection of data
     processing systems.

     Note:  OSI architecture establishes a framework for coordinating the
            development of current and future standards for the interconnection
            of computer systems. Network functions are divided into seven
            layers. Each layer represents a group of related data processing
            and communication functions that can be carried out in a standard
            way to support different applications.


ΓòÉΓòÉΓòÉ 21.143. Open Systems Interconnection (OSI) architecture ΓòÉΓòÉΓòÉ

Open Systems Interconnection (OSI) architecture

Network architecture that adheres to a particular set of ISO standards that
relates to Open Systems Interconnection. (T)


ΓòÉΓòÉΓòÉ 21.144. Open Systems Interconnection (OSI) reference model ΓòÉΓòÉΓòÉ

Open Systems Interconnection (OSI) reference model

A model that represents the hierarchical arrangement of the seven layers
described by the Open Systems Interconnection architecture.


ΓòÉΓòÉΓòÉ 21.145. operating system ΓòÉΓòÉΓòÉ

operating system

Software that controls the execution of programs. An operating system may
provide services such as resource allocation, scheduling, input/output control,
and data management. (A) Examples are IBM PC DOS and IBM OS/2.


ΓòÉΓòÉΓòÉ 21.146. Operating System/2 (OS/2) ΓòÉΓòÉΓòÉ

Operating System/2 (OS/2)

A set of programs that control the operation of high-speed large-memory IBM
personal computers (such as the IBM Personal System/2 computer, Models 50 and
above), providing multitasking and the ability to address up to 16 MB of
memory. Contrast with Disk Operating System (DOS).


ΓòÉΓòÉΓòÉ 21.147. operation ΓòÉΓòÉΓòÉ

operation

  1. A defined action, namely, the act of obtaining a result from one or more
     operands in accordance with a rule that completely specifies the result
     for any permissible combination of operands. (A)

  2. A program step undertaken or executed by a computer.

  3. An action performed on one or more data items, such as adding,
     multiplying, comparing, or moving.


ΓòÉΓòÉΓòÉ 21.148. option ΓòÉΓòÉΓòÉ

option

  1. A specification in a statement, a selection from a menu, or a setting of a
     switch, that may be used to influence the execution of a program.

  2. A hardware or software function that may be selected or enabled as part of
     a configuration process.

  3. A piece of hardware (such as a network adapter) that can be installed in a
     device to modify or enhance device function.


ΓòÉΓòÉΓòÉ 21.149. page ΓòÉΓòÉΓòÉ

page

  1. The portion of a panel that is shown on a display surface at one time.

  2. To move back and forth among the pages of a multiple-page panel. See also
     scroll.

  3. In a virtual storage system, a fixed-length block that has a virtual
     address and is transferred as a unit between real storage and virtual
     storage.


ΓòÉΓòÉΓòÉ 21.150. panel ΓòÉΓòÉΓòÉ

panel

The complete set of formatted information that appears in a single display on a
visual display unit.


ΓòÉΓòÉΓòÉ 21.151. parallel port ΓòÉΓòÉΓòÉ

parallel port

A port that transmits the bits of a byte in parallel along the lines of the
bus, 1 byte at a time, to an I/O device. On a personal computer, it is used to
connect a device that uses a parallel interface, such as a dot matrix printer,
to the computer. Contrast with serial port.


ΓòÉΓòÉΓòÉ 21.152. parameter ΓòÉΓòÉΓòÉ

parameter

  1. A variable that is given a constant value for a specified application and
     that may denote the application. (I) (A)

  2. An item in a menu or for which the user specifies a value or for which the
     system provides a value when the menu is interpreted.

  3. Data passed between programs or procedures.


ΓòÉΓòÉΓòÉ 21.153. path ΓòÉΓòÉΓòÉ

path

  1. In a network, any route between any two nodes. (T)

  2. The route traversed by the information exchanged between two attaching
     devices in a network.

  3. A command in IBM Personal Computer Disk Operating System (PC DOS) and IBM
     Operating System/2 (OS/2) that specifies directories to be searched for
     commands or batch files that are not found by a search of the current
     directory.


ΓòÉΓòÉΓòÉ 21.154. personal computer (PC) ΓòÉΓòÉΓòÉ

personal computer (PC)

A desk-top, free-standing, or portable microcomputer that usually consists of a
system unit, a display, a monitor, a keyboard, one or more diskette drives,
internal fixed-disk storage, and an optional printer. PCs are designed
primarily to give independent computing power to a single user and are
inexpensively priced for purchase by individuals or small businesses. Examples
include the various models of the IBM Personal Computers, and the IBM Personal
System/2 computer.


ΓòÉΓòÉΓòÉ 21.155. phase ΓòÉΓòÉΓòÉ

phase

The relative timing (position) of periodic electrical signals.


ΓòÉΓòÉΓòÉ 21.156. pointer ΓòÉΓòÉΓòÉ

pointer

  1. An identifier that indicates the location of an item of data. (A)

  2. A data element that indicates the location of another data element. (T)

  3. A physical or symbolic identifier of a unique target.


ΓòÉΓòÉΓòÉ 21.157. port ΓòÉΓòÉΓòÉ

port

  1. An access point for data entry or exit.

  2. A connector on a device to which cables for other devices such as display
     stations and printers are attached. Synonymous with socket.


ΓòÉΓòÉΓòÉ 21.158. post ΓòÉΓòÉΓòÉ

post

  1. To affix to a usual place.

  2. To provide items such as return code at the end of a command or function.

  3. To define an appendage routine.

  4. To note the occurrence of an event.


ΓòÉΓòÉΓòÉ 21.159. Power-On Self Test (POST) ΓòÉΓòÉΓòÉ

Power-On Self Test (POST)

A series of diagnostic tests that are run automatically each time the
computer's power is turned on.


ΓòÉΓòÉΓòÉ 21.160. PROCEDURE ΓòÉΓòÉΓòÉ

PROCEDURE

A set of instructions that gives a service representative a step-by-step
procedure for tracing a symptom to the cause of failure.


ΓòÉΓòÉΓòÉ 21.161. processor ΓòÉΓòÉΓòÉ

processor

In a computer, a functional unit that interprets and executes instructions. (I)
(A)


ΓòÉΓòÉΓòÉ 21.162. protocol ΓòÉΓòÉΓòÉ

protocol

  1. A set of semantic and syntactic rules that determines the behavior of
     functional units in achieving communication. (I)

  2. In SNA, the meanings of and the sequencing rules for requests and
     responses used for managing the network, transferring data, and
     synchronizing the states of network components.

  3. A specification for the format and relative timing of information
     exchanged between communicating parties.


ΓòÉΓòÉΓòÉ 21.163. random access memory (RAM) ΓòÉΓòÉΓòÉ

random access memory (RAM)

A computer's or adapter's volatile storage area into which data may be entered
and retrieved in a nonsequential manner.


ΓòÉΓòÉΓòÉ 21.164. receive ΓòÉΓòÉΓòÉ

receive

To obtain and store information transmitted from a device.


ΓòÉΓòÉΓòÉ 21.165. Reference Diskette ΓòÉΓòÉΓòÉ

Reference Diskette

A diskette shipped with the IBM Personal System/2 computers with Micro Channel
architecture. The diskette contains code and files used for configuration of
options and for hardware diagnostic testing.


ΓòÉΓòÉΓòÉ 21.166. reference frame ΓòÉΓòÉΓòÉ

reference frame

In DatagLANce Protocol Analysis, the frame whose frame number is used in
calculating the relative frame number of all other frames. The reference frame
is always frame 0.


ΓòÉΓòÉΓòÉ 21.167. relative time ΓòÉΓòÉΓòÉ

relative time

In DatagLANce Protocol Analysis, the difference in time between the arrival
(absolute) time-stamps of a frame and the marked frame. Relative time is
displayed in the frame summary. See marked frame, absolute time.


ΓòÉΓòÉΓòÉ 21.168. remote program load ΓòÉΓòÉΓòÉ

remote program load

A function provided by adapter hardware components and software that enables
one computer to load programs and operating systems into the memory of another
computer, without requiring the use of a diskette or fixed disk at the
receiving computer.


ΓòÉΓòÉΓòÉ 21.169. remove ΓòÉΓòÉΓòÉ

remove

  1. To take an attaching device off a network.

  2. To stop an adapter from participating in data passing on a network.


ΓòÉΓòÉΓòÉ 21.170. ring network ΓòÉΓòÉΓòÉ

ring network

A network configuration in which a series of attaching devices is connected by
unidirectional transmission links to form a closed path. A ring of an IBM
Token-Ring Network is referred to as a LAN segment or as a Token-Ring Network
segment.


ΓòÉΓòÉΓòÉ 21.171. ring segment ΓòÉΓòÉΓòÉ

ring segment

A ring segment is any section of a ring that can be isolated (by unplugging
connectors) from the rest of the ring. A segment can consist of a single lobe,
the cable between access units, or a combination of cables, lobes, and/or
access units. See cable segment, LAN segment.


ΓòÉΓòÉΓòÉ 21.172. ring station ΓòÉΓòÉΓòÉ

ring station

A station that supports the functions necessary for connecting to the LAN and
for operating with the token-ring protocols. These include token handling,
transferring copied frames from the ring to the using node's storage,
maintaining error counters, observing medium access control (MAC) sublayer
protocols (for address acquisition, error reporting, or other duties), and (in
the full-function native mode) directing frames to the correct data link
control (DLC) link station.


ΓòÉΓòÉΓòÉ 21.173. router ΓòÉΓòÉΓòÉ

router

An attaching device that connects two LAN segments, which use similar or
different architectures, at the reference model network layer. Contrast with
bridge and gateway.


ΓòÉΓòÉΓòÉ 21.174. routing ΓòÉΓòÉΓòÉ

routing

  1. The assignment of the path by which a  message will reach its destination.

  2. The forwarding of a message unit along a particular path through a
     network, as determined by the parameters carried in the message unit, such
     as the destination network address in a transmission header.


ΓòÉΓòÉΓòÉ 21.175. runt frame ΓòÉΓòÉΓòÉ

runt frame

An Ethernet frame that violates the 64-byte minimum specification.


ΓòÉΓòÉΓòÉ 21.176. scroll ΓòÉΓòÉΓòÉ

scroll

To move all or part of the display image vertically or horizontally to display
data that cannot be observed within a single display image. See also page (2).


ΓòÉΓòÉΓòÉ 21.177. segment ΓòÉΓòÉΓòÉ

segment

See cable segment, LAN segment, ring segment.


ΓòÉΓòÉΓòÉ 21.178. serial port ΓòÉΓòÉΓòÉ

serial port

On personal computers, a port used to attach devices such as display devices,
letter-quality printers, modems, plotters, and pointing devices such as light
pens and mice; it transmits data 1 bit at a time. Contrast with parallel port.


ΓòÉΓòÉΓòÉ 21.179. server ΓòÉΓòÉΓòÉ

server

  1. A device, program, or code module on a network dedicated to providing a
     specific service to a network.

  2. On a LAN, a data station that provides facilities to other data stations.
     Examples are a file server, print server, and mail server.


ΓòÉΓòÉΓòÉ 21.180. service access point (SAP) ΓòÉΓòÉΓòÉ

service access point (SAP)

  1. A logical point made available by an adapter where information can be
     received and transmitted. A single SAP can have many links terminating in
     it.

  2. In Open Systems Interconnection (OSI) architecture, the logical point at
     which an n + 1-layer entity acquires the services of the n-layer. For
     LANs, the n-layer is assumed to be data link control (DLC). A single SAP
     can have many links terminating in it. These link "end-points" are
     represented in DLC by link stations.


ΓòÉΓòÉΓòÉ 21.181. session ΓòÉΓòÉΓòÉ

session

  1. A connection between two application programs that allows them to
     communicate.

  2. In SNA, a logical connection between two network addressable units that
     can be activated, tailored to provide various protocols, and deactivated
     as requested.

  3. The data transport connection resulting from a call or link between two
     devices.

  4. The period of time during which a user of a node can communicate with an
     interactive system, usually the elapsed time between log on and log off.

  5. In network architecture, an association of facilities necessary for
     establishing, maintaining, and releasing connections for communication
     between stations. (T)


ΓòÉΓòÉΓòÉ 21.182. signal ΓòÉΓòÉΓòÉ

signal

  1. A time-dependent value attached to a physical phenomenon for conveying
     data.

  2. A variation of a physical quantity, used to convey data.


ΓòÉΓòÉΓòÉ 21.183. single-route broadcast ΓòÉΓòÉΓòÉ

single-route broadcast

The forwarding of specially designated broadcast frames only by bridges which
have single-route broadcast enabled. If the network is configured correctly, a
single-route broadcast frame will have exactly one copy delivered to every LAN
segment in the network. Synonymous with limited broadcast. See also automatic
single-route broadcast.


ΓòÉΓòÉΓòÉ 21.184. socket ΓòÉΓòÉΓòÉ

socket

Synonym for port (2).


ΓòÉΓòÉΓòÉ 21.185. soft error ΓòÉΓòÉΓòÉ

soft error

An intermittent error on a network that causes data to have to be transmitted
more than once to be received. A soft error affects the network's performance
but does not, by itself, affect the network's overall reliability. If the
number of soft errors becomes excessive, reliability is affected. Contrast with
hard error.


ΓòÉΓòÉΓòÉ 21.186. source address ΓòÉΓòÉΓòÉ

source address

A field in the medium access control (MAC) frame that identifies the location
from which information is sent. Contrast with destination address.


ΓòÉΓòÉΓòÉ 21.187. source service access point (SSAP) ΓòÉΓòÉΓòÉ

source service access point (SSAP)

The service access point (SAP) from which a logical link control protocol data
unit (LPDU) is originated.


ΓòÉΓòÉΓòÉ 21.188. splitter ΓòÉΓòÉΓòÉ

splitter

A passive device used at a node to connect two or more branches. The device is
coupled inline to a main trunk or branch for splitting the power and
information signal two or more ways. A splitter does not amplify or regenerate
data signals.


ΓòÉΓòÉΓòÉ 21.189. start delimiter ΓòÉΓòÉΓòÉ

start delimiter

The first byte of a token or frame, consisting of a special, recognizable bit
pattern.


ΓòÉΓòÉΓòÉ 21.190. station ΓòÉΓòÉΓòÉ

station

  1. A communication device attached to a network. The term used most often in
     LANs is an attaching device or workstation.

  2. An input or output point of a system that uses telecommunication
     facilities; for example, one or more systems, computers, terminals,
     devices, and associated programs at a particular location that can send or
     receive data over a telecommunication line. See also attaching device,
     workstation.


ΓòÉΓòÉΓòÉ 21.191. switch ΓòÉΓòÉΓòÉ

switch

On an adapter, a mechanism used to select a value for, enable, or disable a
configurable option or function.


ΓòÉΓòÉΓòÉ 21.192. symbolic name ΓòÉΓòÉΓòÉ

symbolic name

In a LAN, a name that may be used instead of an adapter or bridge address to
identify an adapter location.


ΓòÉΓòÉΓòÉ 21.193. system ΓòÉΓòÉΓòÉ

system

In data processing, a collection of people, machines, and methods organized to
accomplish a set of specific functions. (I) (A)


ΓòÉΓòÉΓòÉ 21.194. system configuration ΓòÉΓòÉΓòÉ

system configuration

A process that specifies the devices and programs that form a particular data
processing system.


ΓòÉΓòÉΓòÉ 21.195. system disk(ette) ΓòÉΓòÉΓòÉ

system disk(ette)

A personal computer fixed disk or diskette that has been formatted with the
Personal Computer Disk Operating System (PC DOS) or Operating System/2 (OS/2)
by using the FORMAT command with the /S option.


ΓòÉΓòÉΓòÉ 21.196. Systems Application Architecture (SAA) ΓòÉΓòÉΓòÉ

Systems Application Architecture (SAA)

An architecture developed by IBM that consists of a set of selected software
interfaces, conventions, and protocols, and that serves as a common framework
for application development, portability, and use across different IBM hardware
systems.


ΓòÉΓòÉΓòÉ 21.197. Systems Network Architecture (SNA) ΓòÉΓòÉΓòÉ

Systems Network Architecture (SNA)

The description of the logical structure, formats, protocols, and operational
sequences for transmitting information units through, and controlling the
configuration and operation of, networks.

Note:  The layered structure of SNA allows the ultimate origins and
       destinations of information, that is, the end users, to be independent
       of and unaffected by the specific SNA network services and facilities
       used for information exchange.


ΓòÉΓòÉΓòÉ 21.198. threshold ΓòÉΓòÉΓòÉ

threshold

  1. A level, point, or value above which something is true or will take place
     and below which it is not true or will not take place.

  2. In IBM bridge programs, a value set for the maximum number of frames that
     are not forwarded across a bridge due to errors, before a "threshold
     exceeded" occurrence is counted and indicated to network management
     programs.

  3. An initial value from which a counter is decremented to zero, or a value
     to which a counter is incremented or decremented from an initial value.
     When the counter reaches zero or the threshold value, a decision is made
     and/or an event occurs.


ΓòÉΓòÉΓòÉ 21.199. throughput ΓòÉΓòÉΓòÉ

throughput

  1. A measure of the amount of work performed by a computer system over a
     given period of time, for example, number of jobs per day. (I) (A)

  2. A measure of the amount of information transmitted over a network in a
     given period of time. For example, a network's data transfer rate is
     usually measured in bits per second.


ΓòÉΓòÉΓòÉ 21.200. token ΓòÉΓòÉΓòÉ

token

A sequence of bits passed from one device to another on the token-ring network
that signifies permission to transmit over the network. It consists of a
starting delimiter, an access control field, and an end delimiter. The access
control field contains a bit that indicates to a receiving device that the
token is ready to accept information. If a device has data to send along the
network, it appends the data to the token. When data is appended, the token
then becomes a frame. See frame.


ΓòÉΓòÉΓòÉ 21.201. token-ring ΓòÉΓòÉΓòÉ

token-ring

A network with a ring topology that passes tokens from one attaching device
(node) to another. A node that is ready to send can capture a token and insert
data for transmission.


ΓòÉΓòÉΓòÉ 21.202. token-ring network ΓòÉΓòÉΓòÉ

token-ring network

  1. A ring network that allows unidirectional data transmission between data
     stations by a token-passing procedure over one transmission medium so that
     the transmitted data returns to and is removed by the transmitting
     station. (T) The IBM Token-Ring Network is a baseband LAN with a
     star-wired ring topology that passes tokens from network adapter to
     network adapter.

  2. A network that uses a ring topology, in which tokens are passed in a
     sequence from node to node. A node that is ready to send can capture the
     token and insert data for transmission.

  3. A group of interconnected token-rings.


ΓòÉΓòÉΓòÉ 21.203. trace ΓòÉΓòÉΓòÉ

trace

  1. A record of the execution of a computer program. It exhibits the sequences
     in which the instructions were executed.

  2. A record of the frames and bytes transmitted on a network.


ΓòÉΓòÉΓòÉ 21.204. transmit ΓòÉΓòÉΓòÉ

transmit

To send information from one place for reception elsewhere.


ΓòÉΓòÉΓòÉ 21.205. transmitter ΓòÉΓòÉΓòÉ

transmitter

  1. A circuit used in data communication applications to send information from
     one place for reception elsewhere.

  2. The device in which the transmission circuits are housed.


ΓòÉΓòÉΓòÉ 21.206. trigger frame ΓòÉΓòÉΓòÉ

trigger frame

The frame which triggered the capture. This frame matched the trigger equation
specified on the Trigger/Stop Capture Options panel.


ΓòÉΓòÉΓòÉ 21.207. twisted pair ΓòÉΓòÉΓòÉ

twisted pair

A transmission medium that consists of two insulated conductors twisted
together to reduce noise. (T)


ΓòÉΓòÉΓòÉ 21.208. universally administered address ΓòÉΓòÉΓòÉ

universally administered address

The address permanently encoded in an adapter at the time of manufacture. All
universally administered addresses are unique. Contrast with locally
administered address.


ΓòÉΓòÉΓòÉ 21.209. unnumbered acknowledgment ΓòÉΓòÉΓòÉ

unnumbered acknowledgment

A data link control (DLC) command used in establishing a link and in answering
receipt of logical link control (LLC) frames.


ΓòÉΓòÉΓòÉ 21.210. upstream ΓòÉΓòÉΓòÉ

upstream

On an IBM Token-Ring Network, the direction opposite that of data flow.
Contrast with downstream.


ΓòÉΓòÉΓòÉ 21.211. variable ΓòÉΓòÉΓòÉ

variable

  1. In computer programming, a character or group of characters that refers to
     a value and, in the execution of a computer program, corresponds to an
     address.

  2. A quantity that can assume any of a given set of values. (A)


ΓòÉΓòÉΓòÉ 21.212. version ΓòÉΓòÉΓòÉ

version

A separate IBM-licensed program, based on an existing IBM-licensed program,
that usually has significant new code or new function.


ΓòÉΓòÉΓòÉ 21.213. wire fault ΓòÉΓòÉΓòÉ

wire fault

An error condition caused by a break in the wires or a short between the wires
(or shield) in a segment of cable.


ΓòÉΓòÉΓòÉ 21.214. work area ΓòÉΓòÉΓòÉ

work area

An area in which terminal devices (such as displays, keyboards, and printers)
are located.  Access units may also be located in work areas.


ΓòÉΓòÉΓòÉ 21.215. workstation ΓòÉΓòÉΓòÉ

workstation

  1. An I/O device that allows either transmission of data or the reception of
     data (or both) from a host system, as needed to perform a job:  for
     example, a display station or printer.

  2. A configuration of I/O equipment at which an operator works. (T)

  3. A terminal or microcomputer, usually one connected to a mainframe or
     network, at which a user can perform tasks.


ΓòÉΓòÉΓòÉ 22. Bibliography ΓòÉΓòÉΓòÉ


ΓòÉΓòÉΓòÉ 22.1. Related Publications ΓòÉΓòÉΓòÉ

Consult the following publications for additional information about the IBM
Token-Ring and IBM Local Area Networks. To obtain these publications, contact
your IBM representative or your local IBM branch office.

 o IBM Token-Ring Network Architecture Reference, SC30-3374

 o IBM Local Area Network Technical Reference IEEE 802.2 and NETBIOS APIs,
   SC30-3587

 o IBM Token-Ring Network Remote Program Load User's Guide, SK2T-0333

 o IBM Systems Network Architecture Formats, GA27-3136

 o TCP/IP Tutorial and Technical Overview, GG24-3376

 o Netware from IBM: Network Protocols and Standards, GG24-3890

 o Multiprotocol Transport Networking (MPTN) Architecture: Formats, GC31-7074

 o Systems Network Architecture Technical Overview, GC30-3073

 o Systems Network Architecture Formats, GA27-3136

 o Systems Network Architecture Network Product Formats, LY43-0081

 o Systems Network Architecture Advanced Peer-To-Peer Networking, Architecture
   Reference, SC30-3422

 In addition to the publications listed above, the following publications are
 available to support the product:

 o Token-Ring Troubleshooting Handbook, Dan Nassar

 o Logical Link Control, ISO 8802-2, ANSI/IEEE Std. 802.2. 1989

   This specification is available for purchase from: Institute of Electrical
   and Electronics Engineers
   Piscataway, NJ

 o DDN Protocol Handbook
   Volume 1: DOD Military Standard Protocols, NIC-5004
   Volume 2: DARPA Internet Protocols, NIC-5005
   Volume 3: Supplement, NIC-5006

   These publications are available for purchase from:

    DDN Network Information Center
    SRI International
    Menlo Park, CA

 These publications are also available for purchase from:

    Defense Technical Information Center

    Cameron Station

    Alexandria, VA  22314

 o Internetworking with TCP/IP: Principles, Protocols, and Architecture Volumes
   I and II., Douglas E. Comer

   This publication is available for purchase from:

    Prentice-Hall, Inc.
    Englewood Cliffs, NJ

 o LAN Troubleshooting Handbook, Mark A. Miller, P.E.

 o LAN Protocol Handbook, Mark A. Miller, P.E.

 o Internetworking: A Guide to Network Communications. LAN to LAN; LAN to WAN,
   Mark A. Miller, P.E.

 o Troubleshooting Internetworks, Mark A. Miller, P.E.

 o Troubleshooting TCP/IP: Analyzing the Protocols of the Internet, Mark A.
   Miller, P.E.

   These publications are available for purchase from:

    M&T Books
    Redwood City, CA

 o Inside AppleTalk, Second Edition, Gursharan S. Sidhu, Richard F. Andrews,
   Alan B. Oppenheimer

   This publication is available for purchase from:

    Apple Computer, Inc.
    Cupertino, CA

 o Analyzing Novell Networks, Carl Malamud

 o Analyzing DECnet/OSI Phase V, Carl Malamud

   These publications are available for purchase from:

    Van Nostrand Reinhold
    New York, NY

 o NetWare System Interface Technical Overview, Novell, Inc.

   This publication is available for purchase from:

    Addison Wesley Publishing Company, Inc.

    Menlo Park, CA

 o Novell's Guide to NetWare LAN Analysis, Laura Chappell

   This publication is available for purchase from:

    Novell Press

    San Jose, CA

 o Xerox Network Systems Architecture, General Information Manual, XNSG 068504,
   Xerox Corporation

 o Internet Transport Protocols, XNSS 029101, Xerox Corporation

   These publications are available for purchase from:

    Xerox Corporation
    Sunnyvale, CA

 o DECnet Digital Network Architecture (Phase IV) General Description, Order
   No. AA-N149A-TC

 o DECnet Data Access Protocol Functional Specification, Order No. AA-K177A-TK

 o DECnet Phase IV Network Management Functional Specification, Order No.
   AA-X437A-TK

 o DECnet Phase IV Maintenance Operations Functional Specification, Order No.
   AA-X436A-TK

 o DECnet Phase IV Routing Layer Functional Specification, Order No.
   AA-X435A-TK

 o DECnet Phase IV NSP Functional Specification, Order No. AA-X439A-TK

 o DECnet Session Control Functional Specification, Order No. AA-K182A-TK

   These publications are available for purchase from:

    Digital Equipment Corporation

    Phone 1-800-DIGITAL

 o Vines Architecture Definition

 o Vines Protocol Definition

   These publications are available for purchase from:

    Banyan Systems, Inc.

    Boston, MA

 In addition, the following Journal Articles and Documents are available to
 support the product:

 o IBM PC Network SMB Protocol, IBM Personal Computer Seminar Proceedings,
   Volume 2, Number 8-1, May 1985

 o SMB File Sharing Protocol, Intel Part Number 138446, Document Version 2.0,
   Microsoft Corporation, November 7, 1988

 o SMB File Sharing Protocol Extensions Version 2.0, Document Version 3.3,
   Microsoft Corporation, November 7, 1988

 o SMB File Sharing Protocol Extensions Version 3.0, Document Version 1.11,
   Microsoft Corporation, June 19, 1990

 o A Digital Network Architecture Overview, Anthony G. Lauck, David R. Oran,
   Radia J. Perlman, Digital Technical Journal, No. 3, September 1986

 o Terminal Servers on Ethernet Local Area Networks, Bruce E. Mann, Colin
   Strutt, Mark F. Kempf, Digital Technical Journal, No. 3, September 1986

 o An Introduction to Novell's Burst Mode Protocol, NetWare Application Notes,
   March 1992