LinkFerret Network Monitor

LinkFerret Network Monitor Help

LinkFerret is a versatile, easy to use, low cost, high performance network monitor; a sleek new version of the analyzer used by Baseband, NDIS driver specialists, for rigorous driver conformance testing. This ground-breaking monitor combines added features, a clean consistent interface, in-depth help file and top-notch support to provide an elegantly simple, yet power-packed tool geared for the Network Administrator, network/protocol developer and the security-minded individual.

This file contains a wealth of information on the operation of the monitor. Spend a little time browsing through the topics to gain familiarity with the many features that are available. LinkFerret, like any other tool, will become increasingly useful as you discover what LinkFerret can do for you.

LinkFerret and LinkFerret Network Monitor are Trademarks of Baseband Technologies.


 Conventions in LinkFerret Documentation

LinkFerret contains many windows, we are focusing on the menu bar (1), the Preferences icon on the toolbar (2) and the tabs in theStatistics window (3).

X > Y
When you select an item, X, from the menu bar, a pop-up menu appears. The entries in the pop-up window are Y.
When you select File from the menu bar and then you select Open from the pop-up menu, the shorthand is File > Open.

X > Y > Z
This is a quick method for identifying a tabbed entry. X > Y has the value Preferences > Preferences or Windows > Statistics. Z are the tabbed entries. When you select Preferences > Preferences (2), the dialog box LinkFerret Preferences is generated. In this case, the tabbed entry Windows (Preferences > Preferences > Windows), has been selected.

Statistics are the tabbed entries located at the bottom of the Statistics window (3). In this case you selected Traffic Profile, i.e., Windows > Statistics > Traffic Profile.


 Organization of LinkFerret Documentation

The Getting Started section includes some very brief tutorials to get you off the ground. For more detailed tutorials, check out Help > How do I... Finally Menu Options is organized to reflect the pop-up windows on the menu bar.

If the documentation has errors or you find a topic confusing or incomplete, please send us a note. We think that LinkFerret is easy to use, but, more importantly, you should think so, too.


 Getting Started with LinkFerret

When LinkFerret is executed, the user is presented with a myriad of pop-up menus, icons and smaller windows. To learn how to use LinkFerret quickly, read through the following articles:

  • LinkFerret Window Elements
  • Start Capturing Frames
  • Start Analysis
  • Using the Name Space Table
  • Filtering
  • Setting up Alarms
  • Installing LinkFerret's Wireless Driver


 LinkFerret Window Elements

When LinkFerret is executed, the following elements are visible:
menu bar
toolbar
Brief Decode Window
Detail Decode Window
Hex Decode Window
Statistics Window
Statistics Tabs
Status Bar

LinkFerret's main window contains the following windows that you can show or hide by clicking the Windows menu and choosing the window:
1. | Brief Decode (see [image] )
2. | Detail Decode (see [image] )
3. | Hex Decode (see [image] )
4. | Statistics (see [image] )

Right-click in a window to save, to copy to the clipboard or to print the data displayed in the window.

Go to Select another topic.


 Menu Bar - A Quick Overview

When you select an option on the menu bar, a pop-up window appears with available actions. For a more complete description of each action, hover the mouse over the action and an explanation appears in the status bar. For more details, check out Menu Bar.

Go to:
next step - Toolbar
return to beginning
select another topic


 Toolbar

The toolbar provides shortcuts to the more common utilities. To determine the meaning of an icon, just hover the mouse over the icon and a tool tip will pop up. The list of icons includes:

Icon Description
Open a capture file for display
Save capture buffer as a file
Copy a packet to the clipboard
Print packets
Configure LinkFerret options
Find a frame
Go to a frame
Clear capture buffer
Modify display filter
Modify display colors
Access name space table
Toggle button to display/hide the brief decode window
Toggle button to display/hide the detail decode window
Toggle button to display/hide the hex decode window
Toggle button to display/hide the statistics window
Enable alarm triggers
Start frame capture
Pause frame capture
Stop frame capture
Transmit frames

Go to:
next step - Brief Decode Window - A Quick Overview
previous step - Menu Bar
return to beginningbeginning
select another topic


 Brief Decode Window - A Quick Overview

To show or hide the Brief Decode Window, toggle one of the following:
Windows > Brief Decode
brief decode window icon

In the above case you see only one LinkFerret window, the brief decode window. The column titles (see [image]) like number, time, destination, etc., also include vertical bars to change the width of the columns. Just grab a vertical bar and move the bar either to the right or left to modify the column width.

In the table below the "Title" column refers to the titles in the brief window display.

Title | Description
Number | The frame number. The first frame number is always 1 if reading from a file. The first number in a screen capture may not be 1 due to wrapping.
Time | The time.
Destination | Address of the frame's destination address.
Source | Address of the frame's source address.
Protocol | The last protocol in the frame that LinkFerret could decipher.
Function | The frame in the last protocol that LinkFerret could decipher.

You can right click on the window to quickly access one of the following options:
1. | Create brief trace report (.htm, .txt or .csv)
2. | Copy packet to clipboard (detail trace version is copied)
3. | Print brief packet view

Go to:
next step - Detail Decode Window - A Quick Overview
previous step - Toolbar
return to beginning
select another topic

For further details, check out
  • Preferences > Preferences > Windows
  • Preferences > Preferences > Brief Display
  • Windows > Brief Decode
  • Name Space Pop-up menu


 Detail Decode Window - A Quick Overview

To show or hide the Detail Decode Window, toggle one of the following:
Windows > Detail Decode
detail decode window icon

In the above picture LinkFerret has three windows open:
brief decode window
detail decode window
hex decode window

Assume that a file has been read or that LinkFerret is capturing data to the screen. Also assume that the brief, detail and hex windows are visible in LinkFerret and execute the following:
1. | select a frame in the brief window
2. | note that the detail and hex windows have changed
3. | select a protocol field in the detail window
4. | see that the corresponding bytes in the hex window are highlighted

You can right click on the detail decode window to quickly access one of the following options:
1. | Create detail trace report (.htm, .txt or .csv)
2. | Copy packet to clipboard (detail trace version is copied)
3. | Print detail packet view

Go to:
next step - Hex Decode Window - A Quick Overview
previous step - Brief Decode Window - A Quick Overview
return to beginning
select another topic

For further details, check out

  • Preferences > Preferences > Windows
  • Windows > Detail Display


 Hex Decode Command - A Quick Overview

To show or hide the Hex Decode Window, toggle one of the following:
Windows > Hex Decode
hex decode window icon

In the above picture LinkFerret has three windows open:
brief decode window
detail decode window
hex decode window

Assume that a file has been read or that LinkFerret is capturing data to the screen. Also assume that the brief, detail and hex windows are visible in LinkFerret and execute the following:
1. | select a frame in the brief window
2. | note that the detail and hex windows have changed
3. | select a protocol field in the detail window
4. | see that the corresponding bytes in the hex window are highlighted

You can right click on the hex decode window to quickly access one of the following options:
1. | Create hex trace report (.htm, .txt or .csv)
2. | Copy packet to clipboard (detail trace version is copied)
3. | Print hex packet view

Go to:
next step - Statistics Window - A Quick Overview
previous step - Detail Decode Window - A Quick Overview
return to beginning
select another topic

To show or hide the hex decode window when LinkFerret starts, check out Preferences > Preferences > Windows.


 Statistics Window - A Quick Overview
To show or hide the Statistics Window, toggle one of the following:
Windows > Statistics
statistics window icon

The statistics are gathered from the capture buffer. Note that signal, speed and AP discovery statistics are only valid when monitoring a wireless network. To view one of the graphs or reports in the statistics window, select one of the following statistic tabs located below the statistics window:
1. | Traffic Profile
2. | Utilization Profile
3. | Link Histogram
4. | Packet Size
5. | Capture Rate
6. | Protocol Statistics
7. | Host Statistics
8. | Top Senders
9. | Top Receivers
10. | Signal
11. | Speed
12. | AP Discovery

You can right click on the statistics window to quickly access one of the following options:
1. | Save graph as a file
2. | Copy graph to clipboard
3. | Print graph

Go to:
next step - Status Bar
previous step - Hex Decode Window - A Quick Overview
return to beginning
select another topic

For further details, check out
  • Preferences > Preferences > Windows
  • Windows > Statistics


 Status Bar

The elements of the status bar include:
description of highlighted menu option
current active alarm trigger
current filter
current wireless channel
state of capture
number of frames captured
The status bar provides some useful tips. Just hover the mouse over each entry on the status bar and a quick explanation appears.

As an Ethernet monitor the entry, current wirless channel, is blank. As a wireless monitor, this field indicates which channel is being monitored. When LinkFerret is in scan mode, this field indicates the current channel.

LinkFerret can be in one of 4 states (see [image]):
color/image | LinkFerret state
green | capture mode
yellow | pause mode
red | not in capture mode
clock | reading a file
The green icon in the status bar indicates that the user selected LinkFerret to capture frames. It is NOT an indication that the NIC device is capturing successfully.

When the user reads in a file with captured data and the read has not completed, the clock icon remains visible until the read completes. The clock is on the status bar at the state of capture entry. If the clock is visible, then certain functions are not available. Once the clock disappears and the icon is red, all frames have been read from the file.

During a "live" capture, the number of frames represents the number of frames captured from the line (see [image]). If saving to a file, the number should reflect the number of frames saved in the file unless the media is out of space. Another cause for loss of data is the execution of other processes on the computer like the act of minimizing windows. If the data is being captured to the screen, the number displayed will be greater than the number of frames displayed. The frame loss is due to window processing overhead.

Go to:
previous step - Statistics Window - A Quick Overview
return to beginning
select another topic

More details:
Start Capture Command
Pause Command
Stop Command
Open Command
Device Info... Command
toolbar


 Start Capturing Frames

To capture data either on the screen or to a file requires a few steps:
1. | Select the NIC | Capture > Select Device...
2. | Select the Capture Method | Capture > Capture to screen or Capture > Capture to file
3. | Select Capture Options | Preferences > Preferences > Capture Buffer
4. | Start the Capture | Capture > Start Capture
5. | Stop the Capture | Capture > Stop Capture

Go to Select another topic.

More details:
Capture pop-up menu
Preferences > Preferences > Capture Buffer
Windows pop-up menu


 Select the NIC, Capture > Select Device...

A NIC, network interface card, must be selected before capture can begin. Execute the following:
1. | Capture > Select Device...
2. | the dialog box, Select Link Capture Device, appears
3. | select the NIC from drop-down box
4. | select OK
There, you selected a NIC. The NIC is set to promiscuous mode. In promiscuous mode the card receives all frames sent on the network. Any messages sent out by the selected NIC are looped back, therefore all frames on the network are captured.

Do not select the dial-up device for monitoring. If you select the dial-up device, nothing will happen. Literally, nothing will happen.

Go to:
next step - Select the Capture Method
return to beginning
select another topic

More information: Select Link Capture Device


 Select the Capture Method

To capture to screen:
1. | make sure that brief window is visible | Windows > Brief Decode must be checked
2. | make sure that screen capture is selected | Capture > Capture to screen must be checked

To capture to a file make sure that Capture > Capture to file is checked.

Go to:
next step - Select Capture Options, Preferences > Preferences > Capture Buffer
previous step - Select the NIC, Capture > Select Device...
return to beginning
select another topic

More details:
Capture pop-up menu
Capture to screen or file
Windows pop-up menu


 Select Capture Options, Preferences > Preferences > Capture Buffer

To set up your capture options, execute the following:
1. | Preferences > Preferences > Capture Buffer
2. | Capture Termination select Capture until halted
3. | Capture capture length set to 256
4. | Capture full frames is NOT checked

Capturing to the screen provides instant gratification, but screen capture is not as efficient as file capture. To avoid frame loss during screen capture you must increase the amount of memory that LinkFerret can use by setting Maximum capture buffer size to its highest setting. Because there is less overhead doing file capture, you can decrease memory use to its lowest setting.

Select OK, you are a done with Capture Buffer. You are only capturing 256 bytes of each frame and the capture will continue until you decide to stop it.

Go to:
next step - Start the Capture, Capture > Start Capture
previous step - Select the Capture Method
return to beginning
select another topic

More information: Preferences > Preferences > Capture Buffer


 Start the Capture, Capture > Start Capture

Select Capture > Start Capture. If you are capturing to the screen, you should be capturing frames. If you are capturing to a file, you have one extra step because the Open a Capture File to Save Traffic dialog box appears. In the dialog box you specify the name, location and format of the file. When you finish with the dialog box, you should be capturing!

If you are capturing to the screen, you should see frames in the Brief Window. If you are capturing to a file, the frame count in the right corner of the status bar should be increasing.

If you are not capturing frames, create some activity by selecting Transmit > Transmit a Frame. If you still don't see any activity, you have a problem. Select Capture > Device Info... and if the address is 0, there was a problem installing the device. Try removing the NIC, replacing the NIC and reinstalling the driver.

Go to:
next step - Stop Capture, Capture > Stop Capture
previous step - Select Capture Options, Preferences > Preferences > Capture Buffer
return to beginning
select another topic

More details:
brief window
Transmit > Transmit Frame
Capture > Device Info...
File > Open...


 Stop Capture, Capture > Stop Capture

To stop the capture just select Capture > Stop Capture. If you captured to the screen, you can save your screen capture by selecting File > Save. If you captured to a file, you can read your file via File > Open. In any case, your data is displayed and you are ready to analyze your data.

Go to:
previous step - Start the Capture, Capture > Start Capture
return to beginning
select another topic

More details:
Capture > Stop Capture
File > Open
File > Save


 Start Analysis

Before you can begin analyzing the data, you must stop the capture by selecting Capture > Stop Capture. Now you either have data captured to a file or to the capture buffer.

Before analysis can begin, the data from the file must be displayed on the screen. To open a file and display the file contents on the screen select File > Open.

If data has been captured to a buffer, you should save the raw data to a file before beginning post-mortem analysis by executing File > Save. More sophisticated analyzing techniques like filtering require that the display be refreshed by executing View > Refresh. This operation can only be performed on data read from a file.

To start analyzing your data requires a few simple steps:
1. | Set up windows
2. | Edit Tools

Go to Select another topic.

More details:
Capture > Stop Capture
File > Open
File > Save
Stop Capture
View > Refresh


 Set up windows

Make sure that your windows are open. At a minimum, you should have your brief window and detail decode window open. Check the Windows pop-up entry. If a window has a check mark next to it, it is open. To open a window, just select the unchecked entry. The window will open. It is not uncommon to have the hex decode window open, too.

Go to:
next step - Edit tools
return to beginning
select another topic

More information: Windows pop-up entry


 Edit Tools

The entries in the Edit pop-up entry are good for quickly navigating through the data. Use Edit > Go to Frame... to go to a frame number. Use Edit > Find to find frames with a given value.

Be careful using Edit > Clear, which deletes everything in the capture buffer. If you were looking at data in a saved file, you haven't lost anything. If your data was only in the capture buffer, then the data is lost. To avoid such problems, save your data in a file using File > Save.

More sophisticated analyzing techniques include filtering, modifying the name space table and color coding. These techniques cannot be applied to a captured buffer. These techniques require that the data be read from a file, the analysis techniques applied, then executing View > Refresh. Refresh reads the data from the opened file, applies the analyzing techniques and then displayes the modified data on the screen.

Go to:
previous step - Set up windows
return to beginning
select another topic

More details:
Edit options
File > Save
View > Refresh


 Using the Name Space Table

To use the name space table, you must know:
1. | What is the name space table?
2. | Why modify the name space table?
3. | How do I add a name and address to the name space table?
4. | How do I color destination and source addresses?
5. | Summary for the name space table

Go to select another topic.

For more details go to Name space pop-up menu


 What is the name space table?

The table contains two columns. The first column contains source addresses. The second column is a name associated with the source address.

How is the name matched with the address?
When LinkFerret is capturing, every new source address is stored in the name space table. Messages like browser announcements provide an association between an alphanumeric name and the hexadecimal MAC address of each NIC, network interface card.

What does the name space table affect?
Whenever a source address or a destination address matches the address stored in the name space table, the associated name is displayed in the brief window instead of the hex address.

What do the flags mean?
The valid flags in the name space table include:
  • G is a group address. If the least significant bit of the high order byte of the MAC address is 1, then the MAC address is a group address. LinkFerret determines whether the MAC address is a group address.
  • P is a persistent address. A persistent address is a well-known address like broadcast. LinkFerret provides the persistent addresses.
  • L is a locked address. A locked address remains valid for the life of the name space table and is the only flag that can be modified by the user.
When is the table used?
The name space table is always being updated, even when reading from a file. New names in the name space table only affect future entries in the brief window. To have the modifications made to the name space table be reflected in the entire file display, the user must refresh the screen.

Go to:
next step - Why modify the name space table?
return to beginning
select another topic

More information: Refresh the screen


 Why modify the name space table?

The main reasons to modify the name space table:
1. | add a hexadecimal address
2. | match a name to a hexadecimal address
3. | change the name associated with a hexadecimal address
4. | color messages sent or received by a given address

Go to:
next step - How do I add a name and address to the name space table?
previous step - What is the name space table?
return to beginning
select another topic


 How do I add a name and address to the name space table?

A. | You want to name an address that you see in the Brief Window (see [image] above)
B. | Select Name Space > Edit (see [image] above)
C. | Select Add a new name mapping icon (see [image] ) in Edit LinkFerret Name Table Mappings dialog box shown below.
D. | In Create a New LinkFerret Name Table Mapping dialog box execute the following:
 |  | For Mapped Address use an address displayed in your brief window. In this case 00-40-c7-20-be-18 is selected.
 |  | Provide a name for Mapped Name. HACK1 is used here.
 |  | Select OK
E. | Select OK in Edit LinkFerret Name Table Mappings dialog box.
 | Notice that the Edit Name Table Mappings displays the entry, HACK1.
F. | Check out the results in the Brief Window.
That's it! You modified the address to HACK1.

Go to:
next step - How do I color destination and source addresses?
previous step - Why modify the name space table?
return to beginning
select another topic

More information: Brief window


 How do I color destination and source addresses?

A. | Select Name Space > Edit. See [image] above.
B. | double-click on HACK1 in the LinkFerret Name Table. See [image] below.
C. | Select modify destination color. See [image] below.
D. | In the Color dialog box select:
 |  | the color
 |  | OK
E. | In Edit LinkFerret Name Mappings dialog box:
 |  | Notice that the color is displayed
 |  | Select OK
F. | Check out the results in the Brief Window
G. | You don't see any difference? Select View > Refresh
H. | Much better!
That's it! You colored HACK1 as a destination address and it really stands out.

Go to:
next step - Summary for the name space table
previous step - How do I add a name and address to the name space table?
return to beginning
select another topic


 Summary for the name space table

After you have updated your name space table, you can save your name space table via Name Space > Save.... Now you can take your file and name space table to another computer, bring up LinkFerret, open your file, open the name space table and continue your investigation.

Go to:
previous step How do I color destination and source addresses?
return to beginning
select another topic


 Filtering

You have started a capture or are reading a file and you are investigating a MAC address called HACK1. For filtering you are going to learn the following:
1. | When to use View > Refresh
2. | How do I show or hide a protocol on the display?
3. | How do I color a protocol?
4. | How Does Filtering Work?
5. | How do I create a protocol filter?
6. | How do I create MAC address filter?
7. | Summary for filtering

Go to Select another topic.

More details:
Filter pop-up menu


 When to use View > Refresh

If you are reviewing a file and have done something to modify the display like disable a protocol display, color a protocol or install a filter; you must select View > Refresh before seeing any effect.

If you are capturing to the screen, you cannot refresh. As a result, your modifications only affect frames received after the change is made. Any frames captured prior to the modifications remain unchanged. The only way to affect the entire capture is to stop the capture, save to a file and then read the file.

Go to:
next step - How do I show or hide a protocol on the display?
return to beginning
select another topic

For more details go to View > Refresh


 How do I show or hide a protocol on the display?

You are interested in SMB frames. Let's disable protocols going to a Novell server, because SMB frames are not supported by Novell. Execute the following steps:
1. | Select Filters > Display Filter...
 | The Protocol Display Filter dialog box appears
 | In Enabled Protocols click on Netware Core Protocol (see NCP), keep the button depressed and slide the element into the Disabled Protocols window
. | Select OK and the Protocol Display Filter dialog box disappears
Now LinkFerret will not display any information about Netware Core Protocol in any frame.

Here's a simple trick. To only display frames containing a particular protocol, execute:
1. | Select Filters > Display Filter...
2. | The Protocol Display Filter dialog box appears
3. | Select Disable All ->> at the bottom of Enable Protocols
4. | In Disabled Protocols click on the desired protocol, keep the button depressed and slide the element into the Enabled Protocols window
5. | select OK and the Protocol Display Filter dialog box disappears

Go to:
next step - How do I color a protocol?
previous step - When to use View > Refresh
return to beginning
select another topic

For more details go to Filters > Display Filter...


 How do I color a protocol?

You want to know about all the SMB frames that are being sent. To color all the frames in the Brief decode window containing the SMB protocol, execute:
1. | Select Filters > Protocol Color Coding...
2. | The Protocol Display Color Coding dialog box appears
3. | double-click on SMB
4. | in the Color dialog box select the color blue, select OK
5. | note that SMB is blue in the Protocol Display Color Coding dialog box
6. | Select OK in the Protocol Display Color Coding dialog box

Now all frames containing the SMB protocol are colored blue on the Brief decode window. If you are reading from a file and nothing happened, don't forget to View > Refresh. If you are getting data from the network, only future frames are affected.

Go to:
next step - How Does Filtering Work?
previous step - How do I show or hide a protocol on the display?
return to beginning
select another topic

For more details go to Filters > Protocol Color Coding....


 How Does Filtering Work?

Each filter contains one or more include/exclude statements. The filter may contain no more than four statements. Each statement will have at least one test, but no more than four tests.

When you install a filter, each frame is tested against the filter:

  1. A filter statement is not TRUE unless the frame passes all of the statement's tests. The test results are ANDed together.
  2. All statement results are ORed together. If the result is TRUE, the frame is saved.
  3. Exception to Rule 2: If a frame passes all the tests for an exclude statement, testing stops and the frame is deleted.
If your filter only has exclude statements, your filter is invalid. When you attempt to install an invalid filter, a warning occurs and the filter is not installed.

Go to:
next step - How do I create a protocol filter?
previous step - How do I color a protocol?
return to beginning
select another topic

For more details go to Filters pop-up menu item.


 How do I create a protocol filter?

Let's eliminate all frames that contain the Netware Core Protocol. Select the Filters > Manage Link Filters.... Whenever you use the Manage Link Filters dialog box, the procedure generally requires a right click on the mouse and then a left click. To edit an entry, just double click on the desired item.

Create a filter
  1. Right click on LinkFerret Filters
  2. Left click the context menu, create filter
  3. Type a filter name, like hide novell protocol in the Filter Name dialog box, select OK

Create a filter statement
  1. Right click on hide novell protocol
  2. Left click Create Statement in the context menu
  3. In the Filter Statement dialog box select Include and OK

Create a filter test
  1. Right click on statement 0 under hide novell protocol
  2. Left click on create Protocol-based test
  3. In the Filter Protocol Test dialog box, select NCP as the Protocol Filter
  4. Select Protocol Not Present in the Filter on Condition area
  5. Select OK in the Filter Protocol Test dialog box
  6. Select OK in the Manage Link Filters dialog box
That's it! You created a filter to include all frames not containing Netware Core Protocol.

Go to:
next step - How do I create a MAC address filter?
previous step - How Does Filtering Work?
return to beginning
select another topic

For more details go to Filters pop-up menu item.


 How do I create a MAC address filter?

Let's only include frames that are sent by HACK1 (see Using the Name Space Table). HACK1 has a MAC address equal to 00-40-c7-20-be-18. This time you will create a MAC Address-based test. Again, select the Filters > Manage Link Filters....

Create a filter
  1. Right click on LinkFerret Filters
  2. Left click the context menu, create filter
  3. Type a filter name, only HACK1 in the Filter Name dialog box, select OK

Create a filter statement
  1. Right click on only HACK1
  2. Left click Create Statement in the context menu
  3. In the Filter Statement dialog box, select Include and OK

Create a filter test
  1. Right click on statement 0 under only HACK1
  2. Left click on create MAC Address-based test
  3. In the Filter MAC Address Test dialog box, type the MAC address
  4. Select Source Address in the Address Option area
  5. Select Equal in the Test Type area
  6. Select OK in the Filter MAC Address Test dialog box
That's it! You created a filter to include all frames sent by HACK1.

Go to:
next step - Summary for filtering
previous step - How do I create a protocol filter?
return to beginning
select another topic

For more details, check out:


 Summary for filtering

If the filter does not seem to be working, it is not supposed to work, yet. The filter must be installed. To select a filter, execute the following:
1. | Select the drop-down menu in the status bar
2. | Select hide novell protocol in the drop-down menu

Now your filter should be working. For live captures, the excluded frames are not captured. If you are reading from a file, the display buffer is modified but the file remains unchanged.

Like the name space table, the filters may be saved by selecting Filters > Export Link Filters.... You can send your saved filters to someone else running LinkFerret. To read in a filter file select Filters > Import Link Filters....

Go to:
previous step - How do I create a MAC address filter?
return to beginning
select another topic

More details:
Selecting a Link Filter
Filter > Export Link Filters...
Filter > Import Link Filters...


 Setting up Alarms

Although LinkFerret is a great monitor, no one wants to stare at a monitor for hours waiting for some intermittent problem to occur. Alarms notify the user of the situation.

To learn about alarms execute the following steps:
1. | How do I create an alarm?
2. | How do I stop an alarm?
3. | How do I edit an alarm script?
4. | How do I delete an alarm script?

Go to Select another topic.


 How do I create an alarm?

You have created a filter, only HACK1, to capture all frames sent by the NIC, 00-40-c7-20-be-18. You want LinkFerret to make the screen blink when a frame is received with the source address of 00-40-c7-20-be-18.

Create an alarm trigger
1. | Select Alarms > Manage Alarm Triggers...
2. | In Manage Alarm Triggers dialog box:
 | a. | Select Link filter in the Alarm trigger column
 | b. | Select Only HACK1 from the pull-down in the Alarm trigger column
 | c. | Select OK

Create an alarm script called "bad address"
1. | Select Alarms > Manage Alarm Scripts...
2. | In Manage Alarm Scripts dialog box:
 | a. | Right click on LinkFerret Scripts
 | b. | Left click the context menu, Create Script
3. | In LinkFerret Alarm Scripts dialog box:
 | a. | Set script name to bad address
 | b. | For Select Action select flash screen
 | c. | Select OK
4. | In Manage Alarm Scripts dialog box select OK

Modify an alarm trigger to execute alarm script, "bad address"
1. | Select Alarms > Manage Alarm Triggers...
2. | In Manage Alarm Triggers dialog box:
 | a. | In the Link filter row and in the Alarm Action column, select bad address from pull-down
 | b. | Select OK

You did it! You created an alarm! Start a capture and watch the screen flash when "HACK1" sends a frame. When the alarm occurs, the name of the alarm script appears in the status bar for 1 to 2 seconds.

Go to:
next step - How do I stop an alarm?
return to beginning
select another topic

More details:
Status Bar
Filtering


 How do I stop an alarm?

You have created an alarm and started it. To stop the alarm:
1. | Select Alarms > Manage Alarm Triggers...
2. | In Manage Alarm Triggers dialog box uncheck Link filter and select OK.

In this case it is easier to destroy than create.
Go to:
next step - How do I edit an alarm script?
previous step - How do I create an alarm?
return to beginning
select another topic


 How do I edit an alarm script?

You have created an alarm and you have started a capture. The screen flickers every time the bad address is received as a source address. Instead of making the screen flicker, let's make the computer beep.

edit an alarm script
1. | Stop the alarm (see How do I stop an alarm?)
2. | Select Alarms > Manage Alarm Scripts...
3. | In Manage Alarm Scripts dialog box:
 | a. | Click on the plus sign next to Link Ferret Scripts to get the scripts
 | b. | Double-click on the script bad address
 | c. | In the LinkFerret Alarm Scripts dialog box:
 |  | 1. | For Select Action choose Sound beep
 |  | 2. | Select Test and you should hear a beep
 |  | 3. | Select OK
 | d. | In Manage Alarm Scripts dialog box select OK

Start alarm
1. | Select Alarms > Manage Alarm Triggers...
2. | In Manage Alarm Triggers dialog box:
 | a. | Select Link filter to make the alarm active with the script, bad address
 | b. | Select OK

Now your bad address should cause LinkFerret to beep every time it receives a frame with the requested source address. To avoid chronic alarms, LinkFerret will not generate another alarm for a minimum of 2 seconds. If an alarm condition occurs during the 2 second period, the condition is ignored.

Go to:
next step - How do I delete an alarm script?
previous step - How do I stop an alarm?
return to beginning
select another topic


 How do I delete an alarm script?

You have created an alarm, an alarm script and the alarm is executing. You are tired of the beeps and want to eliminate the script.

To delete the alarm script
1. | Select Alarms > Manage Alarm Scripts...
2. | In Manage Alarm Scripts... dialog box:
 | a. | Select + to see all the scripts
 |  | Select the script, bad address
 |  | Select the icon, Delete an Alarm Script
 |  | Select OK

Wait a minute -- LinkFerret is still beeping! You must disable the alarm.

Disable alarm trigger
1. | Select Alarms > Manage Alarm Triggers...
2. | In Manage Alarm Triggers dialog box:
 | a. | Remove check next to Link filter
 | b. | Select OK

Go to:
previous step - How do I edit an alarm script?
return to beginning
select another topic


 Installing LinkFerret's Wireless Driver

Why does LinkFerret need to provide a driver?
Wireless LAN technology burst onto the scene so rapidly that the protocol stacks developed for the major operating systems such as Windows couldn't be modified quickly enough to "understand" this new media. Card vendors took the approach that has typically been used when porting a piece of hardware to a system that did not understand it. They emulated a device that the system did know about, in this case Ethernet, and were therefor able to immediately deploy their adapters without waiting for the system software to catch up.

This approach works well for ordinary communication, however the consequence is that there is no uniform way to place a wireless adapter into a mode in which the network can be monitored. In order to truly see inside the network a packet sniffer must be able to view the raw 802.11 traffic.

Every packet sniffer that offers true wireless monitoring support must provide a custom driver, which includes promiscuous MAC-level capture, for each wireless card that it supports. For this release, LinkFerret supports Cisco/Aironet 340/350 wireless adapters and WaveLAN/Orinoco adapters. We have drivers in development for several other popular wireless cards. They will be available as an update in the near future.

What happens when I install the LinkFerret driver?
After it is installed, the LinkFerret capture driver "owns" the adapter. Normal system functions will not be able to use this adapter while the capture driver is in place. Use the LinkFerret driver when you are setting up a monitoring session. When you are ready to resume normal system operation then simply repeat the steps listed below for the appropriate operating system and specifying the original driver.

Why do I need different instructions for different Microsoft operating systems?
It does not matter whether you install an Ethernet driver or a wireless driver, the instructions differ from one Microsoft operating system to the next.

Does LinkFerret support wireless monitoring on versions of Windows NT earlier than Windows 2000?
No.

To install LinkFerret's driver for your computer, select your operating system:
Windows 2000
Windows XP
Windows 98/ME

select another topic.


 Installing LinkFerret's Wireless Driver on Windows 2000

Directions

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the Control Panel and select the "System" icon
  4. Select the "Hardware" tab
  5. Select "Device Manager"
  6. Open network adapters tree view node
  7. Double-click one of the adapters supported by LinkFerret:
    1. Cisco/Aironet adapter
    2. WaveLAN/Orinoco adapter
  8. From the property sheet select "Driver"
  9. Select "Update driver"
  10. Follow directions provided, and specify "Search for a driver", indicating that the system should look in:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    1. For the Cisco/Aironet adapter the name of the .inf file describing the driver is lfan4500.inf. The driver itself is named lfan4500.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.

    2. For the WaveLAN/Orinoco adapter the name of the .inf file describing the driver is lfprism.inf. The driver itself is named lfprism.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.

  11. When the update has completed, return to the "Connection Properties" screen. If any filters or intermediate drivers are listed, then clear the check mark so that they are not bound to the LinkFerret driver. Examples of this type of driver are the Microsoft QoS Packet Scheduler, the MAC Bridge and VPN's.
  12. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  13. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.

return to beginning
select another topic.


 Installing LinkFerret's Wireless Driver on Windows XP

Directions

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the "Start" menu and select "My Computer"
  4. Select "My Network Places"
  5. Select "View Network Connections"
  6. Right-click on the icon for one of cards supported by LinkFerret
    1. the Cisco/Aironet card
    2. the WaveLAN/Orinoco card
  7. Select "Properties" on the dropdown menu
  8. Select "Configure"
  9. Select the "Driver" tab
  10. Select "Update Driver"
  11. Check the "Install from location" button
  12. Check the "don't search" button
  13. Select "Have Disk"
  14. Indicate that the system should look in:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    1. For the Cisco/Aironet adapter the name of the .inf file describing the driver is lfan4500.inf. The driver itself is named lfan4500.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.

    2. For the WaveLAN/Orinoco adapter the name of the .inf file describing the driver is lfprism.inf. The driver itself is named lfprism.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.

  15. When the update has completed, return to the "Connection Properties" screen. If any filters or intermediate drivers are listed, then clear the check mark so that they are not bound to the LinkFerret driver. Examples of this type of driver are the Microsoft QoS Packet Scheduler, the MAC Bridge and VPN's.
  16. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  17. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.

return to beginning
select another topic.


 Installing LinkFerret's Wireless Driver on Windows 98/ME

Directions

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the Control Panel and select the "System" icon
  4. Select the "Device Manager" tab
  5. Open network adapters
  6. Select the one of the adapters supported by LinkFerret
    1. Cisco/Aironet adapter
    2. WaveLAN/Orinoco adapter
  7. Select "Properties"
  8. From the property sheet select "Driver"
  9. Select "Update driver"
  10. Follow directions provided, and specify "Search for a driver". Use the "Browse" button and navigate to:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    1. For the Cisco/Aironet adapter the name of the .inf file describing the driver is lfan4500.inf. The driver itself is named lfan4500.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.

    2. For the WaveLAN/Orinoco adapter the name of the .inf file describing the driver is lfprism.inf. The driver itself is named lfprism.sys. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.

  11. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  12. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.

return to beginning
select another topic.


 Trouble-shooting LinkFerret's Wireless Monitor

Unfortunately, wireless monitoring is not as simple as monitoring an Ethernet LAN. Based on our users' questions and problems, we have compiled some topics to help you trouble-shoot your wireless monitor:
1. | Why must I install a driver?
2. | Determining that the driver is installed
3. | Normal network functions unavailable
4. | Media information not preserved in capture file
5. | Bad frames captured
6. | Only see Ethernet data, source address is 0

Go to Select another topic.


why install driver

 Why must I install a driver?

There has been some confusion about why Baseband Technologies and other vendors of wireless network monitoring software must provide proprietary drivers for specific network adapters. It does seem confusing, especially considering that there is no such problem when setting up for Ethernet monitoring. We will try to make some sense of the issues involved.

Vendors who supply network adapter cards also provide a piece of software, known as a driver, to interface between the card and the operating system. The driver for each card is different, because the hardware/firmware on each card is different. The purpose of the driver is to mask the differences in hardware from the system software and present a uniform interface so that all Ethernet adapters look pretty much the same to the system network software.

To be useful, the monitoring software must be able to see all of the frames on the network, not just those intended for the station on which it is operating. Relatively speaking, Ethernet is old technology. There is a well-defined mechanism through which an Ethernet driver may be configured by the system to operate in this so-called promiscuous mode. To take advantage of this functionality the typical network monitor vendor supplies a protocol or intermediate driver that sits on top of the card driver and accesses frames via this interface.

Wireless networking, on the other hand, is relatively new and the upper edge software interfaces have not been clearly defined as they have with Ethernet. In point of fact, most current generation wireless 802.11 drivers actually pretend that they are Ethernet so that legacy operating system software won't be confused. The down side to this is that there is no standardized way to get beyond this Ethernet emulation and see the raw 802.11 traffic.

To step around this obstacle, every packet sniffer vendor that wishes to provide real 802.11 monitoring must write a driver for each wireless card that it can support. Here is where Baseband Technologies shines. Baseband started out writing media access drivers for network hardware vendors. We wrote one of the first wireless LAN drivers certified for Windows 2000. We have the experience to provide top-notch drivers that are very fast and efficient both for vendors and for our own product, the LinkFerret Packet Sniffer.

The caveat that comes with these add-on or replacement capture drivers is that while network monitoring is taking place the normal system software is locked out from using the adapter. In other words, you can monitor your network or you can surf your network - but you can't do both at the same time. The good news is that it is usually easy to switch between the normal adapter driver and the driver provided by the monitor vendor. We provide instructions on how to do it. Most of the other vendors do so as well.

At the moment we support the Aironet 340/350 Wireless card.

Go to:
Determining that the driver is installed
return to beginning
select another topic


install driver correctly

 Determining that the driver is installed

After you have installed LinkFerret's wireless driver (see installation directions), you should reboot to be on the safe side. Bring up LinkFerret Monitor and select Capture > Select Device... to display the dialog box, Select Link Capture Device. All of LinkFerret's wireless drivers include [LinkFerret-Capture] in the pull-down selection. If you do not see [LinkFerret-Capture] in any of the pull-down selections, then you had a problem installing the driver.

To make sure that you really selected the correct driver, select Capture > Device Info.... In the dialog box, Capture Device Information, you had better see [LinkFerret-Capture] in the title.

Go to:
Normal network functions unavailable
return to beginning
select another topic


normal network functions

 Normal network functions unavailable

Every packet sniffer that supports 802.11 monitoring must write a driver for each supported wireless network card. The packet sniffer's driver must lock out normal operating system functions, because the driver is providing a "raw mode" data stream that normal system network components cannot understand. You can either surf the network with the normal adapter driver or have 802.11 monitoring with the a packet sniffer's driver; but you cannot do both at the same time.

Go to:
Media information not preserved in capture file
return to beginning
select another topic


live capture vs reading from capture file

 Media information not preserved in capture file

The live capture media specific information includes the usual information like date and time of the packet capture. It also includes the channel number, speed, signal strength, quality of signal and the PLCP header. We felt that this information may help the debugging process on wireless networks. Unfortunately, the capture file formats that LinkFerret support do not provide an area for storing such information. When reading from a file, the channel, speed, etc. are dispalyed as zero.

Go to:
Bad frames captured
return to beginning
select another topic


bad data frames

 Bad frames captured

First, you should expect to see more bad frames on your wireless network than on an Ethernet network carrying a comparable load. This is only a partial answer. If you do a simple ping and see valid 802.11 control frames but no valid data frames like ICMP, you most likely have not set LinkFerret up correctly.

The first possibility is that the frames have been encrypted and LinkFerret has not been given the key. To determine if this is indeed the problem, stop or pause a capture, select a data frame and check the 802.11 MAC Protocol tree in the detail window. If the entry WEP in Frame Control Byte 1 is on, then there is an encryption problem. Go to Preferences > WEP, provide the key, restart your capture and see if the problem is solved.

The other possibility is that LinkFerret is looking for data on the wrong channel. The control frames are not garbled, because they come in at a slower speed than data frames. Again, start a live capture and stop/pause the capture after the problem occurs. Select a data frame, go to the detail window and check the entry, Status, in the Physical Frame tree. If you keep seeing errors, then you have to switch the channel that you are investigating. If you are not sure what channel to set LinkFerret, then put LinkFerret into scan mode by accessing Preferences > WEP. Increase the hover time to about one minute. Start capture and hopefully, you will begin to see valid data frames coming in on one of the channels. To determine which channel is providing good data, stop/pause the capture, select a good data frame and check the channel entry in the detail window's Physical Frame. Another way to determine the channel is to display the statistics window, Signal, while capturing frames. To switch the channel, access Preferences > WEP

Go to:
Only see Ethernet data, source address is 0
return to beginning
select another topic


only see Ethernet data

 Only see Ethernet data, source address is 0

If you are only seeing Ethernet data and in most cases the source address is 0, then some filters or intermediate drivers are still bound to the LinkFerret wireless driver. Check the install instructions for your operating system.

Go to:
return to beginning
select another topic


 Menu Bar

The menu bar is located right under the LinkFerret title bar. The following options are available on the menu bar:

  • File
  • Edit
  • Preferences
  • View
  • Capture
  • Name Space
  • Statistics
  • Reports
  • Filters
  • Alarms
  • Log
  • Transmit
  • Windows
  • Help
  • Accelerator keys

When an option is selected, a pop-up menu appears with available actions. For a more complete explanation of each action, hover the mouse over the item and an explanation appears in the Status Bar.

For more information, check out:


 File Pop-up Menu

The File Pop-up Menu is located on the Menu Bar. The items in the File Menu are used to open, save and print capture files. The File pop-up menu includes the Exit command to end execution of LinkFerret Network Monitor. The options Open, Save and Print are not available if the monitor is in capture mode (see Capture Pop-up Menu).

The following File options are available:
  • Open...
  • Save...
  • Print...
  • Exit
For more details, check out


File > Open...

File > Open... Ctrl+o

Open a File

File Types
When opening a file, you may select one of the following extensions:
Extension | Name
Cap | LibPCap File Format
Cap | Microsoft Network Monitor Format
Enc | Network Associates Sniffer (DOS) Format
Cap | Network General's NetXray Format
Snp | RFC 1761 Snoop Format

Although .Cap files refer to LibPCap files, Microsoft files and NetWork General's NetXray files; each one of these standards has different formats. The user may rename the files with an extension other than .cap, .enc or .snp and LinkFerret will still be able to read the file. Because LinkFerret can read and write so many different file types, you can continue using other monitors/analyzers in conjunction with LinkFerret.

Name Space Table
When a capture file is opened, the source and destination addresses in the file might not be in the user's name space table. The names are learned as the file is read in. To see the names, instead of the MAC hexadecimal address, in the early entries use View > Refresh.

Problems While Reading
Many functions and icons are not available until the read is completed. Check the status bar entry, state of capture, to determine if the read has completed. If the clock icon is visible, the read is not complete.

How Does LinkFerret Record All Frames?
The LinkFerret Network Monitor only records frames that it receives. So how does the monitor record frames that the "local" computer (where the network monitor is located) sends out? At the network driver interface level loopback occurs, i.e., the frames sent out on the line are looped back. The looped-back frames are received and then recorded by the LinkFerret Network Monitor.

For more information, check out:


File > Save...

File > Save... Ctrl+s

Save Captured Frames to a File

Size of file saved
The Save command invokes the Save Display Buffer to File dialog box. The dialog box permits the captured file to be saved on a disk. If the data was originally captured from the screen (Capture > Capture to screen), then the amount of data saved is limited by the size of the capture buffer (Preferences > Preferences > Capture Buffer).

File Types
Extension | Name
Cap | LibPCap File Format
Cap | Microsoft Network Monitor Format
Enc | Network Associates Sniffer (DOS) Format
Cap | Network General's NetXray Format
Snp | RFC 1761 Snoop Format

If the user does not specify the file type, the default, LibPCap, is used. The default extension may be overridden by selecting an extension for the filename.

Although .Cap files refer to LibPCap files, Microsoft files and NetWork General's NetXray files; each one of these standards has different formats. Because LinkFerret can handle so many different file types, you can continue using other monitors/analyzers in conjunction with LinkFerret.

For more information, check out:


File > Print...

File > Print... Ctrl+p

Print a File

The dialog box, Print Captured Frames, includes a few fields that require some more details.

Print range section
The Print range section refers to the frames in the display buffer. If reading from a file, all the frames are included in the range. If you were capturing to the screen, the number of frames is limited to the capture buffer size.

The Print range section includes three radio boxes. The first radio box, All, prints all the frames in the display buffer. The second radio box, Frames, permits the user to select a range of frames, based on the frame numbers. The frame numbers are displayed in LinkFerret's brief decode window. The third radio box, Selection, is visible but unavailable, because it is a future enhancement.

Detail level section
The Detail level section permits the user to select which monitor window to print. The windows available in this section include the brief decode, detail decode and hex decode. When the detail window is printed, each protocol level is expanded and each entry is well documented. The hex view prints a hex dump of each frame selected.

Paper Size for Different Windows
LinkFerret prints each displayed line on one printed line. If the brief monitor window is printed in portrait mode, the character size is decreased. For readability the brief monitor window should be printed in landscape mode. Since the detail monitor window requires many short lines per packet, the user should use portrait mode to save paper.

For more details, check out:
brief decode window
Capture buffer size
detail decode window
hex decode window


 Edit Pop-up Menu

The Edit Pop-up Menu is located on the Menu Bar. The edit items are used to manipulate frames in the capture buffer. The following Edit options are available:
  • Copy
  • Go to Frame...
  • Find...
  • Find Next
  • Clear
For more information, check out:


Edit > Copy

Edit > Copy Ctrl+c

Copy a Frame

The Copy command copies the selected frame from the brief window to the clipboard. The resulting copy is the frame from the detailed window and hex window. Only one frame may be selected and copied at a time.

More details:
brief decode window
detail decode window
hex decode window


Edit > Go to Frame...

Edit > Go to Frame... Ctrl+g

Go to Frame...

General Information
The user selects the frame number in the dialog box and presses the OK button. LinkFerret scrolls to the specified frame number in the brief window. If the frame number is not in the capture buffer, an error is displayed.

Limitations
If you are reading from a file, you can access all the frames. If you have read from the screen, then you are limited by the capture buffer size. The brief window reflects the frames that can be accessed.

For more details check out:
brief decode window
capture buffer


Edit > Find...

Edit > Find.... Ctrl+f

Find...

What are the different search types?
The Find command invokes the Find a Frame dialog box. The user selects the search type:
Destination Address
Source Address
EtherType
Hex string
Ascii string
Use the detail window to determine the destination address, source address and ethertype (the first fourteen bytes of the frame).

What are the restrictions for Find what field?
Both hexadecimal values and hyphens are valid characters for the destination address, source address and hex string; however hyphens are ignored.

How is the capture buffer searched?
LinkFerret searches the captured file from the beginning of the buffer for the requested data. To start the search further down the buffer, use Ctrl+g to go to a frame and then start the Find.

Limitations
If you are reading from a file, you can access all the frames. If you have read from the screen, then you are limited by the capture buffer size. The brief window reflects the frames that can be accessed.

More details:
brief decode window
capture buffer
detail decode window


Edit > Find Next

Edit > Find Next F3

Find Next

The Find Next command is used in conjunction with Edit > Find... and searches for the next occurrence of the requested string in the capture buffer.

For more details see Edit > Find...


Edit > Clear

Edit > Clear Delete

Clear

The Clear command empties the capture buffer and the LinkFerret monitor windows are cleared. If you were capturing to the screen and use the Clear command, then the data is lost. If you had been reading from a file, the file is untouched.


Preferences Pop-up Menu

Preferences Pop-up Menu

The Preferences pop-up menu is an entry on the menu bar and the toolbar. Preferences permits you to set-up characteristics for LinkFerret options. When Preferences is selected, a window with the following tabs appear:
  • Windows
  • Options
  • Brief Display
  • Log File
  • Capture Buffer
  • Transmit
  • Channels
  • WEP
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |

For more details, check out menu bar.


 Preferences > Preferences > Windows

Visibility of Windows at Start-up

Definition
You select which windows that you want visible at start-up. Once LinkFerret is up, you can show/hide windows using the toggle buttons in the Windows pop-up menu.

To refresh your memory here is a picture of the different windows available in LinkFerret:

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |

More details:
brief decode window
detail decode window
hex decode window
statistics window


 Preferences > Preferences > Options

Options

Display tips
When you start LinkFerret up, it can provide a tip. If you don't want to see the tips, just uncheck its entry.

Check file associations
If you select the file association icon, then the LinkFerret icon pops up next to trace files when you use Windows Explorer to display a list of files. If you double-click on the file, then LinkFerret is automatically executed.

Check for MAPI support
MAPI, messaging API, is required for e-mail. You can use e-mail in your alarm scripts and to send requests to Baseband. If you have no interest in e-mail, then uncheck the entry.

Check for Name Table modification
If this option is checked, your name table has been modified, the table has not been saved and you exit LinkFerret, a warning message is displayed. You can modify the table by adding, deleting or modifying an entry. If you were capturing data, then LinkFerret may have added entries.

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |


 Preferences > Preferences > Brief Display

Brief Display Options

Timestamp Format
You decide how to display time in the Brief decode window:
Name | Meaning
GMT | Greenwich Mean Time
Local Time | Local time is available on all platforms except Windows 98/ME
Start Relative | relative to the first packet captured
Packet Delta | relative to the packet preceding the current packet

Address Format
You can display the source/destination addresses as either an ip address or a hexadecimal address, i.e. MAC (media access control). The MAC address is twelve hexadeciamal digits long. If you select Select IP addresses and the frame does not contain an ip address, then the hexadecimal address is displayed.

Override addresses with OUIs
OUI, Organizational Unique Identifier, refers to the first six hexadecimal digits in the MAC address. The first six hex digits are replaced with the name of the manufacturer. If you select Display IP addresses and Override addresses with OUIs, then the results can be confusing. If the IP address is known, then only the IP address is displayed. If the IP address is not known, then the OUI with the last six hexadecimal digits are displayed.

Override addresses with names
LinkFerret uses the name space table to learn names. If you want to use the name space table, then learned names are displayed instead of any other address format selected including the OUI option. If there is no name associated with the address in the name space table, the other selected options will affect the display.

Brief Column Order
To modify the order that columns are displayed, grab an item with the mouse and put it in the desired location. To put the destination address after the source address, just grab "Destination" and put it after "Source". If the mouse strays outside the list display area, the item position does not change.

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |

For more details check out brief decode window.


 Preferences > Preferences > Log File

Log File Options

Some of the events logged include:
1. | stop/start capture
2. | open/save capture files
3. | open/save name space table
4. | executing an alarm

Maximum Entries
Valid numbers range from 8 to 1024.

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |

For more information, check out log pop-up menu.


 Preferences > Preferences > Capture Buffer

Capture Buffer Options

Points to remember
1. | This tab affects LinkFerret's capture performance.
2. | This tab is only available when LinkFerret is not in capture mode.
3. | LinkFerret capture performance is best when capturing to a file using a small capture frame size (256 bytes).

Maximum capture buffer size
1. | Determines the number of frames captured from the link
2. | Whether capturing 64 bytes/frame or 1518 bytes/frame, each frame requires about 1,700 bytes of memory
3. | Capture to a file
 | a. | When data is copied from memory to a file, then memory is re-used.
 | b. | Small buffer size affects performance. If LinkFerret runs out of memory, the frames are lost.
 | c. | Capture until halted - determines the number of frames saved before halting.
 | d. | Capture until buffer filled - has no effect. Capture continues until you halt the capture.
 | e. | Capture xxx frames - stops capturing when the requested number of frames have been captured.
4. | Capture to the screen
 | a. | Capture until halted - determines the number of frames displayed before halting.
 | b. | Capture until buffer filled - determines the number of frames displayed before wrapping occurs.
 | c. | Capture xxx frames - If the buffer size is too small to capture the requested number of frames, the oldest frames are lost.

Capture Length
1. | Useful for screen and file capture
2. | impacts performance - larger frame sizes degrades performance
3. | Range defaults to a minimum of 64 bytes to a maximum of a little less than 1,700 bytes
4. | 256 bytes is recommended for protocol review

To improve capture performance
1. | decrease frame size
2. | run as few processes as possible on the computer
3. | For screen capture increase the buffer size to avoid wrapping.

Capture Termination
For screen capture any one of the three options are valid. For file capture Capture until buffer filled defaults to Capture until halted.

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |


 Preferences > Preferences > Transmit Display

Transmit Frame Options

Select transmit source
You may transmit from a file or a buffer. In either case, only one frame is specified.

Transmit from a File
1. | Preferences > Preferences > Transmit
2. | Select Transmit from buffer
3. | Select OK
4. | Select Capture > Start Capture
5. | Select Transmit > Transmit a Frame
6. | Open a Packet File for Transmission dialog box appears
7. | Select a file from the dialog box
8. | The frame(s) are transmitted

Transmit from a Buffer
1. | Preferences > Preferences > Transmit
2. | Select Transmit from file
3. | In Transmit data enter the data for transmission
4. | Select OK
5. | Select Capture > Start Capture
6. | Select Transmit > Transmit a Frame
7. | The frame(s) are transmitted

File format
The file format is ascii and can be created with notepad. The frame includes the MAC destination and source address. A new line is specified using a hexadecimal 0d or hexadecimal 0a. A comment is always preceded by an asterisk and ends with new line. The comment may take a whole line or be at the end of a line.

Intra-frame pacing
When sending multiple frames, intra-frame pacing is required to determine the time delay before sending the next frame. This argument is required if Transmit once is not selected.

Summary
Once you have saved your transmission options, execute the following:
1. | Capture > Start Capture | start capture
2. | Transmit > Transmit a Frame | start transmission
3. | Transmit > Stop Transmit | stop transmission (if sending more than 1 frame)

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |


Preferences > Preferences > Channel

 Preferences > Preferences > Channels

Channel Options for Wireless Networks

Purpose
Preferences > Preferences > Channels is only valid for wireless networks. You can transmit on one channel, the Default channel, or cycle through all valid channels. Cycling is referred to as scan mode. The Channel Map specifies the valid channels used during scan mode.

Scan Mode
If you select Enable scan mode, transmission begins on one channel. After a period of time (Channel Hover Time), transmission switches to the next channel in the channel map. Scanning begins with the lowest channel number in the channel map, cycles through all channels until reaching the largest number, then scanning cycles back to the lowest number.

Buttons at bottom of page
The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |


 Preferences > Preferences > WEP

Decryption Information for Wireless Networks

Purpose
Preferences > Preferences > WEP is only valid for wireless networks and is used to decrypt encrypted frames. The network may have from one to four encryption keys. The keys can be either 40 or 128 bits long. LinkFerret permits the use of different sized keys on the same wireless network.

When LinkFerret reads in a wireless frame, the header specifies a key number if decrypting is required. If the keys are not entered into LinkFerret in the same order and same number of bits as entered on the network, then LinkFerret will not be able to decrypt the frame correctly.

The buttons at the bottom of the page are defined as follows:
Button | changes on all pages are saved | LinkFerret Preferences dialog box is closed
OK | X | X
Cancel |  | X
Apply | X |


 View Pop-up Menu

The View Pop-up Menu is located on the Menu Bar. The view options are used to either modify the font in the monitor windows or refresh the monitor window.

The following View options are available:

  • Select Font
  • Refresh
For more details, check out menu bar.


View > Font

Select Font Command

View > Select Font invokes the Font dialog box for modifying the font type and size in all LinkFerret windows. Any font modifications are maintained between LinkFerret sessions.

More details:
brief decode window
detail decode window
hex decode window


View > Refresh

Refresh Command

View > Refresh modifies the display in the brief decode window to reflect updates to the filters, name space table and coloring of hosts or protocols. Before executing Refresh, a file must have been opened. You cannot refresh data from the capture buffer.

More details:
Filters pop-up menu
Name Space pop-up menu


 Capture Pop-up Menu

The Capture Pop-up Menu is located on the Menu Bar. The selected options are maintained in the registry, therefore the same options are available the next time LinkFerret is executed. The following Capture options are available:

  • Start Capture
  • Pause Capture
  • Stop Capture
  • Select Device...
  • Device Info...
  • Capture to screen
  • Capture to file
For more details, check out menu bar.


Capture > Start Capture

Start Capture Command

No NIC has been selected
If a NIC, Network Interface Card, was selected in a prior capture, then the previously selected NIC is used and capturing commences. If no device has been selected, then the Capture > Start Capture command invokes the Select Link Capture End Points dialog box and you select the NIC.

Capture to file
1. | Select Capture > Capture to file
2. | Select Capture > Start Capture
2. | Open a capture file to save traffic dialog box appears
3. | Select a file name
4. | Select OK
5. | Capture begins

In the Open a capture file to save traffic dialog box, you determine where to save the captured data and the file format. At the moment LinkFerret provides the following formats:
Extension | Name
Cap | LibPCap File Format
Cap | Microsoft Network Monitor Format
Enc | Network Associates Sniffer (DOS) Format
Cap | Network General's NetXray Format
Snp | RFC 1761 Snoop Format
If the user cancels the dialog box, capturing is canceled.

Capture to screen
Capturing to the screen, not to a file, is more labor intensive, therefore packets may be dropped. To improve the capture rate check out Preferences > Preferences > Capture Buffer. To save the data captured to the screen, execute the following:
Capture > Stop Capture
File > Save

LinkFerret Windows
Whenever Capture > Start Capture command is selected, the LinkFerret Network Monitor windows are erased. If you choose to capture to the screen, the data is also displayed on the LinkFerret monitor brief window. If you capture to a file, then nothing is displayed in the LinkFerret windows. Whenever LinkFerret is in the capture state, the icon on the status bar is green.

For more information, check out:
Capture > Device Info...
Capture > Stop Capture
File > Save
Preferences > Preferences > Capture Buffer
Select Link Capture End Points dialog box
Status bar
Windows > Brief Decode


Capture > Pause Capture

Pause Capture Command

When you select Capture > Pause Capture
When you select Pause Capture, LinkFerret automatically stops saving data whether the data is stored on the screen or in a file. When Pause Capture is enabled, the capture functions available include Start, Stop and Device Info. In pause mode, the status bar state field is yellow.

For more details, check out:
Capture > Device Info...
Capture > Start Capture
Capture > Stop Capture
Preferences > Preferences > Capture Buffer
Status bar


Capture > Stop Capture

Stop Capture Command

When you select Capture > Stop Capture...
By selecting Stop Capture the network monitor automatically stops saving data whether the data is stored on the screen or in a file. The status bar state field turns red. When Stop Capture is invoked, the options available include:
Capture > Start Capture
Capture > Select Device...
Capture > Device Info...
Capture > Capture to screen
Capture > Capture to file
Preferences > Preferences > Capture Buffer

When can I access Stop Capture?
The Stop Capture command is only available when capture is active or paused. If the LinkFerret monitor is in any other state, the icon is not displayed on the toolbar and the icon is greyed-out on the Capture pop-up menu.

For more details, check out:
Capture > Device Info...
Capture > Capture to file
Capture > Capture to screen
Capture > Select Device...
Capture > Start Capture
Preferences > Preferences > Capture Buffer
Status bar


Capture > Select Device... Command

Capture > Select Device...

Select Device... Command

Select Link Capture End Points Dialog Box
When you select Capture > Select Device..., the Select Link Capture End Points dialog box appears. The dialog box includes The Select Capture Source, a drop-down list displaying all available NICs, Network Interface Cards, on the computer that could be used by the LinkFerret Network Monitor for monitoring. You select which NIC to use for monitoring. Do not select the dial-up device for monitoring. If you select the dial-up device, nothing will happen. Literally, nothing will happen.

Wireless cards
Do not select a wireless card unless (LinkFerret-Capture) is part of the title. LinkFerret-Capture indicates that the installed driver has been provided by LinkFerret. For wireless cards, you must have a driver provided by LinkFerret. If you select wireless cards without the (LinkFerret-Capture) string, then the manufacturer's driver is installed and you will not receive 802.11 traffic.

What happens when a NIC is selected?
A NIC must be selected before capture can begin. The NIC is set to promiscuous mode. In promiscuous mode the card receives all frames sent on the network. Any messages sent out by the selected NIC are looped back, therefore all frames on the network are captured.

Future Captures
Once a device has been selected, the same NIC is used for all future captures until another NIC is selected. Check Capture > Device Info... command to get information about the NIC.

For more details, check out:
Capture > Device Info...
Installing LinkFerret's Wireless Driver


Capture > Device Info... Command

Capture > Device Info...

Device Info... Command

Capture Device Information Dialog Box
When the Device Info command is chosen, the Capture Device Information dialog box appears. If a NIC has not been selected, an error message is displayed. For all valid cases, the window displays pertinent information about the last NIC used for capturing. If the user has select a NIC but has not executed a capture with the NIC, the MAC address is all zeroes.

LinkFerret is in capture mode, but has not captured any frames
You have selected a NIC, you started a capture but it appears that LinkFerret is not capturing. First check the MAC address in the Capture Device Information dialog box. If the MAC address is all zeroes, there is most likely a hardware problem. Try removing and reinstalling the NIC.

It does not matter what capture state LinkFerret is in - start capture, stop capture, pause - Device Info.. is always available.


Capture > Capture to screen and Capture > Capture to file Commands

Capture to screen and Capture to file Commands

Can I select both?
No. The two commands act like radio buttons, only one of the commands may be selected.

Capture to file
If Capture to file is chosen, the user does not select a file name until the start capture request is made. Once capture is started, no data is displayed on the screen. To see the data, you have to stop capture and then read the file.

Capture to screen
If you choose screen capture, the data is put in a buffer and then displayed on the LinkFerret monitor windows. Capturing to a buffer is more labor intensive, therefore packets may be dropped. The size of the capture buffer also affects how much data is saved in the buffer. If the buffer is small and/or a large amount of data has been received, data loss might occur.

Make sure that you are capturing frames
Check the status bar. Make sure that the capture state is green and the frame count is increasing. If the frame count is zero, try sending a frame to stimulate traffic. If the frame count is still zero, check Capture > Device Info...

Improve performance
Whether capturing to a file or the screen, other processes on the computer can affect the capture rate. Be aware that the act of minimizing windows impacts the capture rate.

For information check out:
Capture > Device Info...
Capture > Start Capture
File > Open...
Preferences > Preferences > Capture Buffer
Status bar


 Name Space Pop-up Menu

The Name Space Pop-up Menu is located on the Menu Bar. The Name Space options affect the name space table which matches names with addresses. If the address is in the name space table, then the brief window will display the name, not the address.

The following Name Space options are available:
  • New
  • Open...
  • Save...
  • Edit...
  • Host Color Coding...
For more details check out menu bar


Name Space > New Command

Name Space > New

New Name Space Table Command

What is the name space table?
The name space table contains MAC addresses and a name associated with each address. Either LinkFerret learned the addresses while reading a file or executing a file/screen capture or you provided the name and address (Name Space > Edit...). Names are displayed in the Brief Window.

Flags
Abbreviation | Name | Meaning
G | group address | If the least significant bit of the high order byte of an address is 1, then the MAC address is a group address. LinkFerret determines whether an address is a group address.
P | persistent address | A persistent address is a well-known address like broadcast. LinkFerret provides the persistent addresses.
L | locked address | A locked address remains valid for the life of the name space table. It is the only flag that can be modified by the user.

Select Name Types to Preserve Dialog Box
When Name Space > New is selected, the Select Name Types to Preserve dialog box appears. You decide whether to maintain persistent and locked addresses.

After creating a new name space table
The new name space table contains no entries unless you kept persistent and/or locked addresses. Once you start capture or read a file, the name space table is updated.

For more details, check out:


Name Space > Open... Command

Name Space > Open...

Open a Name Space Table

What is the name space table?
The name space table contains MAC addresses and a name associated with each address. Either LinkFerret learned the addresses while reading a file or executing a file/screen capture or you provided the name and address (Name Space > Edit...). Names are displayed in the Brief Window.

Why open a name space table?
You have captured a lot of data to a file. If you save the name space table (Name Space > Save...), then you could take the file and name space table to another computer. Open LinkFerret, the name space table and then the file. It is so much easier to analyze the file using names, not addresses.

Do I have to use .nsp as the extension?
No. This is a LinkFerret convention but you can use any name or extension.

For more details, check out:
Name Space > Edit...
Name Space > Save...
Windows > Brief Decode


Name Space > Save... Command

Name Space > Save...

Save a Name Space Table

What is the name space table?
The name space table contains MAC addresses and a name associated with each address. Either LinkFerret learned the addresses while reading a file or executing a file/screen capture or you provided the name and address (Name Space > Edit...). Names are displayed in the Brief Window.

Why save a name space table?
You have captured a lot of data to a file. If you save the name space table, then you could take the file and name space table to another computer. Open LinkFerret, the name space table (Name Space > Open...) and then the file. It is so much easier to analyze the file using names, not addresses.

Do I have to use .nsp as the extension?
No. This is a LinkFerret convention but you can use any name or extension.

For more details, check out:
Name Space > Edit...
Name Space > Open...
Windows > Brief Decode


Name Space > Edit...

Edit a Name Space Table

What is the name space table?
The name space table contains MAC addresses and a name associated with each address. Either LinkFerret learned the addresses while reading a file or executing a file/screen capture or you provided the name and address (Name Space > Edit...). Names are displayed in the Brief Window.

Flags
Abbreviation | Name | Meaning
G | group address | If the least significant bit of the high order byte of an address is 1, then the MAC address is a group address. LinkFerret determines whether an address is a group address.
P | persistent address | A persistent address is a well-known address like broadcast. LinkFerret provides the persistent addresses.
L | locked address | A locked address remains valid for the life of the name space table. It is the only flag that can be modified by the user.

Linkferret Name Table dialog box
Name Space > Edit... invokes the dialog box, Linkferret Name Table. The dialog box includes the following icons:
Icon | Definition
 | Add a new name mapping
 | Delete a name mapping
 | Edit a name mapping
 | Lock a name mapping
 | Unlock a name mapping

Delete, lock or unlock a name mapping
Just select an entry in the name space table, select the icon and the job is done.

Create a New LinkFerret Name Table Mapping dialog box
When you select the Add a new name mapping icon, the Create a New LinkFerret Name Table Mapping dialog box appears.
Entry | Definition
Mapped Address | Must be 12 hexadecimal digits Hyphens are ignored
Mapped Name | Must be less than 33 alphanumeric characters Not case sensitive May not be a duplicate of any other name in the table
Colors | Select the color of the address Destination address and source addresses can be different colors When you Modify either the destination address or the source address, the Color dialog box is invoked. When you finish with the Color dialog box the selected color is displayed next to the Modify button.

Edit a LinkFerret Name Table Mapping dialog box
Either you double-clicked on an entry in the name space table or you selected an entry in the name space table and then selected the Edit a name mapping icon. The result is that the Edit a LinkFerret Name Table Mapping dialog box appears.
Entry | Definition
Mapped Address | Cannot be modified
Mapped Name | Must be less than 33 alphanumeric characters Not case sensitive May not be a duplicate of any other name in the table
Colors | Select color of address Destination address and source addresses can be different colors When you Modify either the destination address or the source address, the Color dialog box is invoked. When you finish with the Color dialog box, the selected color is displayed next to the Modify button.

Color dialog box
You get to the Color dialog box by selecting Modify from the Create a New LinkFerret Name Table Mapping dialog box or Edit a LinkFerret Name Table Mapping dialog box. Just select the color and OK. You can create your own colors by selecting Define Custom Colors.

What happens when you edit or add an entry in the name space table?
Read in a file or capture to the screen. You have changed the appearance of the Brief Window. Depending on your change, a name appears instead of an address. If you changed the color, the change to the Brief Window can be dramatic.

I modified my name space table. Why doesn't my brief window change?
If you are reading from a file, you have to refresh the brief window (View > Refresh), before the changes are visible. If you are capturing to the screen, then only the frames captured after the filter is installed are modified.

For more details, check out:


Name Space > Host Color Coding...

Coloring an Entry in the Name Space Table

What is the name space table?
The name space table contains MAC addresses and a name associated with each address. Either LinkFerret learned the addresses while reading a file or executing a file/screen capture or you provided the name and address (Name Space > Edit...). Names are displayed in the Brief Window.

Host Display Color Coding dialog box
When you select Name Space > Host Color Coding..., the Host Display Color Coding dialog box appears. Now you can change the color of an entry in the the name space table which affects the display in the Brief Window.

First, select the entry in the name space table. Decide if you want to highlight frames sent or received by selected address. The icons at the top of the dialog box permit you to select the destination address (frames received by the address) or the source address (frames sent by the address).

Once you select the source or destination address, the Color dialog box is displayed and you choose your color. When you finish with the Color dialog box, you can modify more addresses or select OK in the Host Display Color Coding dialog box.

Color dialog box
Just select the color and OK. You can create your own colors by selecting Define Custom Colors.

Result
Read in a file or capture to the screen. The colors in the Brief Window should be jumping out at you.

I modified my name space table. Why doesn't my brief window change?
If you are reading from a file, you have to refresh the brief window (View > Refresh), before the changes are visible. If you are capturing to the screen, then only the frames captured after the filter is installed are modified.

For more details, check out Windows > Brief Decode.


 Statistics Pop-up Menu

The statistics pop-up menu is an entry on the menu bar.

Save, Print and Copy
Save, Print and Copy refer to the current statistics display (see Windows > Statistics) and are only available when the user has stopped capture. You have access to the same functions if you right-click in the statistics window.

Clear Statistics and Cumulative Statistics
It does not matter what state LinkFerret is in, you can always access these two options. Clear statistics clears all the counters and statistics collection restarts. If the Cumulative Statistics is checked, then the statistics are accumulated until Clear Statistics is selected or Cumulative Statistics is stopped. If Cumulative Statistics is not checked, the statistics reports are generated on a moment by moment basis. It is useful to have Cumulative Statistics unchecked to get visual confirmation when traffic spikes are occurring.

The following statistics options are available:
  • Save Current Statistics Display
  • Print Current Statistics Display
  • Copy Current Statistics Display
  • Cumulative Statistics
  • Clear Statistics

For further details, check out:
menu bar
Windows > Statistics.


Statistics > Save Current Statistics Display

Save Current Statistics Display Command

When is this function available?
If LinkFerret is not in capture state, then Statistics > Save Current Statistics Display is available. If status bar state field is not green, this function should be available.

How do I save the statistics?
1. | Go to the statistics window and select the chart or graph that you want from the statistics tabs.
2. | Make sure that LinkFerret is not in capture mode
3. | Select Statistics > Save Current Statistics Display. (You can also right-click in the status window and select save from the context window).
4. | Determine the name and location for the file.
5. | Determine the format. For graphs you can only save in one format (.bmp). For charts you can save in either .htm, .txt or .csv.

For further details, check out:


Statistics > Print Current Statistics Display

Print Current Statistics Display Command

When is this function available?
If LinkFerret is not in capture state, then Statistics > Print Current Statistics Display is available. If status bar state field is not green, this function should be available.

How do I print the statistics?
1. | Go to the statistics window and select the chart or graph that you want from the statistics tabs.
2. | Make sure that LinkFerret is not in capture mode
3. | Select Statistics > Print Current Statistics Display. (You can also right-click in the status window and select print from the context window).

For further details, check out:


Statistics > Copy Current Statistics Display

Copy Current Statistics Display Command

When is this function available?
If LinkFerret is not in capture state, then Statistics > Copy Current Statistics Display is available. If status bar state field is not green, this function should be available.

How do I copy the statistics?
1. | Go to the statistics window and select the chart or graph that you want from the statistics tabs.
2. | Make sure that LinkFerret is not in capture mode
3. | Select Statistics > Copy Current Statistics Display. (You can also right-click in the status window and select copy from the context window).
4. | The chart or graph has been copied to the clipboard.

For further details, check out:


Statistics > Clear Statistics and Statistics > Cumulative Statistics

Clear Statistics and Cumulative Statistics Commands

What does Clear Statistics do?
Statistics > Clear Statistics clears all the counters and then statistics collection restarts. You can execute this command at any time.

What does Cumulative Statistics do?
If Statistics > Cumulative Statistics is checked, the statistics are accumulated. You can execute this command at any time. If Clear Statistics is selected, the counters are zeroed out and accumulation restarts.

If Statistics > Cumulative Statistics is not checked, the statistics reports are generated on a moment by moment basis. It is useful to have Statistics > Cumulative Statistics unchecked to get visual confirmation when traffic spikes are occurring.


 Reports Pop-up Menu

The Reports pop-up menu is an entry on the menu bar. The items in the Reports Menu are used to create a printed copy of the data in the brief decode window, the detail decode window or the hex decode window.

When are these functions available?
The items in the Reports Menu are only available when data has been captured and the capture has been paused or stopped, i.e., if the status bar state field is not green.

What can I do with these functions?
All three functions bring up a dialog box and permit you to save the data from the selected window in a file. The file type may be html, text or csv.
Command | Title of Dialog Box
Brief Trace... | Save Brief Trace as ..
Detail Trace... | Save Detail Trace as ..
Hex Trace... | Save Hex Trace as ..

For more details, check out:


 Filters Pop-up Menu

The Filters Pop-up Menu is located on the Menu Bar. The items in the Filters Menu are used to filter frames at the display level and the source level.

Display Level Filtering
Display level refers to the options, Filters > Display Filter... and Filters > Protocol Color Coding..... Both filters modify the display, not the source. Both filters modify the protocol display.

Use Filters > Display Filter... to enable/disable protocol information from the brief and detail decode windows. Use Filters > Protocol Color Coding... to highlight frames in the brief decode window that contain the requested protocol.

Source Level Filters
Source level filtering refers to either live data coming from the wire or data from a file. For source level, filtering occurs before the data is placed in the capture buffer. Use Filters > Manage LinkFilters... to create source level filters.

After you capture data to a file and read in the file, use source level filtering to remove unnecessary frames. Don't forget to use View > Refresh to see the effect of the filter in the capture buffer. If you have done source level filtering and then saved the frames to a file, the filtered frames are not included in the file.

The following filter options are available:
  • Selecting a Link Filter
  • Manage Link Filters...
  • Import Link Filters...
  • Export Link Filters...
  • Display Filter...
  • Protocol Color Coding...
There is no mechanism to capture a frame of a particular frame size. The user may limit the number of bytes captured per frame by accessing Preferences > Preferences > Capture Buffer.

For more details check out:


 Selecting a Link Filter

In the status bar there is a pull-down entry used for selecting the desired filter. The entry, No Filter, is always available.

All the entries in the opened filter file are displayed in the drop-down menu. You can select any filter, including No Filter, at any time.

For more details check out:
menu bar
Filters > Import Link Filters...
Filters > Export Link Filters...


Filters > Manage Link Filters...

Manage Link Filters Command

Manage Link Filters dialog box
When you select Filters > Manage Link Filters..., the dialog box Manage Link Filters appears. The first time this dialog box appears, there is only one line, LinkFerret Filters. You cannot edit or delete this line.

How do I navigate in Manage Link Filters dialog box?
Use the icons at the top to create, edit or delete selected items in the dialog box. You can also right-click on an item to get a context-menu with all possible options.

What do the plus and minus signs in the Manage Link Filters dialog box mean?
A plus sign in front of an item means that you can click on the plus sign and the item expands to show more details. Click on the minus sign to hide the details.

How do I create a filter?
1. | Create a filter name.
2. | Create a statement.
3. | Create a test (select the statement, select add icon, then pick the test).
 | A. | Create Value-based test.
 | B. | Create IP Address-based test.
 | C. | Create MAC Address-based test.
 | D. | Create Protocol-based test.

Rules to follow when creating filters
1. | less filter statements are more efficient
2. | less filter tests in a filter statement are more efficient
3. | filter statements whose action is EXCLUDE should precede INCLUDE statements
4. | there must exist at least one filter statement whose action is INCLUDE


Filter Name Dialog Box

Create a Link Filter dialog box
You can have many filters and each filter must have a unique name. You define the filter name in this dialog box.

Why is this dialog box called "Create a Link Filter"? You are not creating a filter, just its name.
This is the first step toward creating a filter. You cannot create anything else until your filter has a name.

Can I modify the filter name after creating statements and tests for this filter?
Yes, you can. In the Manage Link Filters dialog box select the filter name and then select the edit icon. The Edit a Link Filter dialog box appears and you can edit the filter name.

For more information check out Filters > Manage Link Filters....


Filter Statement Dialog Box

Filter Statement dialog box
In this dialog box you must make one decision. What action is taken if the frame passes all the tests in this statement? The frame is either INCLUDED or EXCLUDED.

What if I forget what value I picked for the filter statement?
Check out Manage Link Filters dialog box. Each filter statement has a number and its value is either INCLUDE or EXCLUDE.

How many statements can a filter have?
A filter must have at least one statement and a maximum of four statements.

Are there any rules for the filter statement?
Yes, at least one statement must have the value INCLUDE. Each filter statement must have at least one test.

Are there any limits to the number of tests for each filter statement?
Yes, each statement must have at least 1 test and no more than 4 tests.

If I have an INCLUDE statement with 3 tests, how many tests does the frame have to pass?
It does not matter whether the statement is INCLUDE or EXCLUDE. The frame has to pass all the tests before the statement is valid. Test results are ANDed to determine the validity of each statement.

I have 2 INCLUDE statements and 2 EXCLUDE statements. How does processing work?
As soon as a frame passes an EXCLUDE statement, processing stops and the frame is filtered out. For efficiency put the EXCLUDE statements before the INCLUDE statements.

INCLUDE statements are ORed together. If the frame only passes 1 INCLUDE statement, then the frame is captured unless the frame passes an EXCLUDE statement. If none of the statements are valid, the frame is filtered out.

Can I edit this statement at a later date?
Yes. In Manage Link Filters dialog box select the statement and then select the edit icon; the Filter Statement dialog box appears and you can change the value.

For more information check out Filters > Manage Link Filters....


Filter Value Test Dialog Box

Filter Value Test dialog box
This dialog box looks pretty intimidating, but it packs a lot of power. You can check from one to eight bytes in a frame, the field can be in any part of the frame, then you add/subtract/... a modifier, get the result and compare the result to the test value.

Let's take an example. We want to filter out frames if the low order 4 bits of the 50th byte is less than or equal to 7.

Where is offset 0?
This is the first byte of the frame. For Ethernet frames it is the destination address and the low-order bit of the first byte determines if it is a group address.

Where is the 50th byte?
It is at offset 49. Notice from the title that the location is a decimal value.

What do I do with the second field entitled, And Mask (Hex)?
The title of the second field is determined by the Modifier field. Change the modifier and the title changes. The title prompts you whether the value must be decimal or hexadecimal.

For our example select And and the title becomes And Mask (Hex). The value in this field must be a hexadecimal value. Use byte fields. For our example we type 0f, because we only want to look at the lowest 4 bits.

What have I accomplished so far?
You went to offset 49 (the 50th byte), ANDed 0x0f to it and created a "result".

How do I compare the "result" to 7?
Set the Test Type to Greater than and set the Test value (hex) to 07.

How do I set the length of the field?
The length of the Test value (Hex) determines the length of the field to test. The field must be between 1 and 8 bytes. If your other fields are shorter, check Manage Link Filters dialog box and make sure that your other fields are displayed correctly. LinkFerret makes assumptions that might not correlate with what you want.

How do I use the test types AND and NOT?
In both cases the "result" is ANDed with the Test value. If the final answer is non-zero and the test type is AND, the frame passes the test. If the final answer is non-zero and the test type is NOT, the frame fails the test.

How can I remember this test?
Look at the Manage Link Filters dialog box after creating this test. For this test you see GT if ((Pack Offset(49) AND 0x0f)07). Translation: go to offset 49, AND 0x0f and if the result is greater than 7, then the test is TRUE.

Can I edit this test at a later date?
Yes. In Manage Link Filters dialog box select the test and then select the edit icon; the Filter Value Test dialog box appears and you can change the test.

For more information check out Filters > Manage Link Filters....


Filter IP Address Test Dialog Box

Filter IP Address Test dialog box
This test permits you to select frames based on the source or destination IP address.

Do I enter decimal or hexadecimal values for the IP address?
Decimal values.

Can I check if an IP address is in a range of addresses?
Yes. Select Use Address Range. Then you can provide a beginning and an ending address.

Can you give me an example?
Let's include frames that have a source IP address equal to 128-64-10-22. Set IP Address to 128-64-10-22. Set Address Option to Source Address and Test Type to Equal.

How can I remember this test?
Look at the Manage Link Filters dialog box after creating this test. For this test you see (IP) if (Source Address EQ 128-64-10-22). You know that this is a IP address test and the rest is easy to figure out.

Can I edit this test at a later date?
Yes. In Manage Link Filters dialog box select the test and then select the edit icon; the Filter IP Address Test dialog box appears and you can change the test.

For more information check out Filters > Manage Link Filters....


Filter MAC Address Test Dialog Box

Filter MAC Address Test dialog box
This test permits you to select frames based on the source or destination MAC address.

Do I enter decimal or hexadecimal values for the MAC address?
Hexadecimal values.

Can I check if an MAC address is in a range of addresses?
Yes. Select Use Address Range. Then you can provide a beginning and an ending address.

Can you give me an example?
Let's exclude frames that have a destination MAC address equal to 00-40-c7-20-be-18. Set MAC Address to 00-40-c7-20-be-18. Set Address Option to Destination Address and Test Type to Not equal.

How can I remember this test?
Look at the Manage Link Filters dialog box after creating this test. For this test you see (MAC) if (Destination Address NE 00-40-c7-20-be-18). You know that this is a MAC address test and the rest is easy to figure out.

Are there any short-cuts for providing the MAC address?
Yes. Right-click on the MAC Address entry and Name Table entries appear in a drop-down menu.

Can I edit this test at a later date?
Yes. In Manage Link Filters dialog box select the test and then select the edit icon; the Filter MAC Address Test dialog box appears and you can change the test.

For more details, check out:
Filters > Manage Link Filters...
Using the Name Space Table - a quick overview


Filter Protocol Test Dialog Box

Filter Protocol Test dialog box
This test permits you to select frames based on the existence of a protocol in the frame. Select the protocol from the drop-down menu. If you select Protocol present, then the test is TRUE if the frame contains the selected protocol.

Can you give me an example?
Let's exclude frames that have a the protocol, NCP. Assume the statement is INCLUDE. Select NCP from the drop-down menu and select Protocol not present. You are including all frames that do not contain NCP.

How can I remember this test?
Look at the Manage Link Filters dialog box after creating this test. For this test you see (PROT) if (Frame does not contain NCP). You know that this is a protocol test and the rest is easy to figure out.

Can I edit this test at a later date?
Yes. In Manage Link Filters dialog box select the test and then select the edit icon; the Filter Protocol Test dialog box appears and you can change the test.

For more details, check out Using the Name Space Table - a quick overview


Filters > Import Link Filters...

Import Link Filter Command

Open a File containing Filters to import dialog box
When you select Filter > Install a Link Filters..., the dialog box Open a File containing Filters to import is displayed. You pick the location and name of the file. You can change the file extension. The default is .flt.

Once you have installed the file, go to Manage Link Filters dialog box by executing Filters > Manage Link Filters.... You should see the filters saved earlier using Filters > Export Link Filters....

Why do I see an icon in front of the .flt files?
Windows believes that these are EtherPeek filter files. LinkFerret filter files are not compatible with EtherPeek's filter files.

For more details check out:
Filter > Export Link Filters...
Filter > Manage Link Filters...


Filters > Export Link Filters...

Export Link Filters Command

Select the Filters to Export dialog box
You have created filters with the command, Filter > Manage Link Filters.... You select which filters to save in a file. Select OK. The dialog box, Open a File to contain the exported Filters appears next.

Open a File to contain the exported Filters dialog box
You pick the location and name of the file. You can change the file extension. The default is .flt.

For more details check out Filter > Manage Link Filters....


Filters > Display Filter...

Display Filter Command

Protocol Display Filter dialog box
When you select the command Filter > Display Filter..., the dialog box Protocol Display Filter appears. This dialog box does not affect the source capture, just the display. You decide which protocols you want to see in the brief and detail decode windows. For each protocol that you don't want to see, select the protocol from the Enable Protocols window and drag it over to the Disable Protocols window.

Is there a simple way to enable just a few protocols?
Yes. Disable all the protocols (see the button at the bottom of the window, Disable All->>). For each protocol that you want to see in the brief and detail windows, select the protocol from the Disable Protocols window and drag it over to the Enable Protocols window.

Why doesn't my brief window change appearance?
If you are reading a file, you must refresh (View > Refresh) the brief window before the change takes effect. If you are capturing to the screen, the brief window does not modify frames captured before the change is made.

For more details check out:
Windows > Brief Decode
Windows > Detail Decode
View > Refresh


Filters > Protocol Color Coding...

Protocol Color Coding Command

Protocol Color Coding dialog box
When you select the command Filter > Protocol Color Coding..., the dialog box Protocol Color Coding appears. This dialog box does not affect the source capture, just the display. You can color one or more protocols. Double-click on the protocol and the Color dialog box appears. You choose the color for the protocol. You can create other colors by selecting Define Custom Colors>>. When you are finished with the Color dialog box, select OK.

You have colored one protocol, you can now color another protocol. This option provides a quick visual, if only one or two protocols are colored; however many colors make the brief window look chaotic.

Why doesn't my brief window change appearance?
If you are reading a file, you must refresh (View > Refresh) the brief window before the change takes effect . If you are capturing to the screen, the brief window does not modify frames captured before the change is made.

For more details check out:
Windows > Brief Decode
View > Refresh


 Alarms Pop-up Menu

The Alarms Pop-up Menu is located on the Menu Bar. To avoid missing important events, you can install alarms to receive notification of the event. The following alarm options are available:
Manage Alarm Triggers... | refers to the event that causes the alarm
Manage Alarm Scripts... | determines the type of alarm

For more details check out menu bar


Alarms > Manage Alarm Triggers...

Manage Alarm Triggers Command

Manage Alarm Triggers dialog box
When you select the command Alarms > Manage Alarm Triggers..., the dialog box, Manage Alarm Triggers appears. The first column, Alarm Trigger, determines what event causes the alarm. Most of the events occur when a threshold has been reached. The last entry, Link filter, refers to filters that were created using Filters > Manage Link Filters...

Second Column
The second column refers to the threshold or the filter. FPS means frames per second. For Broadcast and Multicast frames, the number is a decimal value. Errors refer to the errors reported by the driver like CRC errors, the frame is too small or the frame is too large. For Link Filter select the drop-down menu to choose one of the filters that you have created.

Third Column
The third column, Alarm Action, refers to the event used as the alarm. The events are defined when you execute Alarms > Manage Alarm Scripts... The icon in the upper left-hand corner is a short-cut for accessing the dialog box generated by Alarms > Manage Alarm Scripts...

How do I start/stop an alarm?
When you check the alarm, the alarm is activated. Uncheck the alarm to deactivate it.

Does it matter what state LinkFerret is in when I activate the alarm?
No. You can activate/deactivate the alarm whether LinkFerret is in capture mode or not. Of course, the alarm does not work until LinkFerret is capturing.

How often can I receive an alarm?
Every 2 seconds. To avoid receiving too many alarms, the alarm system goes inactive for two seconds after an alarm occurs. If another alarm condition occurs within the two seconds, you never receive the alarm.

Does LinkFerret provide any hints that an alarm occurred?
Yes, the script name is displayed on the status bar for about one second.

What is the default Alarm Action?
The default is the equivalent to flashing the screen.

For more information, check out:
Alarms > Manage Alarm Scripts...
Filters > Manage Link Filters...
status bar - a quick overview


Alarms > Manage Alarm Scripts...

Manage Alarm Scripts Command

Manage Alarm Scripts dialog box
Alarms > Manage Alarm Scripts... invokes this dialog box. The first time you open this dialog box, it contains exactly one line, LinkFerret Scripts. You cannot edit or delete this line.

How do I navigate in Manage Alarm Scripts dialog box?
Use the icons at the top to create, edit or delete scripts selected in the dialog box. You can also right-click on an script to get a context-menu with all possible options.

What do the plus and minus signs in the Manage Alarm Scripts dialog box mean?
A plus sign in front of LinkFerret Scripts means that you can click on the plus sign and all the alarm scripts are displayed. Click on the minus sign to hide the alarm scripts.

How do I create a script?
Right-click on LinkFerret Scripts and select Create script in the context-menu. Now the dialog box, LinkFerret Alarm Scripts, appears.

How do I edit a script?
Double-click on the script and the dialog box, LinkFerret Alarm Scripts, appears.

How do I delete a script?
Select the script and select the delete icon or delete key.

LinkFerret Alarm Scripts dialog box
Depending on the alarm that you select, more fields become available. Use the Test button to check out your alarm.


 Log Pop-up Menu

The Log Pop-up Menu is located on the Menu Bar. Important LinkFerret events are recorded in the log. Preferences > Preferences > Log File includes the options to control logging.

The following log commands are available:
Display Log File | Once the log is displayed, no new events are displayed. Close the log and the log file is updated.
Export Log File | Execute this command to save the log file which invokes the Export LinkFerret Log File dialog box. The log can be saved as an .htm, .txt or .log.
Print Log File | This command invokes the Print dialog box.
Clear Log File | Removes all entries in the log file.
Make a Log Entry | This command invokes the Make a LinkFerret Log Entry dialog box. You may enter one or more lines. To force a new line, enter Ctrl+enter. To end the entry, enter enter.

For more details, check out:


 Transmit Pop-up Menu

The Transmit Pop-up Menu is located on the Menu Bar. Transmit commands start and stop the transmission of frames by LinkFerret. Preferences > Preferences > Transmit includes the options to control frame transmission.

The following transmit commands are only available when LinkFerret is in capture mode:
Icon | Accelerator | Command | Meaning
 | Ctrl+t | Transmit a Frame | Transmit > Transmit a Frame transmits one or more frames. The frame's content and the number of frames transmitted is determined by Preferences > Preferences > Transmit
 |  | Stop Transmit | Transmit > Stop Transmit stops LinkFerret's frame transmission.

For more information, check out:


 Windows Pop-up Menu

The Windows Pop-up Menu is located on the Menu Bar. The windows menu controls whether a particular LinkFerret window is displayed or not. If a window is checked, then the window is displayed. In the case above, all the windows except the Statistics window are displayed in LinkFerret. You cannot move windows within LinkFerret. You may eliminate the window, change its size or modify its display.

The picture above labels all the windows available in LinkFerret. The following window options are available:

  • Brief Decode
  • Detail Decode
  • Hex Decode
  • Statistics
For more details, check out menu bar.


Windows > Brief Decode...

Brief Decode Window Command

To show or hide the Brief Decode Window, toggle either Windows > Brief Decode... or the brief decode window icon. To show or hide the brief decode window when LinkFerret starts, see Preferences > Preferences > Windows.

Change Size of Columns
In the above case the user has only one window open, the brief decode window. The column titles like number, time, destination, etc., also includes vertical bars to change the width of the columns. Just grab a vertical bar and move the bar either to the right or left to modify the column width.

Define Columns
In the table below the "Title" column refers to the titles in the brief window display, marked as 1 above.
Title | Description
Number | The frame number. The first frame number is always 1 if reading from a file. The first number in a screen capture may not be 1 due to wrapping.
Time | The time. The time can be switched between GMT, local, start relative time and packet delta time (see Preferences > Preferences > Windows and Windows > Detail Decode... for further details).
Destination | Address of the frame's destination address. The address may be displayed as a MAC address name, an IP address or the MAC's hexadecimal address (see Preferences > Preferences > Brief Display and Name Space Pop-up menu for more details).
Source | Address of the frame's source address. The address may be displayed as a MAC address name, an IP address or the MAC's hexadecimal address (see Preferences > Preferences > Brief Display and Name Space Pop-up menu for more details).
Protocol | The last protocol in the frame that LinkFerret could decipher.
Function | The frame in the last protocol that LinkFerret could decipher.

Right-click on Brief Window
You can right click on the window to quickly access one of the following options:
1. | Create Brief trace report (.htm, .txt or .csv) | (see Reports > Brief Trace...)
2. | Copy packet to clipboard (detail and hex window views are copied) | (see Edit > Copy)
3. | Print Brief packet view | (see File > Print)

For more details, check out:
Edit > Copy
File > Print
Name Space Pop-up menu
Preferences > Preferences > Brief Display
Preferences > Preferences > Windows
Reports > Brief Trace
Windows > Detail Decode


Windows > Detail Decode...

Detail Decode Window Command

To show or hide the Detail Decode Window, toggle either Windows > Detail Decode... or the detail decode window icon. To show or hide the detail decode window when LinkFerret starts, see Preferences > Preferences > Windows.

In the above picture LinkFerret has three windows open:
  1. brief decode window
  2. detail decode window
  3. hex decode window

View frame in different windows
When capturing frames onto the screen or reading a file, you can view the frames in the brief window. When you select a frame in the brief window, the detail decode window provides all the protocol details that LinkFerret can interpret. If a field is selected in the detail decode window, the hex values are highlighted in the hexadecimal decode window.

Expand/Colapse Entries in Detail Window
The plus sign in front of an entry in the detail decode window indicates that the entry can be expanded. Click the plus sign to view the details. The plus sign changes to a minus sign. To show fewer details click the minus sign, the entry collapses and the minus sign changes back to the plus sign.

Highlight Detail Decode Entries in Hex Window
When you select a field in the detail window, the hexadecimal values are highlighted in the hex decode window. You can easily identify pieces of a frame in the hex decode window by clicking on entries in the detail decode window.

Get Date and Time of Frame
To determine the date and time that a frame was captured, execute the following in the detail decode window:
1. | expand the first entry in the window, Physical Frame
2. | Frame Captured contains the date and the time in GMT (Greenwich Mean Time)

Right-click in Detail Decode Window
You can right click on the detail decode window to quickly access one of the following options:
1. | Create Detail trace report (.htm, .txt or .csv) | (see Reports > Detail Trace...)
2. | Copy packet to clipboard (detail and hex window views are copied) | (see Edit > Copy)
3. | Print Detail packet view | (see File > Print)

For more details, check out:
Edit > Copy
File > Print
Preferences > Preferences > Windows.
Reports > Detail Trace...


Windows > Hex Decode...

Hex Decode Window Command

To show or hide the Hex Decode Window, toggle either Windows > Hex Decode... or the hex decode window icon. To show or hide the hex decode window when LinkFerret starts, see Preferences > Preferences > Windows.

In the above picture LinkFerret has three windows open:
  1. brief decode window
  2. detail decode window
  3. hex decode window
Highlight Detail Decode Entries in Hex Window
Assume that a file has been read or that LinkFerret is capturing data to the screen. Also assume that the brief, detail and hex windows are visible in LinkFerret and execute the following:
1. | select a frame in the brief window
2. | note that the detail and hex windows have changed
3. | select a protocol field in the detail window
4. | see that the corresponding bytes in the hex window are highlighted

Right-click in Hex Decode Window
You can right click on the hex decode window to quickly access one of the following options:
1. | Create Hex trace report using the format .htm, .txt or .csv. See Reports > Hex Trace....
2. | Copy packet to clipboard, both the detail and hex window views are copied. See Edit > Copy.
3. | Print Hex packet view. See File > Print.

For more details, check out:
Edit > Copy
File > Print
Preferences > Preferences > Windows.
Reports > Hex Trace


Windows > Statistics

Statistics Window Command

To show or hide the Statistics Window, toggle either Windows > Statistics or the statistics window icon. To show or hide the statistics window when LinkFerret starts, see Preferences > Preferences > Windows.

Statistics Tabs
You select which graph or chart you are interested in via the statistics tabs located just below the statistics graph or chart. Use the arrows located in the left corner of the statistics tab bar to view all the tabs. The Statistics tab bar choices include:
Traffic Profile
Utilization Profile
Link Histogram
Packet Size
Capture Rate
Protocol Statistics
Host Statistics
Top Senders
Signal Quality
AP Discovery
Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out:
Preferences > Preferences > Windows.
Statistics pop-up window


 Windows > Statistics > Traffic Profile
click on picture to enlarge

Definition
The Traffic Profile is useful for spotting the frames, either broadcast, multicast or directed, that are causing heavy traffic on the LAN. The chart provides precise numbers and the graph provides a quick snapshot of the chart. Use the scrollbar at the bottom of the chart to view all the columns: type, count and percent.

Interpret Sample
The sample chart and graph indicate that the majority of traffic is comprised of directed frames. Multicast frames are utilizing very little of the line.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out Statistics pop-up window.


 Windows > Statistics > Utilization
click on picture to enlarge

Definition
The Utilization Profile provides information on activity generated within the last five seconds. By viewing the graph the network manager can determine if some software is flooding the network. Use the scrollbar at the bottom of the chart to view all the columns: type, count and percent.

Interpret Sample
Based on the sample chart and graph, the size of the frames must be fairly large since the current frame utilization is low but the byte utilization is higher.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out Statistics pop-up window.


 Windows > Statistics > Link Histogram
click on picture to enlarge

Definition
The Link Histogram provides information on activity generated within the last five seconds. The graph indicates how much of the link is being utilized. The greater number of frames sent within a given time, the higher the frame utilization. To increase frame utilization there must be many small frames on the line. To increase byte utilization the size of the frame must increase.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out Statistics pop-up window.


 Windows > Statistics > Packet Size
click on picture to enlarge

Definition
The packet size chart and graph counts the number of frames in each frame size bracket and the sum of all frames. The bar graph indicates the percentage of all frames is a given frame size.

Interpret Sample
In the example 29% of the frames were less than 150 bytes. 36% of the frames had between 150 and 299 bytes.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out Statistics pop-up window.


 Windows > Statistics > Capture Rate
click on picture to enlarge

Interpret Sample
From the example pie chart 258 frames were captured as indicated on the status bar. LinkFerret was able to acquire 246 frames (95% of the frames) and filtered 12 frames (5%).

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out:
Statistics pop-up window
status bar


 Windows > Statistics > Protocol Statistics
click on picture to enlarge

Definition
Protocol statistics displays three columns. One column is for the protocol name, the second and third columns are for the frames captured and bytes captured for the designated protocol. To have a protocol displayed requires the following conditions:
1. | The protocol has not been filtered out using Filters > Manage Link Filters...
2. | At least one frame containing the protocol was captured
Statistics will still be displayed for a protocol if it was disabled via the Filters > Display Filter....

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more details, check out:


 Windows > Statistics > Host Statistics
click on picture to enlarge

Definition
The Host Statistics Command displays the Host Statistics Counters which includes the number of frames and bytes transmitted and received by each host. The host name value is determined by the choices made in the Preferences > Preferences > Brief Display. Be aware that Source level filtering (see Filters Pop-up Menu) affects Host Statistics.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out:
Preferences > Preferences > Brief Display
Filters Pop-up Menu
Statistics pop-up window


 Windows > Statistics > Top Senders
click on picture to enlarge

Definition
The Top Senders Command displays the Top Ten Transmitters which includes the number of frames and bytes transmitted by the top ten hosts. The host name value is determined by the choices made in the Preferences > Preferences > Brief Display. Be aware that Source level filtering (see Filters Pop-up Menu) affects the statistics for this chart.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out:
Preferences > Preferences > Brief Display
Filters Pop-up Menu
Statistics pop-up window


 Windows > Statistics > Top Receivers
click on picture to enlarge

Definition
The Top Receivers Command displays the Top Ten Receivers which includes the number of frames and bytes received by the top ten hosts. The host name value is determined by the choices made in the Preferences > Preferences > Brief Display. Be aware that Source level filtering (see Filters Pop-up Menu) affects the statistics for this chart.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out:
Preferences > Preferences > Brief Display
Filters Pop-up Menu
Statistics pop-up window


 Windows > Statistics > Signal
click on picture to enlarge

Definition
The Signal Statistics graph indicates the signal strength of each channel being checked. Since more than one channel is being investigated, it is obvious that enable scan mode was set in Preferences > Preferences > Channels. The chart provides both the signal strenth and the signal quality for each channel.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out:
Preferences > Preferences > Channels
Statistics pop-up window


 Windows > Statistics > Speed
click on picture to enlarge

Definition
The Speed Statistics graph indicates the number of data bytes and data frames captured at different wireless speeds. For each speed the percentage of bytes and frames is based on all bytes and frames captured on all the wireless speeds. This graph is not valid when capturing frames on Ethernet.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out Statistics pop-up window.


 Windows > Statistics > Ap Discovery
click on picture to enlarge

Definition
The AP Discovery chart is useful if you have an infrastructure, as opposed to an ad hoc wireless network. The BSSID is the MAC address of the APs, access points. The ESSID is a text string used to identify each AP associated with the network.

Right-Click on Statistics Window
The statistics can be saved to a file, copied to a clipboard or printed by displaying the desired statistic, right-clicking the mouse button and then selecting the desired entry in the context menu (see Statistics pop-up window). The context menu does not appear if LinkFerret is capturing frames.

For more information, check out Statistics pop-up window.


 Help Pop-up Menu

The Help Pop-up Menu is located on the Menu Bar. The options on the pop-up menu include:
Help (F1) | Includes Getting Started... and all LinkFerret commands
Getting Started... | Quick tutorials on how to use LinkFerret
Tip of the Day... | When you select Tip of the Day, another tip is displayed
How do I... | This selection provides detailed tutorials with a lot of pictures
Baseband on the Web | Make sure that the Internet is available. If successful, you go to Baseband's LinkFerret web site.
LinkFerret on the Web | Make sure that the Internet is available. If successful, you go to LinkFerret's web page concerning the basic monitor.
Purchase LinkFerret | Make sure that the Internet is available. If successful, you go to LinkFerret's web page to purchase products.
Register LinkFerret | To register you must have purchased LinkFerret and received a serial number. The dialog box, Register the LinkFerret Network Monitoring Tool appears. Provide your name and serial number. Once you register, the annoying message at the beginning of execution disappears and this option also disappears.
About LinkFerret | This option displays About the LinkFerret Monitoring Tool ... dialog box. In the dialog box is the serial number (if you registered), who purchased LinkFerret and the version of LinkFerret. Included in this dialog box is how to contact us.


Help > Register LinkFerret Command

Help > Register LinkFerret

Register LinkFerret Command

When is this command available?
This command is only available when you have not provided a serial number to the LinkFerret Network Monitor. You receive a serial number after buying LinkFerret.

How do I purchase LinkFerret?
You can select the url in the dialog box and you will be taken to the "Buy" page on our site.

How do I get my user name and serial number?
After purchasing LinkFerret, your user name and serial number is e-mailed to you.


 Accelerator Keys

The following list includes all the accelerator keys in LinkFerret.
Key | Meaning | Reference
Ctrl+c | Copy a frame to the clipboard | Edit > Copy
Ctrl+f | Find a frame in the Brief Decode Window | Edit > Find...
Ctrl+g | Go to a frame in the Brief Decode Window | Edit > Go to Frame...
Ctrl+o | Open a capture file | File > Open...
Ctrl+p | Print captured frames | File > Print...
Ctrl+s | Save captured frames to a file | File > Save...
Ctrl+t | Transmit a frame | Transmit > Transmit a Frame
Delete | Clear capture buffer | Edit > Clear
F1 | Go to Help | Help > Help
F3 | Find next occurrence of the requested string | Edit > Find next


 LinkFerret File Associations dialog box

What does association mean?
When Windows Explorer is used to view files in a directory and the file is associated with LinkFerret, LinkFerret's icon appears next to the file name. If you double-click on the file, then LinkFerret is automatically executed.

When does this message occur
When LinkFerret begins execution, it checks if LinkFerret or another application is associated with trace files. If another application is associated with the files then the LinkFerret File Associations dialog box appears. The user must determine if LinkFerret or the other application should be associated with the files.

For more information about trace file formats, check File > Open or File > Save. To modify file associations while LinkFerret is running, check Preferences > Preferences > Startup.


Getting Started with LinkFerret

When you start LinkFerret is executed, you see a myriad of pop-up menus, icons and smaller windows. To learn how to use LinkFerret quickly, read through the following articles:

  • LinkFerret Window Elements
  • Start Capturing Frames
  • Start Analysis
  • Using the Name Space Table
  • Filtering
  • Setting up Alarms
  • Installing LinkFerret's Wireless Driver


Getting Started with LinkFerret

Congratulations on picking LinkFerret as your network monitoring solution. LinkFerret is both a fully functional Ethernet packet sniffer and a comprehensive 802.11b wireless network monitor, complete with all of the the essential functionality, including signal monitoring, channel scannning, and WEP decryption.

Although LinkFerret is easy to use, it is a sophisticated tool used to find solutions to complex problems. It will take a little bit of time to become familiar with all of the features provided and learn to completely access all of the powerful features provided. To help you get started, we have provided this brief introduction the first time that LinkFerret is executed. If you are ready to move on and start taking charge of your network now then just close this window. You can come back later and read more about LinkFerret. All of the information presented here is also available via the selections under the "Help" drop-down on the LinkFerret menu bar. If you would like to know a bit more right now about how LinkFerret works, then continue reading.

Important! If you are planning on using LinkFerret for wireless monitoring, then the first thing to do is install one of the LinkFerret wireless drivers. To find out how to set up your system, read about installing LinkFerret's wireless drivers. Please read carefully and be sure that you understand the instructions before proceeding. If you have any questions at all, contact us at support@linkferret.ws for quick answers on any questions you may have about how to configure your system.

When LinkFerret is executed, you are presented with a bewildering array of pop-up menus, icons and smaller windows. Click here for a brief description of what you will see on the screen when LinkFerret starts up.

Before you begin capturing data, you may be interested in learning how to create filters to refine your analysis or how to define alarms to notify you when specific events have occured. These are more advanced topics that may be skipped for now, but later on you will want to come back and read up on these features to learn how to get the most from your monitor.

At this point you are ready to start monitoring your network and analyzing the frames that you have captured.

This is just a quick overview of LinkFerret's features and functions. As you become more comfortable with your new monitor you will find that there are many more things that you can do with LinkFerret, and many ways of doing them. Use the program support system as you go along, not only the tutorials and other topics provided with the program, but also our online forum and of course email support is always available and always free. And now, it's time to put LinkFerret to work for you.


 LinkFerret MAPI Support dialog box

LinkFerret MAPI Support dialog box

What is MAPI?
MAPI is Messaging API and is provided by the email client software. Examples of email clients include Outlook Express and Eudora.

Why do I need it?
LinkFerret has a feature called alarms (see Setting up Alarms). You use alarms to monitor for an event. When the event occurs, then you can have the computer beep at you, flash the screen, execute a program or send you a message. If you want LinkFerret to send you a message, then you need email therefore you need MAPI.

What happens if I check the box?
Every time you start LinkFerret, it will check for MAPI support. If LinkFerret cannot find MAPI support, then this warning box will appear.

What if I don't check the box?
Good idea if you don't have MAPI support and don't want to see an annoying message every time you start up.

I unchecked the box. Now I have MAPI support. How do I tell LinkFerret?
Go to Preferences > Preferences > Startup and select Check for MAPI support.

For more information, check out:
Preferences > Preferences > Startup
Setting up Alarms - a quick overview


 Purchasing LinkFerret

Thankyou for purchasing LinkFerret Network Monitor. We offer several options for your convenience. If you like, you may purchase online at www.linkferret.ws. You will be redirected to a secure server to process your order. After we have received and processed your payment, an activation code will be sent to you usually within one business day.