How do I...

LinkFerret Network Monitor Tutorials

LinkFerret is a versatile, easy to use, low cost, high performance network monitor; a sleek new version of the analyzer used by Baseband, NDIS driver specialists, for rigorous driver conformance testing. This ground-breaking monitor combines added features, a clean consistent interface, in-depth help file and top-notch support to provide an elegantly simple, yet power-packed tool geared for the Network Administrator, network/protocol developer and the security-minded individual.

LinkFerret can perform many tasks. Some are conceptually simple but others may be dauntingly complex. Use these tutorials as a guide when configuring and using LinkFerret for the first time, or as a refresher when performing infrequent operations. Each tutorial was designed to be a step by step plain English guide into the heart of LinkFerret's feature-rich interface.

LinkFerret and LinkFerret Network Monitor are Trademarks of Baseband Technologies.


Choose Capture > Select Device...

Next

To capture from the screen requires a few steps. First, you have to tell LinkFerret which network card to use for monitoring:
select Capture pop-up menu
select Select Device... from the pop-up menu
The notation, Capture > Select Device... means go to pop-up window Capture and choose Select Device... from the pop-up window.

The selected NIC, network interface card, is put in promiscuous mode. Promiscuous mode means that the NIC receives all frames put on the line.


Choose Capture > Select Device...

Next

To capture to a file requires a few steps. First, you have to tell LinkFerret which network card to use for monitoring:
select Capture pop-up menu
select Select Device... from the pop-up menu
The notation, Capture > Select Device... means go to the pop-up window Capture and choose Select Device... from the pop-up window.

Determine which NIC, network interface card, to use for monitoring the network. The selected NIC is put in promiscuous mode. Promiscuous mode means that the NIC receives all frames put on the line.


Select File > Save...

Next

To save a file, first execute the following:
select File pop-up menu
select Save... from the pop-up menu
The notation, File > Save... means go to the pop-up window File and choose Save... from the pop-up window.


Select File > Open...

Next

To open a capture file first select File > Open.... The notation, File > Open... means
select File pop-up menu
select Open... from the pop-up menu


Print Statistics Window

Next

To print the statistics window, you have two choices:
If the window is open, then hover the mouse over the window, right click the mouse and select print from the pop-up window
Whether the window is opened or closed, you can always select the Statistics pop-up menu and then choose print.
The printed statistics is always the currently selected statistics. When LinkFerret begins executing, Traffic Profile is the default in the statistics window.


Choose Name Space > Edit...

Next

It is much easier to read the brief window if a name, not a hexadecimal address, is displayed. Let's associate a name with a hex address and see the difference. To access the name space table select:
Name Space an entry on the menu bar
Edit... from the pop-up menu
The notation, Name Space > Edit..., is short-hand for the above two actions where the first item is an entry on the menu bar and the second item is an entry on the pop-up window.


LinkFerret's brief decode window

Next
You have read in a captured file and you notice the following:
No IP addresses in the destination address column.
No IP addresses in the source address column.
There are 184 frames in the file.
Only 10 frames are displayed in the brief window.
Although 10 frames out of 184 frames is a small sample, you suspect that the brief decode window is checking for MAC addresses, not IP addresses. To change the brief decode format, you have selected the entry on the menu bar, Preferences (see [image]). Preferences provides a pop-up window containing one entry, Preferences (see [image]). The shorthand for selecting a menu bar entry and an entry from its associated pop-up window is Preferences > Preferences. To select the tab, Brief Display, in the dialog box invoked by Preferences > Preferences, the shorthand is Preferences > Preferences > Brief Display.


Choose Filter > Manage Link Filter...

Next

You have read in a captured file. You have 184 frames (see [image]) as noted on the frame count field of the status bar. To narrow down your search, you want to filter out uninteresting frames. Let's assume that you are not interested in frames sent by HACK1 and WODEN.

To create a filter select:
Filters which is an entry on the menu bar
Manage Link Filters... from the pop-up menu
The notation, Filters > Manage Link Filters..., is short-hand for the above two actions where the first item is an entry on the menu bar and the second item is an entry on the pop-up window.


Choose Filter > Manage Link Filter...

Next
You have read in a captured file. You have 184 frames (see [image]) as noted on the frame count field of the status bar. To narrow down your search, you want to filter out uninteresting frames. Let's build on the filter created in the tutorial, "Create and install a filter". We are going to display frames not sent by HACK1, not sent by WODEN and contain the protocol, RFC NetBios.

To edit a filter select:
Filters which is an entry on the menu bar
Manage Link Filters... from the pop-up menu
The notation, Filters > Manage Link Filters..., is short-hand for the above two actions where the first item is an entry on the menu bar and the second item is an entry on the pop-up window.


Choose Filter > Manage Link Filter...

Next
You have read in a captured file. You have 184 frames (see [image]) as noted on the frame count field of the status bar. To narrow down your search, you want to filter out uninteresting frames. Let's build on the filter created in the tutorial, "Create Filter Protocol Test for a Filter Statement". We are going to display frames not sent by HACK1, not sent by WODEN, contains the protocol RFC NetBios and is a NetBios Datagram Service.

To edit a filter select:
Filters which is an entry on the menu bar
Manage Link Filters... from the pop-up menu
The notation, Filters > Manage Link Filters..., is short-hand for the above two actions where the first item is an entry on the menu bar and the second item is an entry on the pop-up window.


LinkFerret Brief Decode Window with IP Addresses

Next
If you do not see any IP addresses in your brief window, you might have to modify your brief display (see Modify Brief Window Display). In this case IP addresses are displayed in your brief window (see [image]).

You notice that one IP address on the network that does not have a name associated with it. Let's see how often this IP address is displayed. You are going to create a filter that has 2 include statements and each statement will have 1 IP test. One statement will include all frames with a destination IP address equal to 128.35.96.84. The other statement will include all frames with a source IP address equal to 128.35.96.84.

To create an IP filter go to Filters (see [image]), an entry on the menu bar, and choose Manage Link Filters... (see [image]) from the pop-up window. The notation, Filters > Manage Link Filters..., is short-hand for the above two actions where the first item is an entry on the menu bar and the second item is an entry on the pop-up window.

Why don't you put both tests in one statement?
Because the tests are ANDed. A statement with 2 tests would read, "If the frame contains the IP address as a source address AND the frame contains the IP address as a destination address, then the frame is included". A frame should not contain the same IP address for source and destination, therefor no frames would be captured. Statements are ORed. If two statements each contain one test then it is interpreted:
If the frame contains the IP address as a source address or as a destination address, the frame is included.
The two statement version is the one you want.


Edit a Filter Using the Mouse

Next

To edit the filter using the mouse, remember right click and then left click:
Right-click on the filter name, remove broadcast, which generates a context menu.
Left-click on an option in the context menu.


Rules for Efficient Filters

Next

To avoid frame loss, keep the following rules in mind:
  • less filter statements are better
  • less filter tests are better
  • exclude filter statements should precede include filter statements


Host Color Coding

Name Space > Host Color Coding...

Next

It is easy to color code entries in the brief window based on the destination/source MAC address.

Method 1 - Use Icons
Select the icon Modify display colors on the toolbar, which generates a context menu.
Select Host color coding from the context menu.

Method 2 - Use Menu Bar
Select Name Space on the menu bar which generates a pop-up menu.
Select Host Color Coding... from the pop-up menu.

The notation Name Space > Host Color Coding... is short-hand for the second method. The first item is an entry on the menu bar and the second item is an entry on the pop-up window.


Filters > Protocol Color Coding...

Next

It is easy to color code entries in the brief window based on the protocol.

Method 1 - Use Icons
Select the icon Modify display colors on the toolbar, which generates a context menu.
Select Protocol color coding from the context menu.

Method 2 - Use Menu Bar
Select Filters on the menu bar which generates a pop-up menu.
Select Protocol Color Coding... from the pop-up menu.

The notation Filters > Protocol Color Coding... is short-hand for the second method. The first item is an entry on the menu bar and the second item is an entry on the pop-up window.


Alarms > Manage Alarm Scripts...

Next

You want to create an alarm that causes the screen to flash when a frame is sent by the NIC named HACK1. First, you have to manage the alarm scripts.
Select Alarms on the menu bar which generates a pop-up menu.
Select Manage Alarm Scripts... from the pop-up menu.

The short-hand for the above method is Alarms > Manage Alarm Scripts.... The first item is an entry on the menu bar and the second item is an entry on the pop-up window.


Edit Alarm Scripts Using the Mouse

Next

To edit the alarm script using the mouse, just double-click on the script name. You can also use the right click and then left click method:
Right-click on the alarm script name, flashit, which generates a context menu.
Left-click on an option in the context menu.


Manage Alarm Scripts Dialog Box

Back Next
You know that no alarm scripts have been created, because there is no plus sign next to the entry, LinkFerret Scripts. The plus sign indicates that there are more details. If LinkFerret Scripts had a plus sign next to it and you selected the plus sign, the plus sign would change to a minus sign and all the script names would be displayed.

To create an alarm script:
Select LinkFerret Scripts. You can never modify or delete this entry.
Select the icon Create an Alarm Script.
If you hover the mouse over each icon, a hint pops up.


LinkFerret Alarm Scripts Dialog Box

To create the alarm script:
Type the name of the new script. In this case the name is Flash It.
Choose the kind of alarm in Select Action, i.e., Flash screen.
Select Test button. Now you should see the LinkFerret Network Monitor dialog box flash.
Finally, select OK.
That's it, you have created an alarm that flashes the screen.


Manage Alarm Scripts Dialog Box

Based on this dialog box:
You have scripts. Notice the plus sign next to LinkFerret Scripts. To expand the entries in LinkFerret Scripts select the plus sign. Now a minus sign appears next to LinkFerret Scripts.
You have created one script, Flash It.
Select OK.


Manage Alarm Triggers Dialog Box

In the LinkFerret Network Monitor select Alarms > Manage Alarm Triggers..., which invokes the dialog box, Manage Alarm Triggers. This dialog box ties everything together. In this case you have a filter, only HACK1, which only includes frames sent by HACK1. To make the screen flash when HACK1 sends frames:
Select the drop-down to get the list of existing filters.
Select only HACK1 from the list of filters.
From the Alarm Action column, select the drop-down in the row associated with filters.
From the drop-down, select the alarm script Flash It.
Turn on the alarm.
Select OK.


LinkFerret Network Monitor Dialog Box

Back

In the LinkFerret Network Monitor:
LinkFerret is in capture mode.
LinkFerret has received frames from HACK1.
The screen has flashed and LinkFerret displays the alarm script for the next few seconds.
After receiving the first alarm trigger, LinkFerret's alarm system goes inactive for the next few seconds to avoid creating too many alarms.


Manage Link Filters Dialog Box

To create a new filter
Right-click on LinkFerret Filters which invokes a context menu. You can never modify or delete the root entry LinkFerret Filters.
Left-click on the context menu entry, Create filter. This entry invokes the dialog box, Create a Link Filter.


Create a Link Filter Dialog Box

Create the filter name, get ip address (see [image]), and then select OK (see [image]).


Link Ferret Network Monitor Dialog Box

In Manage Link Filters dialog box there is a filter named get ip address (see [image]). LinkFerret automatically asks you about creating a statement. Select Yes to create the statement (see [image]).


Filter Statement Dialog Box

The statement value determines what to do with a frame if it passes all the tests. In this case you want to include all frames that pass the tests, so execute the following:
For Action select Include in capture.
Select OK.


Link Ferret Network Monitor Dialog Box

In Manage Link Filters dialog box the filter get ip address's Statement 0 is an include statement (see [image]). LinkFerret automatically asks you about creating a test. Select Yes to create the test (see [image]).


Select Test from Context Menu

From the context menu select Create IP Address-based test.


Filter IP Address Test Dialog Box

You want to include all frames that have a source IP address equal to 128.35.96.84. Execute the following:
Provide the IP address as a decimal value.
Set Address Option to Source Address.
Set Test Type to Equal.
When done, select OK.


Manage Link Filters Dialog Box

To create a new statement:
Right-click on the filter get ip address which generates the context menu.
Left-click on Create statement in the context menu.


Link Ferret Network Monitor Dialog Box

In Manage Link Filters dialog box there are two include statements (see [image]) for the filter named get ip address. Statement 0 contains at least one test, because there is a plus sign (see [image]) next to it. The plus sign means there are more details. Because you just created Statement 1, LinkFerret automatically asks you about creating a test for the statement. Select Yes to create the test (see [image]).


Filter IP Address Test Dialog Box

In the dialog box:
Set Address Option to Destination Address.
Set IP Address.
Test Type is Equal.
You are done, so select OK.


Save Link Filter

In the dialog box Manage Link Filters you will notice that the filter, get ip address, includes the following:
There are two include statements, Statement0 and Statement1. If a frame passes all the tests in either statement, the frame is included.
Each statement includes one test. For Statement0 all frames whose source ip address is 128.35.96.84, are included. For Statement1 all frames whose destination ip address is 128.35.96.84 are included.

You have created a new filter, get ip address. get ip address filters out any frames whose destination ip address or source ip address is not equal to 128.35.96.84. Select OK (see [image]) to save the new filter.


Install Link Filter

In the LinkFerret Network Monitor dialog box install the filter, get ip address, by executing the following steps:
Select the pull-down menu for filters in the status bar.
Select the filter, get ip address.

You are almost done. Use View > Refresh to refresh the display.


Result of Installing Link Filter

Back
Let's check out the LinkFerret Network Monitor dialog box.
1. The filter get ip address is installed (see [image]).
2. The filter worked because:
a. | Frames have been filtered out. There are only 4 frames in the brief window (see [image] ), yet LinkFerret reviewed 184 frames (see [image] ).
b. | Each displayed frame either has a destination address equal to 128.35.96.84 (see [image] ), or a source address equal to 128.35.96.84 (see [image] ).


Manage Link Filters Dialog Box

First expand the information in the dialog box, Manage Link Filters invoked by Filter > Manage Link Filter...:
To expand LinkFerret Filters just click on the plus sign next to the entry. You now see the list of created filters. In this case there is only 1 filter, named filter out common NICs.
To expand filter out common NICs just click on the plus sign next to the entry. You now see the list of statements.
To expand the statement, just click on the plus sign next to the statement. In this case you see that there are 2 MAC tests.
To expand an item, click on the plus sign. The plus sign changes to a minus sign and the details are displayed. To delete the details, click on the minus sign. The entry collapses and the plus sign is displayed.

You want to add a protocol test so do the following:
1. | Right-click on the statement(see [image] ). A context menu appears permitting you to add a test, edit the statement or delete the statement.
2. | Left-click on creating a protocol test (see [image] ) in the context menu.


Filter Protocol Test Dialog Box

The protocol test is the simplest test to create:
Select Protocol present in Filter on Condition. You decided that the test is true when the protocol exists in the frame.
Select RFC NetBios from the drop-down menu, Protocol Filters. You have selected your protocol.
Select OK because you are done creating the test.
In this dialog box the test is true if the frame contains the protocol, RFC NetBios.


Manage Link Filters dialog box after adding protocol test

It is pretty easy to read the added test, Test 2. PROT means it is a protocol test. The rest just states that if the protocol, RFC NetBios, is in the frame, then the test is true. Select OK to save your changes to the filter.


LinkFerret Brief Window after installing filter

Back
You installed the filter using the drop-down filter selection on the status bar (see [image]). You refreshed the brief window executing View > Refresh. You notice the following:
The name of the installed filter is filter out common NIC
LinkFerret reviewed 184 frames.
LinkFerret found only 3 frames whose source address is not HACK1, whose source address is not WODEN and includes the protocol RFC NetBios.


Manage Link Filters Dialog Box

To create a value-based test in Manage Link Filters invoked by Filter > Manage Link Filter...:
Expand LinkFerret Filters by clicking on the plus sign next to the entry. You now see the list of created filters. In this case there is only 1 filter, named filter out common NICs. Again, click on the plus sign next to the filter to expand it. Now you see that the filter has one statement. Expand the statement to see the tests.
Right-click on the statement. A context menu appears permitting you to add a test, edit the statement or delete the statement.
Left-click on creating a value-based test in the context menu.
To expand an item, click on the plus sign. The plus sign changes to a minus sign and the details are displayed. To delete the details, click on the minus sign. The entry collapses and the plus sign is displayed.


Filter Value Test Dialog Box

The Filter Value Test is the most powerful test, and the most difficult to create correctly. Follow the steps carefully and always read the titles next to the entries to determine whether the value is decimal or hexadecimal. Finally, remember what this test is doing. We only want NetBios Datagram Service frames. We are going to check the 2 bytes in location 36 and 37. These two bytes must have the hexadecimal value, 008a:
Select the location in the frame to begin filtering. The first byte of the frame, the high order byte of the destination MAC address, is numbered 0. The Offset is the decimal value, 36.
Select the Modifier. The modifier affects the title for [image]. The modifier can be one of three basic groups:
1. | mask(hex)
2. | shift count(decimal)
3. | add/subtract(hex)
For our example the modifier is AND.
Enter the value for the modifier. The value may be no greater than 8 bytes. In this case the modifier is FFFF; therefor the result = data in location 36 AND FFFF.
The Test value may not be greater that 8 bytes. The length of the Test value determines the length of [image]:
1. | If Test value has fewer digits than the value in [image] , then the value in [image] is truncated.
2. | If Test value has more digits than the value in [image] , then the value in [image] is padded.
3. | It is best if the Test value and the value in [image] have the same number of digits. Check Manage Link Filters dialog box after creating your test. Make sure that LinkFerret padded/truncated the fields as you intended.
For our example the Test value is 008A.
Select the Test Type. In most cases the result is compared to the Test value using Test Type. The exceptions include:
1. | If Test Type is AND, then the result is ANDed with Test value. If the final answer is non-zero, then the frame value is true.
2. | If Test Type is NOT, then the result is ANDed with Test value. If the final answer is zero, then the frame value is true.
In this case the Test Type is equal.
Let's check how LinkFerret interpreted this test.


Manage Link Filters dialog box after creating value test

Notice your new test (see [image]) in Manage Link Filters. It looks a lot like C code. If you can program in C, then creating the value test is not difficult. Save your changes (see [image]) and let's try out your new filter.


Install Link Filter

To install the filter select:
Filter drop-down window on the status bar.
filter out common NICs from the drop-down menu.

To refresh the window, select:
View, an entry from the menu bar.
Refresh from the pop-up menu.


LinkFerret Windows after Installing the Filter

Back
So you installed a filter and refreshed the window. Let's check out the windows in LinkFerret:
The brief decode window is visible. Notice the grey around the icon indicating that it has been selected.
The detail decode window is visible. Notice the grey around the icon indicating that it has been selected.
The filter's name, filter out common NIC is shown in the filter drop-down window located on the status bar.
Only 2 frames are displayed in the brief window, but there are 184 frames (see [image]) in the file. The filter has worked and removed 182 frames from the display.
Both frames contain the Browser protocol indicating that a Microsoft network is running. So select a frame and check the detail window.
Frame 1 is examined in the detail decode window. It does include the NetBios Datagram Service.

Why doesn't LinkFerret include NetBios Datagram Service in its protocol filters?
Because LinkFerret provides filters during live captures, LinkFerret can only filter low-level protocols to avoid frame loss. NetBios Datagram Service requires that many variables be investigated.


Edit Alarm Scripts Using Icons

Using the icons provides the same options as the mouse. To edit the alarm script using the icons:
Select the alarm.
Select any of the available icons.

Just hover the mouse over each icon and a quick hint will appear. In this case the icons are:
1. | Edit an alarm script.
2. | Delete an alarm script.


Create an Alarm Script Using the Mouse

To create an alarm script using the mouse, remember right click and then left click:
Right-click on LinkFerret Scripts which generates a context menu.
Left-click on the option in the context menu.

LinkFerret Scripts cannot be edited or deleted.


Create an Alarm Script Using Icons

Back

Using the icons provides the same options as the mouse. To create an alarm script using the icons:
Select LinkFerret Scripts.
Select the only available icon.

Just hover the mouse over the one available icon and a quick hint will appear.
Create an alarm script.


Edit a Filter Using Icons

Using the icons provides the same options as the mouse. To edit the filter using the icons:
Select the filter.
Select any of the available icons.

Just hover the mouse over each icon and a quick hint will appear. In this case the icons are:
1. | Create a filter statement.
2. | Edit a filter.
3. | Delete a filter.


Edit a Filter Statement Using the Mouse

To edit the filter statement using the mouse, remember right click and then left click.
Right-click on the filter statement which generates a context menu.
Left-click on an option in the context menu.

When the filter statement is selected a test may be added to the statement, the statement may be edited or the statement may be deleted.


Edit a Filter Statement Using Icons

Using the icons provides the same options as the mouse. To edit a filter statement using the icons:
Select the filter statement.
Select any of the available icons.

Just hover the mouse over each icon and a quick hint will appear. In this case the icons are:
1. | Add a filter statement test.
2. | Edit a filter statement.
3. | Delete a filter statement.

If add a filter statement test is selected, a pop-up appears permitting the user to select one of the following:
1. | Create Value-based Test
2. | Create IP Address-based Test
3. | Create MAC Address-based Test
4. | Create Protocol-based Test


Edit a Filter Test Using the Mouse

To edit the filter test using the mouse, remember right click and then left click.
Right-click the mouse button on the filter test which generates a context menu.
Left-click one of the options in the context menu.

When a filter test is selected, the test may be edited or deleted.


Edit a Filter Statement Using Icons

Edit a Filter Test Using Icons

Back

Using the icons provides the same options as the mouse. To edit a filter test using the icons:
Select the desired filter test.
Select any of the available icons

Just hover the mouse over each icon and a quick hint will appear. In this case the icons are:
1. | Edit a filter test.
2. | Delete a filter test.


Select Link Capture Device Dialog Box

Capture > Select Device... invokes Select Link Capture Device dialog box. In the dialog box select:
network adapter from the drop-down menu
OK

You have now selected the network card for monitoring your network. Do not select the dial-up device for monitoring, because nothing will happen.


Choose Capture > Capture to file

You can either capture to a screen or to a file. If you capture to a file, you are only limited by the space on your disk but you do not see the incoming frames. You must stop the capture and read in the file.

If you capture to a screen, you have memory limitations but you see incoming frames. While capturing to the screen you have difficulty altering the screen, because the screen is refreshed so often. In this case you are capturing to a file by selecting Capture > Capture to file.
select Capture pop-up menu
select Capture to file from the pop-up menu


Select Preferences > Preferences > Capture Buffer

To control how long to capture, the capture buffer size and how much of a frame to capture select:
Preferences icon which invokes the LinkFerret Preferences dialog box
Capture Buffer tab in LinkFerret Preferences dialog box


LinkFerret Preferences Dialog Box

In this example LinkFerret will capture the entire frame, will stop after capturing 1,000 frames and store all the frames in a file.
Capture XXX frames
You decided to capture 1,000 frames
Capture full frames
For file capture you are using a circular buffer, but the buffer never gets filled. LinkFerret grabs the frame from the line, stores the frame in the buffer, stores the frame in the file and now the memory is available for re-use.

You select the minimum capture buffer size, because you are not worried about data wrapping-around the buffer.
Select OK, because you are finished with this menu.


Start Capture

You have selected your NIC, you are capturing to a file and you are capturing the first 1,000 frames and then automatically halting. To start the capture, select
the icon Capture frames


Open a Capture File to Save Traffic Dialog Box

As soon as you select Capture frames, LinkFerret presents you with the dialog box, Open a Capture File to Save Traffic, so you can specify:
file name, get1000
file format, RFC 1761
OK because you are finished
In this dialog box you decide where to save the file, the file name and the file type. The file type is selected by a pull-down menu (see [image]). You can save the file in one of 5 formats:
  • LibPCap format
  • Microsoft Network Monitor format
  • Network Associates Sniffer (DOS) format
  • Network General's NetXray format
  • RFC1761 Snoop format
The file is named get1000.snp and the format is RFC1761 Snoop format.


LinkFerret in Capture Frames State

LinkFerret is capturing frames to a file. Notice the following:
Only the brief window is visible and there is nothing in the window.
LinkFerret's capture state icon is green, which indicates that capture is on.
Based on the frame count field, LinkFerret has captured 15 frames.
During file capture no data is displayed on the screen. LinkFerret is dedicated to capturing as many frames as possible. Check the status bar to determine the capture state and the number of frames captured.


LinkFerret Completed Capturing Frames to a File

Back

From the status bar you can determine:
LinkFerret's capture state icon is red, which indicates that capture is off.
LinkFerret captured 1,000 frames.


Manage Link Filters Dialog Box

Filter > Manage Link Filter... invokes the dialog box, Manage Link Filters. The root entry, LinkFerret Filters, is always displayed and may never be deleted or edited. To add an entry always think right-click and then left-click the mouse button:
Right-click on LinkFerret Filters. This causes a context menu to appear.
Left-click on the context menu Create Filters.


Create a Link Filter Dialog Box

When you select the context menu Create filter, the dialog box Create a Link Filter appears. You provide the name of the new filter:
Type in the name of the new filter. In this case it is filter out common NICs.
Select OK.

So have you really created a filter with this dialog box? Yes, but it does nothing at the moment. You have given your filter a name.


Create Statement Prompt

Now LinkFerret prompts you about creating a statement for the filter. You should notice:
Your new filter now appears in the Manage Link Filters dialog box.
Select Yes to the prompt.

Remember each filter can include a maximum of 4 statements and each statement can include a maximum of 4 tests.


Filter Statement Dialog Box

In the Filter Statement dialog box you have two choices -- whether to include or exclude a frame. For filtering, LinkFerret excludes all frames until it is told differently; therefor all frames begin with the value exclude. If the frame does not pass all the tests associated with a statement, its value is unchanged and filter testing continues. If a frame passes all the tests and
1. | the statement is exclude, the frame is thrown out and the next frame is tested.
2. | the statement is include, the frame's value is include and testing continues.
After checking all the filters, the frame's value determines whether it is included or excluded. Obviously, it is more efficient to have exclude statements before include statements. If you only have exclude statements, you will never capture anything.

In the Filter Statement dialog box, you selected:
the statement value is include
OK


Create Test Prompt

You just decided whether the statement value is include or exclude and now
You notice that the statement value is displayed in the Manage Link Filters dialog box
LinkFerret provides a prompt about creating a test, Select Yes to create a test.


Test Type Prompt

LinkFerret prompts you about the type of test that you want. Because your filtering is based on the MAC address, select Create MAC Address-based test.


Filter MAC Address Test Dialog Box

When the Filter MAC Address Test dialog box appears, execute:
right-click on MAC Address which generates a pop-up with all the names associated with addresses in the name space table
left-click on the MAC address, HACK1
select OK


Filter MAC Address Test Dialog Box

Filter MAC Address Test Dialog Box (continued)

Back Next

The value for HACK1 is displayed in the MAC address entry. To exclude any frames with a source address equal to HACK1, set the following entries:
The hexadeciaml value for HACK1 is displayed in the MAC Address entry
set Address Option to Source Address
set Test Type to Not equal
select OK

Because this test is associated with an include statement, you created a test to include all frames that do not have a source address equal to HACK1.


Manage Link Filters Dialog Box

In the Manage Link Filters dialog box notice:
The filter name, filter out common NICs, is displayed
The first statement, Statement 0, has the value include
The first test, Test 0, has the value TRUE if the source address does not equal 00-20-78-18-BE-8D.

We want to include another MAC test for Statement 0, so:
Right-click on Statement 0
Left-click on Create MAC Address-based test in the context menu


Filter MAC Address Test Dialog Box

Now you are going to include all frames that do not have a source address equal to WODEN:
The hexadeciaml value for WODEN is displayed in the MAC Address entry. You can either type the address or right-click on MAC Address and select WODEN from the pop-up menu of names in the name space table.
set Address Option to Source Address
set Test Type to Not equal
select OK


Done Creating Filter

In Manage Link Filters dialog box your filter is clearly explained:
The filter is named filter out common NICs
The filter has one include statement, Statement 0
Statement 0 has 2 MAC tests

filter out common NICs will include all frames that have a source address not equal to 00-20-78-18-BE-8D and not equal to 00-40-C7-20-BE-18. A statement is true if the results of all its tests ANDed together are true. Select OK (see [image]), because you are done creating the filter.


Installing a Filter

The brief window still shows HACK1, because you must install a filter before the brief window changes. On the status bar filter field (see [image]), you see that no filter has been installed. To install a filter:
1. | Select the drop-down menu for filters (see [image] ).
2. | From the drop-down menu select filter out common NICs (see [image] ).


I installed a filter. Why doesn't my filter work?

I know that I installed my filter, because the filter name is displayed in the status bar (see [image]). Although I have installed the filter, I know that my brief window has not changed because:
1. | I know that there are 184 frames in the file. The frame count field in the status bar (see [image] ) displays the number of frames reviewed.
2. | The last frame displayed in the brief window is numbered 184 (see [image] ).
3. | HACK1 is still displayed (see [image] ).

You are correct on all counts. You must refresh your screen using the command, View > Refresh.


The Filter Works

Back

You know that the filter is working, because:
1. | There are only 40 frames (see [image] ) in the brief window and 184 frames (see [image] ) were reviewed.
2. | There are no frames from HACK1 or WODEN (see [image] ).

Of course you still have frames sent to HACK1. You filtered out frames sent by HACK1, not received by HACK1.


Print Statistics Window

Print Brief, Detail Decode or Hex Decode Window

Back

To print the brief, detail decode or hex decode window, you have two choices:
If the window is open, then hover the mouse over the window, right click the mouse and select print from the pop-up window
Whether the window is opened or closed, you can always select the Reports pop-up menu and choose the window.


Host Display Color Coding Dialog Box

A dialog box with all the names and addresses in the name space table appear.
Select the name to color.
Select when to color the address. In this case, you chose to color the entries that refer to the address as a source address.
Select OK.


Color Dialog Box

Now you get the Color dialog box. Select
the color for the frames.
OK


Host Display Color Coding Dialog Box

Note the following in the Host Display Color Coding dialog box:
frames with a source address equal to "ACE" will be in red
Select OK and then check the brief window


LinkFerret's Brief Window

LinkFerret's brief window has not changed, because you have to refresh the window via View > Refresh.


LinkFerret's Refreshed Brief Window

LinkFerret's brief window is refreshed and frames from ACE are highlighted in red.


Invalid Filters

Every filter must have at least one include filter statement. A filter with no include statements will not capture any frames.


Filter Contents

  • Each filter must contain at least 1 statement
  • Each filter may contain a maximum of 4 statements
  • Each statement must contain at least 1 test
  • Each statement may contain a maximum of 4 tests


Statements and Tests

A statement determines whether to include or exclude a captured frame. There are four types of tests:
  1. value-based
  2. IP address-based
  3. MAC address-based
  4. protocol-based

Although a statement may have no more than four tests, you can select any combination of test types for the statement.


How Filters Work

The frame is tested against each statement:
  1. The statement is not TRUE unless the frame passes all of the statement's tests. The statement's tests are ANDed together.
  2. All statements are ORed together. If the OR operation is TRUE, the frame is saved.
  3. Here is the exception. If a frame passes all the tests of an exclude statement, testing stops and the frame is deleted.


Rules for Adding Filters

Back

Filtering Hierarchy
  1. LinkFerret Filters (root)
    1. Filter name
      1. Filter statement
        1. Filter test

Filters are created in a hierarchy. The root is ranked at the top and the filter tests at the bottom. To add an entry, select the item above the desired entry and select the "Create ..." icon from the toolbar.

To add a filter, right click on the root LinkFerret Filters.


LinkFerret Name Table Dialog Box

Name Space > Edit... invokes the dialog box LinkFerret Name Table. Let's associate the name, HACK1, with the hexadecimal address 00-40-C7-20-BE-18. Hover the mouse over each icon, an explanation pops up. Select Add a new name mapping icon (see [image]).


Create a New LinkFerret Name Table Mapping Dialog Box

In this dialog box you add the hex address and the name to associate with the hex address:
provide the hexadecimal address. Hyphens and spaces are ignored.
HACK1, the name to associate with the address
select OK


LinkFerret Name Table Mappings Dialog Box

LinkFerret Name Table Dialog Box

You are back to the original dialog box with the new entry displayed in the name table. Notice:
hexadecimal address is correct
the name to associate with the address is HACK1
select OK, because everything looks good!


Brief Window

Nothing has changed! Look at [image], the name HACK1 should be here. Do View > Refresh (see [image]) and check it again.


Refreshed Brief Window

Much better!


Open a Capture File for Display Dialog Box

Open > File... invokes the dialog box, Open a Capture File for Display. To open the capture file old_get3000, execute the following:
select the drop-down for extensions and choose to see files with the extensions cap, enc and snp.
select the file from the list
select Save

This is easy. At the moment LinkFerret can interpret the following capture formats:
  • LibPCap format
  • Microsoft Network Monitor format
  • Network Associates Sniffer (DOS) format
  • Network General's NetXray format
  • RFC 1761 SNOOP Format


Wait until Read Completes

You must wait for LinkFerret to read in the entire file. If the Capture State (see [image]) on the status bar displays a clock, then the read has not completed.


File Read Completes

Since Capture State (see [image]) on the status bar no longer displays a clock, LinkFerret has completed reading old_get3000.cap. The red icon for Capture State indicates that LinkFerret is not capturing data. The Frame Count (see [image]) is 3,000; therefor old_get3000.cap contains 3,000 frames.


Preferences > Preferences > Brief Display

Your suspicion is correct:
Address Format is MAC addresses. Switch the format to IP addresses.
Save the change.


LinkFerret Brief Decode Window

The LinkFerret's brief window hasn't changed. Try refreshing the window by selecting View > Refresh.


LinkFerret Brief Decode Window with IP Addresses

You did it! IP addresses appear in the brief window (see [image]).


Protocol Color Coding Dialog Box

A dialog box, Protocol Color Coding, appears with all the protocols recognized by LinkFerret.
Select the protocol to color code. In this case NetBios Name Service Protocol is selected.
Select the crayon icon.


Color Dialog Box

Now you get the Color dialog box.
Select the color for the frames containing the protocol.
Select OK.


Protocol Color Coding Dialog Box

The Protocol Color Coding dialog box indicates that the frames containing the RFC NetBIOS Name Service Protocol will be colored blue.
Select OK. Let's check the brief window.

If you select Restore All, the entry RFC NetBIOS Name Service Protocol is restored to its original color.


LinkFerret's Brief Window

LinkFerret's brief window has not changed, because you have to refresh the window via View > Refresh (see [image]).


LinkFerret's Refreshed Brief Window

LinkFerret's brief window is refreshed and frames containing the RFC NetBIOS Name Service Protocol are highlighted in blue.


Save Display Buffer to File Dialog Box

Back

File > Save... invokes the dialog box Save Display Buffer to File. In this dialog box you select:
the file name quicksave
the drop-down menu to access the file type
the file type. In this case you selected Microsoft Network Monitor Format.
Save

You are saving the data in the file, quicksave.cap. You can save the file in one of 5 formats:
  • LibPCap format
  • Microsoft Network Monitor format
  • Network Associates Sniffer (DOS) format
  • Network General's NetXray format
  • RFC 1761 SNOOP Format


Choose Capture > Capture to screen

You can either capture to a screen or to a file. If you capture to a file, you are only limited by the space on your disk but you do not see the incoming frames. You must stop the capture and read in the file.

If you capture to a screen, you have memory limitations but you see incoming frames. While capturing to the screen you have difficulty altering the screen, because the screen is refreshed so often. In this case you are capturing to the screen by selecting Capture > Capture to screen.
select Capture pop-up menu
select Capture to screen from the pop-up menu


LinkFerret Preferences Dialog Box

In this example LinkFerret will capture the first 256 bytes of each frame and will not halt until the user stops the capture.
Capture until halted
Capture 256 bytes per frame
For screen capture you are using a circular buffer. Select the maximum capture buffer size in your drop-down menu to avoid wrapping-around the buffer.
Select OK, because you are finished with this menu.


Start Capture

You have selected your NIC, you are capturing to the screen and you are capturing until you halt the capture. To start the capture, select
the icon Capture frames


LinkFerret in Capture State

LinkFerret is capturing frames and displaying the frames on the screen. You are about to stop the capture:
The green icon on the status bar means that LinkFerret is in capture state
This is the frame count.
You are stopping the capture.


LinkFerret Completed Capturing Frames to Screen

Back

From the status bar you can determine:
LinkFerret's capture state is red, so capture has stopped.
LinkFerret has captured 1055 frames.