Copyright: Copyright ® 1993-1999 WinWare Incorporated.


Addresses

The Addresses property page specifies one or more pairs of network addresses that you want included or excluded from the capture.

Organization of the Addresses Page

The Addresses Page consists of a grid with three columns:

•	The first node address

•	In which direction  the network traffic needs to flow between the two addresses in order for TracePlus to take an action.

•	The second node address

Excluding network addresses

By checking the option labeled Exclude these addresses, TracePlus will ignore traffic matching the address filters. The filter logic will change from "Include only these addresses" to "Include everything but these addresses".

Adding a network address filter

Right-clicking on the grid area will display the above menu. Select Add Address Filter from the popup menu.

Address entry formats

The network addresses that you can specify consist of three address types:

•	IP Addresses (displayed as 192.168.1.1, etc.). IP addresses If an IP address has been resolved to a hostname (as shown in the Network Names View), the hostname will appear as well.

•	IPX Addresses (displayed as 00-00-00-00:01-02-03-04-05-06, etc.).

•	MAC Addresses (displayed as 00:01:02:03:04:05, etc.).

NOTE: Addresses can be entered either by descriptive name (as described in the Network Names View) or as a discrete protocol address (such as 192.168.1.100).

Below the network address field(s) is displayed the decoded protocol address, which is useful when specifying a descriptive name in the address field, so that you can verify that the protocol address is the one you want.

A pair of addresses must be of the same address type.

Direction of Network traffic

One of the following three options can be specified in order to filter network traffic according to its source:

•	Bidirectional communication between node 1 and node 2, shown as (1 <-> 2.

•	Node 1 sending packets to node 2, shown as 1 -> 2.

•	Node 2 transmitting packets to node 1, shown as 2 -> 1.

Editing an address filter

Right-click on the desired address filter, then select Edit Address Filter from the popup menu.

Removing an address filter

Right-click on the desired address filter, then select Remove Address Filter from the popup menu.


Capture Settings

The Capture settings dialog appears when the Start button is pressed. It contains many options for refining the capture of network traffic.

Organization of the Capture Settings dialog

The Capture Settings dialog consists of five pages. Each page is represented by a tab above it. The pages are as follows:

•	Network address filters

•	Packet filters (filter on packet characteristics like size and type), and protocol filters (TCP, UDP, HTTP, FTP, IPX, etc.)

•	TCP and UDP port filters include or exclude packets with a specified port number.

•	Triggers to start a capture to start automatically when one or more conditions are met.

To bring up a specific page, click on the tab of the desired page. To rotate through the pages one at a time, press Ctrl+Tab.


Clear All Selections

This option clears the selection status of all packets in the Packets View.


Contents

Getting Started

Network Adapter Compatibility

Selecting an Network Adapter

Setting Display Options

Supported Network Protocols

The Network Dashboard

The Dashboard View

Network Statistics

The Bandwidth by Node View

The Conversations View

The History View

The Network Names View

The Network Statistics Window

The Nodes View

The Protocols View

The Sizes View

The Statistics View

Capturing Network Traffic

The Capture Window

Starting a Capture

Pausing and Continuing a Capture

Stopping a Capture

Saving the Capture

Viewing captured Packets

The Packets View

The Decoded Packet View

The Hex Packet View

The Data View

The IP Headers View

The TCP Headers View

Viewing captured Traffic Statistics

The Activity View

The Conversations View

The Nodes View

The Overview

The Packet Details View

The Protocols View

The Sizes View

The Statistics View

Reference

Keyboard

Toolbar

Index


Data

The Data Page specifies one or more data patterns that are used to accept or exclude a packet from being captured.

What is a data pattern?

A data pattern is a series of one or more bytes that is compared to the contents of a packet at a specific location within the packet.

For performance reasons, the packet is not searched from beginning to end, rather, the comparison is made at the location you specify. This implies that you will know approximately what you are looking for ahead of time.

A data pattern can be represented visually in one of three formats:

•	Hexidecimal - One or more hexidecimal bytes with the length specified.

•	ASCII String - A series of one or more words. The comparison will end with the last character of the last word.

•	Value - Can be numeric or hexidecimal. Values come in three sizes: 8 bit (byte), 16 bit (word), and 32 bit (double word)

Types of data pattern comparisons

You specify a type of logic to be used when comparing a data pattern to bytes in a packet. Hex and ASCII strings have two types of comparisons available:

•	Bytes are equal to the specified pattern.

•	Bytes are not equal to the specified pattern.

Numeric values have a wider variety of comparisons available, including the ability to test if specific bits are turned on or off. Types of numeric comparisons include:

•	Bytes are equal to the specified value.

•	Bytes are not equal to the specified value.

•	Bytes are greater than the specified value.

•	Bytes are less than the specified value.

•	The result of ANDing Bytes and specified value is non-zero.

•	The result of ANDing Bytes and specified value is zero.

The number of bytes used in the comparison is governed by the size of the value being compared.

Organization of the Data Page

The Data Page consists of a grid with seven columns:

•	Type of value being compared.

•	Description of the data pattern.

•	General location where the comparison takes place.

•	Relative offset in bytes from the specified location.

•	Logic used when performing the comparison.

•	Size of the value (specified in bytes for hex and ASCII strings, otherwise specified as number of bits)

•	Visual representation of the value.

Adding a Data pattern

Right-click on the desired address filter, then select Edit Address Filter from the popup menu. The Data Pattern dialog box will appear.

Each data pattern has a description that cannot be blank.

Choose the general location where the comparison is to take place. The following locations are predefined:

Start of packet	LLC header	TCP header
IP header	NetBIOS header	UDP header
IPX header	SMB header	Start of user data

Predefined locations work correctly regardless of the underlying Ethernet frame type of the packet.

Following the general location, you can specify a byte offset relative to that location.

Specifying a hex string

Hex values are entered using the above grid. You can type over the hexidecimal zeroes with your own values. To right of the grid will appear the ASCII interpretation of the individual bytes. You can use the cursor keys to navigate from one byte to another.

The Hex Size field increases or decreases the number of bytes included in the comparision.

Specifying an ASCII string

String values consist of one or more characters, optionally separated by spaces. A string can be up to 32 bytes in length.

Specifying a numeric value

Values come in three sizes: 8 bit (byte), 16 bit (word), and 32 bit (double word). By changing the Data Type field, you can choose to enter a numeric value as hexidecimal instead of base 10 format.

Set the Data Type of a value to hexidecimal to ease the entry of a value if you intend to use the value as a mask.

You can specify the order in which the bytes appear that make up the value. For example, Microsoft SMB packets use numeric values stored in little-endian, or Intel byte order. You would want to uncheck the Compare using network byte order option in order for the comparison to be done correctly.ragraph

Editing a Data pattern

Right-click on the desired address filter, then select Edit Data Pattern from the popup menu.

Removing a Data pattern

Right-click on the desired address filter, then select Remove Data Pattern from the popup menu.


Data View Settings

The Data View Settings page specifies parameters which are used to create the Data View while a packet capture is running.

Protocols

For efficiency reasons, the Data View is limited to displaying a specific subset of protocols. The selected protocol subset can be changed while a packet capture is running. Following is the list of protocol subsets that are available:

•	TCP and UDP protocols

•	Novell IPX and SPX protocols

•	IBM NetBIOS (NetBEUI) protocol

•	All protocols other than these three

Packet Options

If it is necessary to reduce the volume of data being displayed in the Data View, you can limit the amount of data displayed in the Data View by specifying one of the following options:

•	Display all packets (up to 8192 bytes)

•	Display up to a specific number of bytes

•	Display the packet size if the packet exceeds a specific number of bytes

Display Formatting

You can adjust the formatting of the data being displayed in the Data View by specifying one of the following options:

•	Automatic - Packets containing all ASCII (printable) bytes will be formatted using the embedded carriage returns and line feeds. If the packet is not entirely ASCII, then the packet will be formatted as a hex dump.

•	Hex/ASCII - The packet is displayed entirely as a hex dump with ASCII conversions on the right side.

•	ASCII packets only - Packets containing all ASCII (printable) bytes will be formatted using the embedded carriage returns and line feeds. If the packet is not entirely ASCII, then the packet will be skipped.

TIP: This option can be changed in realtime. However packets displayed in the Data View before this option is changed will retain their previously specified formatting.

Grid Options

The number of lines displayed in the Data View can be adjusted using the following option:

•	Buffer Size - Tthe maximum number of lines displayed in the Data View. Keep in mind that the more lines you specify, the more memory is allocated to hold the line information.


Disable Loopback

This option filters out packets generated from the local workstation. The source of a packet is determined by the MAC address specified in the packet itself.

Note that this option ignores packets only on the current selected network adapter. If you have more than one network adapter installed in your PC, then packets from the other network adapter(s) will still be seen by TracePlus.


Disable Sorting of Views

When monitoring one or more specific items in the Protocol View, Nodes View, or Conversations View, the automatic sorting of items in the View may cause the items you are monitoring to shift in position within the View.

In order to prevent this, ensure that this option is checked. If so, the items in the aforementioned Views will not be sorted again until you uncheck this option.


Display Options

The Display Options property sheet contains parameter pages which effect the display of network information in TracePlus.

There are two sets of parameters available:

•	Data View Options - Parameters that effect the formatting of packets in the Data View (this view is available when a capture either started or loaded from disk).

•	Protocol Colors - Specify colors for specific network protocols. The packet information will be displayed using this color in the Packets View (this view is available when a capture either started or loaded from disk).


Filter Profiles

Filter Profiles

Filter Profiles are a powerful way of storing your favorite capture settings for use in other capture sessions. Each profile can be named, and up to thirty two (32) profiles can be created.

TIP: The profile labeled "(default)" will automatically maintain capture settings from the previous capture session without pressing the Save button.

There are two actions that can be performed on Filter Profiles:

•	Save Filter Profile

•	Delete Filter Profile


Find

The Find feature locates a single packet containing the specified text. It is implemented in such a way that all columns in the grid being searched are treated as text.

For example, specific network addresses can be located simply by typing the address exactly as you would see it in the grid, like the screenshot above.

You can specify a case-sensitive search by checking the option Match case.

You can search forwards or backwards in the grid by selecting either Up (forwards), or Down (backwards).


General Settings

This property page specifies basic operational characteristics of the new capture window.

Output Options

This specifies whether you want to create a capture file on disk at the same time the capture file is running.

•	Display on screen only

•	Write to file and display on screen

•	Limit file size to specified number of megabytes

Use the File and Screen option when you want to capture more than the maximum buffer size of 32768K . You specify a Circular capture buffer, then select File and Screen to generate a capture file at the same time. The Circular buffer will display the last x amount of packets, however the capture file will store all packets placed in the buffer.

Display Options

The following options effect certain characteristics of the TracePlus application window when a trace is started:

•	Minimize the TracePlus application window when a capture is started

•	Stop capture when TracePlus is activated.

•	Place the TracePlus application window on top of all other windows.

Buffer Options

The size and type of the capture buffer are specified by the following options.

•	Buffer size can be specified from 1024K to 32768K in 1024K increments.

•	A Circular buffer always displays last x number of packets, where x is defined as BUFFER_SIZE/2048 bytes. For example a buffer size of 4096K can hold up to 2048 packets. In this mode, the capture will run continuously until you manually stop the capture.

•	A Fixed buffer allocates packets more efficiently than the circular buffer, but the capture will stop automatically when the selected buffer size has been reached.

•	Store Packet Headers only will save memory by storing only the protocol headers (not the subprotocol data) according to a predefined criteria..

The criteria used by TracePlus when storing packet headers or the complete packet is as follows:

1.	if the packet is IP, and not TCP or UDP, store the entire packet

2.	If the packet is TCP - Both IP and TCP headers stored.

3.	If the packet is UDP - Both IP and UDP headers stored.

•	If the packet is IPX - IPX Headers are stored.

•	If the packet is IPX/SPX - Both IPX and SPX headers are stored

Any other network protocols not mentioned here will be stored in the same format that they were received.

Output File Path

This specifies the default location on disk where TracePlus will save capture files generated when the Output option File and Screen is specified.

•	Path

•	The Machine Name is the default Computer name as specified by Windows. This field is not editable.

NOTE: The path can be altered when TracePlus prompts you for the name of the capture file.


Hide all but Selected

This option will remove all packets except currently selected packets from the Packets View.

TIP: This option is non-destructive, meaning that the packets still exist in the capture buffer, they are merely flagged as "non-visible"

You can use the Unhide All feature on the Edit menu to make visible the previously hidden packets.


Hide Selected

This option will remove all selected packets from the Packets View.

TIP: This option is non-destructive, meaning that the packets still exist in the capture buffer, they are merely flagged as "non-visible"

You can use the Unhide All feature on the Edit menu to make visible the previously hidden packets.


Index

A

Addresses

C

Capture Settings

Clear All Selections

Contents

D

Data

Data View Settings

Disable Loopback

Disable Sorting of Views

Display Options

F

Filter Profiles

Find

G

General Settings

H

Hide all but Selected

Hide Selected

I

Invert Selection

K

Keyboard

M

Move to First

Move to Last

Move to Next

Move to Previous

N

Network Adapter Compatibility

O

Open

P

Packets and Protocols

Pause

Print

Print Preview

Print Setup

Protocol Colors

R

Reset Network Statistics

S

Save As

Save as HTML

Save as Tab Delimited

Save Selected

Scroll while Capturing

Select All

Select Network Adapter

Select using Filter

Start

Stop

Supported Network Protocols

T

TCP_UDP Ports

TCP_UDP Protocol Definitions

The Activity View

The Bandwidth by Node View

The Bandwidth by Protocol View

The Capture Window

The Conversations View

The Dashboard View

The Data View

The Decoded Packet View

The Hex Packet View

The History View

The IP Headers View

The Network Names View

The Network Statistics Window

The Nodes View

The Overview

The Packet Details View

The Packets View

The Protocols View

The Sizes View

The Statistics View

The TCP Headers View

Toolbar

Triggers

U

Unhide All


Invert Selection

This option will flip the selection status of all packets in the Packets View.

•	Packets that are currently selected will be selected.

•	Packets that are not selected will be selected.


Keyboard

Select all packets in the active Capture view	Ctrl+A
Hide all but packets in the active Capture view	Ctrl+B
Copy selected items to the Clipboard	Ctrl+C
Define display options for the Capture window	Ctrl+D
Find the specified text in the active Capture view	Ctrl+F
Hide all selected packets in the active Capture view	Ctrl+H
Specify a Network Adapter as the source of packets	Ctrl+N
Open an existing packet file (.TDF) from disk	Ctrl+O
Print the active window or view	Ctrl+P
Save the active Capture Window as an .TPF file	Ctrl+S
Define TCP/IP protocols and associated port numbers	Ctrl+T
Unhide all hidden packets in the active Capture view	Ctrl+U
Clear all views in the Network Statistics window	Del
Activate online Help for the active window or view	F1
Move to the previous packet in the active Capture view	F2
Move to next packet in the active Capture view	F3
Move to the first packet in the active Capture view	F4
Move to the last packet in the active Capture view	F5
Creates a new Capture Window and starts capturing packets	F6
Switch to the next pane	F6 (within a splitter window)
Switch to the previous pane	Shift+F6 (within a splitter window)
Switch between active Windows	Ctrl+F6
Stops the capture in the active Capture window	F7
Pauses (and restarts) the capture in the active Capture window	F8
Change packet filters for the active Capture window	F9


Move to First

This option sets the Packet Details View to display the first packet available in the capture buffer


Move to Last

This option sets the Packet Details View to display the last packet available in the capture buffer


Move to Next

This option sets the Packet Details View to display the next packet available in the capture buffer (in relation to the currently visible packet).


Move to Previous

This option sets the Packet Details View to display the previous packet available in the capture buffer (in relation to the currently visible packet).


Network Adapter Compatibility

In theory, any Ethernet adapter whose drivers support NDIS 3 or higher should work. However, due to the wide variety of quality in network drivers, your mileage may vary.

Network Speeds

Any network speed between 10 MIPS and 100 MIPS are supported.

3COM 3C90x series

The Windows NT 3C905 NDIS adapter driver from the Microsoft Windows NT
distribution CD (el90x.sys) does not work with NDIS intermediate drivers. It
fails the NidsIMInitializeDeviceInstance call with error 0xC0000001. The
Windows NT 3C905 NDIS adapter driver from the 3Com site (el90xnd4.sys) works OK.

NOTE: Please insure that you have disabled the 3Com dRMON
SmartAgent PC Software. This applies to all Windows platforms, not just Windows NT.


Open
Open (Saved Packets)

Open displays a dialog box from which you can select an existing capture file  from disk. A new capture window will be created, encapsulating the contents of the capture file.

Supported file formats

TracePlus/Ethernet can import (open) packet capture files from the following applications:

Packet Analyzer/File Format	File Extension	Platforms
TracePlus	.TPF	Windows 98/ME, NT 4.x/2000/XP
libpcap	.PCAP	Unix, Linux, AIX, Windows
Etherpeek	.PKT	MAC OS, Windows
Microsoft Network Monitor	.CAP	Windows NT/2000/XP
Network Associates Sniffer (uncompressed)	.ENC	DOS/Windows
Novell LANalyzer	.TR1	DOS/Windows
Sun Microsystems snoop	N/A	Solaris
tcpdump	N/A	Unix, Linux


Packets and Protocols

The Packets and Protocols page specifies various low-level criteria by which TracePlus determines which packets can be captured, specifically the physical characteristics of the packet itself.

Organization of the Packets and Protocols Page

The Packets and Protocols page consists of four sections, each section representing a specific criteria:

•	Network Protocols

•	Frame Types

•	Packet Sizes (predefined)

•	Packet Size (user defined)

The filtering technique is additive, meaning that all filters must be satisfied before a packet will be captured.

Network Protocols

Packets will be captured if the packet contains one of the selected network protocols.

NOTE: If the packet is a protocol not selected from this list, the packet will not be captured.

Frame Types

Select the desired frame type of the packets you want to capture.

Packet Sizes (predefined)

Select a range of packet sizes to be captured. There is also a super-category called Packet Types, which are as follows:

•	Normal packets are between 60 bytes and the maximum Ethernet frame size, which is 1514 bytes.

•	Oversized packets are packets that are greater than 1500 bytes in length.

•	Undersized packets are packets that are less than 60 bytes in length.

There is also an option to specify a user defined range of packet sizes (later in this section).

Packet Sizes (user defined)

If you select the item User defined from the list of Packet Sizes, this option will be enabled. You can specify a range of packet sizes from 14 to 1514 bytes.

Filter Profiles

Filter Profiles are a powerful way of storing your favorite capture settings for use in other capture sessions. Each profile can be named, and up to twenty profiles can be created.

TIP: The profile labeled "(default)" will automatically maintain capture settings from the previous capture session without pressing the Save button.

There are two actions that can be performed on Filter Profiles:

•	Save Filter Profile

•	Delete Filter Profile


Pause

The Pause button holds a capture in a suspended state, meaning no more network traffic will be stored in the capture buffer.

The Pause button has two visible states:

•	Up - Suspend has not been activated.

•	Down - The capture is suspended.

When the Pause button is down, the suspended state can be resumed by pressing the Pause button a second time.


Print
Print (Current View)

Print the contents of the current view.


Print Preview
Print Preview (Current View)

Preview the printed version of the current view.


Print Setup

The Print Setup dialog box lets you change the default printer (for this application only), as well as specify advanced printer settings.

NOTE: This dialog box may vary in appearance depending on the Windows platform you are using and the printer drivers you have installed.


Protocol Colors

The Protocol Colors page gives you the option of assigning different colors for each network protocol.

Packet summary information in the Packets View will be displayed in the colors that you select here.

Right-clicking on a protocol name (the first column) will display the color picker window. The default color selected for the protocol appears at the top of the window. You can select one of twenty predefined colors, or you can click on the word Custom to display a standard Windows color dialog box.


Reset Network Statistics

This option performs one or both of the following functions:

•	Reset all statistics displayed in the Network Statistics View.

•	Reset the Network Names View.

TIP: The Network Names View is valuable for resolving network addresses to a more easily understandable equivalent. We suggest that you only reset this View if it is really necessary.


Save As

Save the contents of the current capture window to a file with a .TPF extension.

NOTE: In order to save a capture, the capture must be stopped.


Save as HTML
Save as HTML (Current View)

Saves the current view as a HTML document.

NOTE: This option is not available for all views.


Save as Tab Delimited
Save as Tab Delimited (Current View)

Saves the current view as a tab delimited (ASCII character 9) text file. Each field in separated by a tab.

NOTE: This option is not available for all views.


Save Selected

Saves the packets selected in the Packets View to a file with a .TPF extension.

TIP: Use the option Select using Filter to select all packets of a specific type.


Scroll while Capturing

This option determines whether the following views scroll automatically to the last packet in the view while a capture is running:

•	The Packets View

•	The Data View

•	The IP Headers View

•	The TCP Headers View

If the option is checked, the aforementioned views will scroll automatically.


Select All

Highlights all packets displayed in the Packets View.


Select Network Adapter

If you have multiple network adapters in your PC, you can switch between them by selecting this optoin.

Organization of the Select Network Adapter dialog box

The dialog box displays a list of network adapters obtained from the system registry.

NOTE: If you are running Windows NT/2000/XP, network adapters marked as hidden in the system registry will not appear in this list. This function is by design, and prevents the selection of network adapters that are not compatible with TracePlus.

Above the list of network adapters is displayed summary information for the currently selected network adapter.

Selecting a network adapter

To select a different network adapter, there are two different procedures:

•	Double-click on the desired network adapter in the list. The dialog will close automatically.

•	Single-click on the desired network adapter in the list, then press Ok.

NOTE: The existing Global Statistics Window will be closed, then reopened, thus resetting all statistics to zero. The Global Statistics are accumulated for a single network adapter only.


Select using Filter

The Select using Filter option will highlight all packets in the Packets View by one or more of the following criteria:

Organization of the Select using Filter dialog box

The Select using Filter dialog box consists of four sections, each section representing a specific criteria:

•	Frame Types

•	Packet Sizes (predefined)

•	Network Protocols

•	Packet Size (user defined)

The filtering technique is additive, meaning that all filters must be satisfied before a packet will be selected.

TIP: Select using Filter is useful for creating a capture file containing only packets of a specific protocol type. After selecting your criteria and pressing Ok to select the desired packets, use the option Save selected packets to create a new capture file.

Frame Types

Select the desired frame type of the packet you want to highlight.

Packet Sizes (predefined)

Select a range of packet sizes to be highlighted. There is also a super-category called Packet Types, the meaning of which is as follows:

•	Normal packets are between 60 bytes and the maximum Ethernet frame size, which is 1514 bytes.

•	Oversized packets are packets that are greater than 1500 bytes in length.

•	Undersized packets are packets that are less than 60 bytes in length.

There is also an option to specify a user defined range of packet sizes (later in this section).

Network Protocols

Packets can be highlighted if the packet contains one of the selected network protocols.

NOTE: If the packet is a protocol not selected from this list, the packet will not be highlighted.

Packet Size (user defined)

If you select the item User defined from the list of Packet Sizes, this option will be enabled. You can specify a range of packet sizes from 14 to 1514 bytes.


Start

Pressing the Start button begins the process of capturing network traffic.

Capture Settings

The Capture settings dialog appears when the Start button is pressed. It contains many options for refining the capture of network traffic.

Organization of the Capture Settings dialog

The Capture Settings dialog consists of five pages. Each page is represented by a tab above it. The pages are as follows:

•	Capture buffer characteristics, window settings, and capture to file options.

The Capture Settings dialog consists of five pages. Each page is represented by a tab above it. The pages are as follows:

•	Network address filters

•	Packet filters (filter on packet characteristics like size and type), and protocol filters (TCP, UDP, HTTP, FTP, IPX, etc.)

•	TCP and UDP port filters include or exclude packets with a specified port number.

•	Triggers to start a capture to start automatically when one or more conditions are met.

To bring up a specific page, click on the tab of the desired page. To rotate through the pages one at a time, press Ctrl+Tab.

Filter Profiles

Filter Profiles are a powerful way of storing your favorite capture settings for use in other capture sessions. Each profile can be named, and up to twenty profiles can be created.

TIP: The profile labeled "(default)" will automatically maintain capture settings from the previous capture session without pressing the Save button.

There are two actions that can be performed on Filter Profiles:

•	Save Filter Profile

•	Delete Filter Profile


Stop

The Stop button halts the capture of network traffic.

NOTE: In order to save a capture, you must stop the capture first.


Supported Network Protocols

In general, TracePlus can display any packet as long as it is in one of the four Ethernet frame types specified below.

Ifa protocol is listed here, all offical versions of that protocol are supported, unless otherwise noted.

ASCII based protocols such as FTP, HTTP, POP, etc. are noted as "full packet decodes" because TracePlus will display the formatted ASCII data "as-is" in the Decoded Packet View.

Ethernet Frame Types

802.1Q/802.1P

802.2*

802.3*

Ethernet II*

Ethernet SNAP*

Layer 2 Protocols

LLC (Link Layer Control)*

SNAP*

Layer 3 Protocols

AppleTalk*

AppleTalk AARP*

ARP*

Bridge Spanning Tree*

Cisco Discovery Protocol

Cisco Group Management Protocol

Configuration Test Protocol*

IP (Internet Protocol)*

IPX (Internetwork Packet eXchange)*

NetBIOS*

RARP*

IP sub-protocols

DVMRP

EGP

GGP

ICMP*

IGMP*

IGRP*

EIGRP*

IGP

OSPF*

TCP*

UDP*

TCP Protocols

FTP*

IMAP*

HTTP*

IRC*

NNTP*

POP*

SMTP*

Telnet*

Any other packets on any port number

UDP Protocols

BOOTP*

DHCP*

DNS*

NetBIOS Name*

NetBIOS Datagram*

NetBIOS Session*

OSPF*

RIP*

SNMP*

SNMP Traps*

TFTP

Any other packets on any port number

IPX Protocols

IPXWAN

NCP*

NDS

NetBIOS*

NLSP*

NMPI

Ping

RIP*

SAP*

Serialization

SNMP

SNMP Traps

SPX*

Any other packets on any socket number

NetBIOS protocols

NetBEUI*

SMB*

AppleTalk Protocols

AppleTalk AARP

DDP

A protocol marked with an asterisk ("*") indicates that a detailed packet decode is provided.


TCP_UDP Protocol Definitions
TCP/UDP Protocol Definitions

You can define a TCP or UDP protocol used on your network by specifying the port numbers and protocols used. The name you give the protocol will be used to identify the protocol in the various views.

Right-clicking on the grid will produce the menu above, from which you can add, edit or remove protocols from the grid.

Adding a Protocol Definition

A protocol definition consists of the protocol name, plus one or more port and protocol specifications.

Port Definitions

At least one port and protocol must be specified. According to TCP/IP specifications, a port number can be between 1 and 65535.

Editing a Protocol Definition

To edit a protocol definition, you can use one of the following procedures:

•	Right-click on the protocol, then select Edit Protocol Definition.

•	Double-click on the protocol.

Removing a Protocol  Definition

To remove an existing protocol definition, right-click on the protocol, then select Remove Protocol Definition.


TCP_UDP Ports
TCP/UDP Ports

This page defines a set of TCP and/or UDP ports which TracePlus will either include or exclude from the capture. Up to four sets of ports can be defined.

Organization of the TCP/UDP Ports Page

The TCP/UDP Ports page consists of a grid with nine columns:

•	The protocol name for the following port specifications

•	Port number 1

•	IP Protocol of port number 1

The following columns are optional, if the protocol definition includes more than one port, or uses the same port for both TCP and UDP:

•	Port number 2

•	IP Protocol of port number 2

•	Port number 3

•	IP Protocol of port number 3

•	Port number 4

•	IP Protocol of port number 4

Excluding TCP/UDP ports

By checking the optioni labeled Exclude these ports, TracePlus will ignore TCP and UDP traffic whose port(s) match the port filters. The filter logic will change from "Include only these ports" to "Include everything but these ports".

Adding a TCP/UDP port filter

A protocol definition consists of the protocol name, plus one or more port and protocol specifications.

Port Definitions

At least one port and protocol must be specified. According to TCP/IP specifications, a port number can be between 1 and 65535.

Editing a TCP/UDP port filter

To edit a protocol definition, you can use one of the following procedures:

•	Right-click on the protocol, then select Edit Port Filter.

•	Double-click on the protocol.

Removing a TCP/UDP port filter

To remove an existing protocol definition, right-click on the protocol, then select Remove Port Filter.


The Activity View

The Activity View displays a real time graph depicting various network statistics. The graph is updated every two seconds. When the chart is updated the previous data points are scrolled to the left.

NOTE: The Activity view is not available if the capture buffer was created from a file.

Chart Types

There three chart types to select from:

•	Packets per Second

•	Bytes per Second

•	Utiltization

The type of chart you select will be remembered by TracePlus the next time you use it.

Each chart type can be printed (in color if you have a color printer) by selecting Print from the File menu.

TIP: You can change chart types by right clicking on the chart itself, and selecting a different chart type from the popup menu.

Frame Types

Each chart type displays statistics for three different frame types simultaneously:

•	Unicast packets

•	Broadcast packets

•	Multicast packets


The Bandwidth by Node View
The Bandwith by Node View

The Bandwidth by Node View displays a list of the top addresses (AppleTalk, IP, IPX, and MAC) that are using the most bandwidth based on the wire speed of the selected network adapter.

The percentage of bandwidth is calculated as follows

1.	[Octets per second] = [total octets per node] / [number of seconds]

2.	[Bandwidth] = ( [Octets per second] * 8 ) / [wire speed] * 100.0

The data for this graph is derived from the Nodes View.

Chart Format

The chart is arranged as a horizontal bar chart, with the percentage of bandwidth displayed on the X axis, and the network address specified on the Y axis.

A scrollbar appears on the right if there are more nodes in the graph that cannot fit within the window.

Sort order of chart elements

The Y axis is sorted according to the amount of bandwidth calculated for the specified node. Nodes consuming more bandwidth appear towards the bottom of the chart.

The chart is resorted automatically every 6 seconds.


The Bandwidth by Protocol View
The Bandwith by Protocol View

The Bandwidth by Node View displays a list of the top protocols (AppleTalk, IP, IPX, and MAC) that are using the most bandwidth based on the wire speed of the selected network adapter.

For TCP and UDP protocols, if the protocol is not found in the internal database, then the protocol will placed in one of the following categories:

•	IP TCP (uncategorized)

•	IP UDP (uncategorized)

The percentage of bandwidth is calculated as follows

1.	[Octets per second] = [total octets per node] / [number of seconds]

2.	[Bandwidth] = ( [Octets per second] * 8 ) / [wire speed] * 100.0

The data for this graph is derived from the Protocol View.

Chart Format

The chart is arranged as a horizontal bar chart, with the percentage of bandwidth displayed on the X axis, and the network address specified on the Y axis.

A scrollbar appears on the right if there are more protocols in the graph that cannot fit within the window.

Sort order of chart elements

The Y axis is sorted according to the amount of bandwidth calculated for the specified protocol. Protocols consuming more bandwidth appear towards the bottom of the chart.

The chart is resorted automatically every 6 seconds.


The Overview

The Overview displays a realtime summary of the capture. If the capture is loaded from a file, this information is static (nonchanging), otherwise it is updated each second in realtime.

Organization of the Overview

The Overview consists of two sections:

•	On the right is displayed summary information about the capture such as start time, duration, total packets captured, total packets seen, etc.

•	On the left is a graphical representation of the current state of the capture buffer.

Summary Information

This section of the Overview displays realtime information about the contents of the capture buffer. The following statistics are available:

•	Number of packets saved in the capture buffer

•	Number of bytes saved in the capture buffer

•	Number of packets seen (includes packets not saved in the capture buffer due to filtering).

•	Number of bytes seen (includes bytes not saved in the capture buffer due to filtering).

•	Absolute time when the capture was started.

•	Elapsed time that capture has been running in the format hours:minutes:seconds.

•	Buffer size in kilobytes

NOTE: If you specified a circular buffer on the General Settings page, a fixed size of 2048 bytes will be allocated for each packet.

Protocol Capture Statistics

This section of the Overview displays the bytes captured and percentage of capture buffer utilized categorized by the most common network protocols. It is organized as a grid with three columns:

•	The name of the network protocol

•	The total number of bytes (accumulated packet sizes) saved in the capture buffer related to this protocol.

•	The percentage of total bytes saved in the capture buffer.


The Capture Window

This window appears when one of two functions is initiated:

•	Starting a Capture (by pressing the Start button on the toolbar)

•	Loading a packet file (.TPF) from disk

Organization of the Capture Window

The Capture Window consists of a splitter window, which means that the window is split into two panes.

The bar between the panes can be grabbed with the mouse and adjusted so that one pane can be larger than the other.

Upper Pane

The upper pane displays the contents of the Capture buffer in various formats: It contains the following views:

•	Packets View

•	Data View

•	IP Headers View

•	TCP Headers View

To display a specific view, use the mouse to single-click on one of the tabs lining the bottom of the window. Appearing on the tab is the name of the view associated with that tab.

Lower Pane

The lower pane displays summary statistics of the Capture in various formats. It contains the following views:

•	Capture Statistics View

•	Packet Details View

•	Sizes View

•	Protocols View

•	Nodes View

•	Conversations View

•	Activity View

NOTE: The Activity view is not available if the capture buffer was loaded from a .TPF file on disk.

The IP Headers View and TCP Headers View will not appear if the capture buffer was loaded from a .TPF file on disk, and the capture buffer does not contain IP or TCP/IP packets, respectively.


The Conversations View

The Conversations View displays summary statistics of packets seen organized by the pairs of network addresses involved in a exchange of packets. The pairs of addresses are sorted by the network protocol involved in the exchange.

Capacity of the Conversations View

The Conversations View holds up to 5000 records. When the View is full, each new record will cause the oldest record to be deleted. For example, the total number of records can be 6500, yet only records 1501 through 6500 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Address Display Formats

A node address is the high level protocol address as recognized by TracePlus. If TracePlus cannot decode the protocol address, the MAC address is used instead.

The following protocols have uniquely formatted addresses:

•	IP Addresses (displayed as 192.168.1.1, etc.). If an IP address has been resolved to a hostname (as shown in the Network Names View), the hostname will appear as well.

•	IPX Addresses (displayed as 00-00-00-00:01-02-03-04-05-06, etc.)

•	MAC Addresses (displayed as 00:01:02:03:04:05, etc.).

Organization of the Conversations View

The Conversations View is configured as a grid with 15 columns:

•	Protocol description

•	Node 1

•	Node 2

The following 3 columns represent the number of total packets sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 3 columns represent the number of total bytes sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 6 columns represent the number of total packets per node (sent+received) classified by packet size:

•	0-64 bytes

•	65-127 bytes

•	128-255 bytes

•	256-511 bytes

•	512-1023 bytes

•	Packet sizes 1024 bytes or greater

The following two columns display the first and last timestamps for a particular node address.

•	First - The timestamp when the first packet containing this node address was seen.

•	Last - The timestamp of the last packet containing this node address was seen.

802.1P/802.1Q VLANs

If the packet has a Ethernet type of 0x8100 (802.1Q/802.1P), the protocol description will be suffixed with the phrase "[VLAN: n]", where n is a number from 0 to 4095.

Sorting on a specific column

The grid can be reorganized by clicking on the header of the column to sort the grid according to the value in that column. The sort order will alternate between ascending and descending each time the column header is clicked.

If you are sorting by protocol address, the addresses will be sorted first by protocol (IP, MAC/NetBIOS/AppleTalk, IPX), then by actual address.

As of version 1.17.000, the grid is resorted by the specified column and sort order automatically every 6 seconds.

Timestamps

The timestamps in the last two columns of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Dashboard View

The Dashboard View provides a graphical means of monitoring statistics for various protocols in realtime.

The dashboard concept is analogous to an automobile dashboard.

Organization of the Dashboard View

The Dashboard View consists of seven circular gauges, grouped as a column of three  gauges, and another set of four gauges to the right. The second set of gauges are configurable by the user.

The effective range of all gauges can be adjusted by right-clicking anywhere on the dashboard and selecting Dashboard Settings.

Predefined Gauges

The predefined gauges represent three common indicators of network performance:

•	Packets per second, up to a maximum of 1,000,000 packets per second.

•	Bytes per second, up to a maximum of 12,500,000 bytes per second (equivalent to a rate of 100 MBits/second).

•	Bandwith utilization, expressed as a percentage of the maximum theoretical bandwidth, as reported by the network adapter. Commonly, this would be either 10 MBits/second, or 100 MBits/second.

User-defined Gauges

User-defined gauges display protocol traffic measured in bytes per second. You can assign which protocol is measured to each of the four gauges. The maximum range that can be measured is 12,500,000 bytes per second.

Changing Dashboard settings

Dashboard settings can be viewed by right-clicking on the Dashboard View, and selecting Dashboard Settings.This is where you can specifiy throttle settings for each gauge individually, and assign a protocol to each of the four vertical gauges.

Predefined Gauge ranges

You can select the maximum bytes per second displayed by each of the gauges. This value is expressed as a percentage of the absolute maximum range for that gauge.

Packets per second has a maximum range of 1,000,000 packets, or 100%. Therefore 20% would be equivalent to 40,000 packets.

Bytes per second has a maximum range of 12,500,000 bytes, or 100%. Therefore 40% would be equivalent to 6,000,000 bytes per second

Utilization has a a maximum range of 100% (either 10 MBits/second or 100 MBits/second, depending on your network card. Therefore 40% would be equivalent to either 4 MBits/second or 40 MBits/second, respectively.

User-defined Gauge assignments

As stated previously, the user-defined gauges consist of the four gauges to the right of the three predefined gauges. Here you can choose one of the preset protocols to monitor.

You can select the maximum bytes per second displayed by each of the gauges. This value is expressed as a percentage of the absolute maximum range for that gauge.

The maximum range for each of the user-defined gauges is 12,500,000 bytes per second, or 100%. For example, selecting 50% is equivalent to 6,250,000 bytes per second.

The Activity View

The Activity View displays a real time graph depicting various network statistics. The graph is updated every two seconds. When the chart is updated the previous data points are scrolled to the left.

Chart Types

There three chart types to select from:

•	Packets per Second

•	Bytes per Second

•	Utiltization

The type of chart you select will be remembered by TracePlus the next time you use it.

Each chart type can be printed (in color if you have a color printer) by selecting Print from the File menu.

TIP: You can change chart types by right clicking on the chart itself, and selecting a different chart type from the popup menu.

Frame Types

Each chart type displays statistics for three different frame types simultaneously:

•	Unicast packets

•	Broadcast packets

•	Multicast packets


The Data View

The Data View displays the contents of the data portion of the following protocols:

•	TCP and UDP

•	IPX and SPX

•	NetBEUI (also known as NetBIOS)

•	Other protocols

The packets appear as one or more lines within the grid. The formatting of the packets can be configured by changing the settings in the Data View Settings page in the Display Options property sheet.

The data for each packet is colored according to its source:

Sent from a recognized network protocol, port, or socket.

Received by a recognized network protocol, port, or socket.

Capacity of the Data View

The Data View holds up to 15000 lines of packet information. When the View is full, each new line will cause the oldest line to be deleted. The number of lines appearing in the status bar will keep incrementing. For example, the total number of lines can be 17500, yet only lines 2501 through 17500 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Organization of the Data View

The Data View is organized as a grid with 7 columns:

•	Sequence number

•	Source and Destination network addresses

•	Packet Contents as specified in the data portion of the packet (that which follows the protocol header)

•	Size of the packet

The following three columns display the delta, relative, and absolute timestamps of this particular packet:

•	Delta time - The time between this packet and the previous packet in the same conversation. A match is made if the IP addresses are identical and/or reversed, meaning that the two addresses are communicating with each other.

•	Relative time - The time between this packet and the time when the capture was initiated.

•	Absolute time - The time according to the computer clock.

Changing the format of the Data View

Data View Settings

Timestamps

The timestamps in the last two columns of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Decoded Packet View

The Decoded Packet View displays expanded details of a specific packet in the capture buffer.

Selecting a Packet for Display

To select a packet you want to see in the Packet Details view, merely select a packet that is visible in the following views:

•	The Packets View

•	The Data View

•	The IP Headers View

•	The TCP Headers View

Each time you click on the mouse in one of the aforementioned views, the packet displayed will be updated to the packet you selected.

Once the packet is displayed, it will continue to be displayed even if the Capture buffer is set to Circular, and the packet itself is overwritten when the Capture buffer wraps.

Organization of the Decoded Packet View

The Decoded Packet View is displayed as tree with four columns:

•	The descriptive name of a byte field within the packet

•	The offset (in bytes) from the start of the packet where this field is located.

•	The value of the field. This can be expressed in many formats such as numeric, hexadecimal, ASCII, etc.

Highlighting

When you select an element from the Decoded Packet View, the corresponding location in the packet will be highlighted in the Hex Packet View.

Keyboard Navigation

Move to the previous packet in the active Capture view	F2
Move to next packet in the active Capture view	F3
Move to the first packet in the active Capture view	F4
Move to the last packet in the active Capture view	F5
Switch to the next pane	F6
Switch to the previous pane	Shift+F6
Toolbar Navigation

Move to the first packet in the active Capture view

Move to the previous packet in the active Capture view

Move to next packet in the active Capture view

Move to the last packet in the active Capture view


The Network Statistics Window

The Network Statistics Window displays realtime network statistics in various formats. The statistics can be reset at any time by selecting Reset Network Statistics from the View menu.

Organization of the Network Statistics Window

The Network Statistics Window consists of the following seven views:

•	Statistics View

•	Sizes View

•	Protocols View

•	Nodes View

•	Conversations View

•	Activity View

•	Network Names View

To display a specific view, use the mouse to single-click on one of the tabs lining the bottom of the window. Appearing on the tab is the name of the view associated with that tab.

The Statistics Bar

Above the tabbed views is a dockable bar which displays several summary figures based on the

•	Date Started - The date and time when the gathering of network statistics was started, or the date and time when the statistics  were reset.

•	Wire Speed - The maximum network speed of the currently selected network adapter.

•	Total Packets - The accumulated amount of network packets seen by TracePlus.

•	Total Bytes - The total number of bytes

•	Total Oversize


The Hex Packet View

The Hex View displays the entire contents of the packet as a grid of hex digits. The ASCII equivalent for each digit is displayed to the right of the grid.

Highlighting

When you select a specific hex value in the grid, the series of bytes containing that hex value will be highlighted. In addition, the corresponding element in the Decoded Packet View will be scrolled into view.

Keyboard Navigation

Move to the previous packet in the active Capture view	F2
Move to next packet in the active Capture view	F3
Move to the first packet in the active Capture view	F4
Move to the last packet in the active Capture view	F5
Switch to the next pane	F6
Switch to the previous pane	Shift+F6
Toolbar Navigation

Move to the first packet in the active Capture view

Move to the previous packet in the active Capture view

Move to next packet in the active Capture view

Move to the last packet in the active Capture view


The History View

The History view chronicles the occurrence of specific events on your network. Some  events are automatically generated by network equipment, such as ICMP messages and SNMP traps. Others events are initiated by people using your network, such as FTP transfers, reading newsgroups via NNTP, and Telnet connections.

Capacity of the History View

The History View holds up to 3000 records. When the View is full, each new record will cause the oldest record to be deleted. For example, the total number of records can be 4500, yet only records 1501 through 4500 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Organization of the History View

The History View consists of a grid with three columns:

•	# -The sequence number associated with this history record, starting at 1.

•	Message - Detailed information about the event. This always includes the source address and the destination address, and each address is translated if possible.

•	Time - The time at which the event was detected.

Timestamps

The timestamp in the second column of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.

History Filters

The History Filters provide you with the ability to reduce the number of events appearing in the History View, as a busy network could provide you with more information then you can read without a headache.

Filter Local Machine

If you are using the History View to monitor your network, you probably don't want your Web browsing or other activities to appear as well. By unchecking the checkbox, all packets sent and received from the current selected network adapter will not be candidates for inclusion in the History View.

If you have more than one network adapter, traffic from adapters other than the adapter that is being monitored by TracePlus will still appear in the History View.

Filter Protocols

There are over 30 protocols that can be monitored in the History View. Following is a sample of some of the protocols that generate events in the History Window under specific circumstances:

FTP Transfers

Packets sent or received on the defined FTP port(s) is monitored. When a RETR or STOR command is detected, a history event is generated. The event contains the name of the object being transferred.

HTTP Transfers

Packets sent or received on the defined FTP port(s) is monitored. When a HTTP GET or POST command is detected, a history event is generated. The event identifies the URL contained in the HTTP header.

HTTPS secure transfers

Packet sent or received on the defined HTTPS port(s) are monitored. If any data transfers are detected, a history event is generated.

ICMP Messages

Packets sent on the default ICMP port is monitored. When an ICMP message other than a stadard Ping type ICMP message is detected, a history event is generated. The event identifies the specific ICMP message that was detected.

NNTP Newsgroups

Packets sent or received on the defined NNTP Trap port are monitored. When an NNTP GROUP command is detected, a history event is generated. The event identifies the specific group being accessed.

SNMP Traps

Packets sent or received on the defined SNMP Trap port are monitored. When a SNMP Trap message is detected, a history event is generated. The event includes the SNMP version number of the trap, and the Generic type.

Telnet/Rlogin connections

Packets sent or received on the defined Telnet port(s) are monitored. When the Telnet service reports either that a connection was accepted, or the the connection was terminated, a history event is generated.

Filter on IP address

This feature enables you to filter only events where the source or destination address matches the specified IP address. This is useful when you want to see events emanating from or generated by a specific IP address.

Clicking on the ellipses button "..." will open the Select Network Name dialog, so you can select an IP address from the Network Names list.


The IP Headers View

The IP Headers View shows detailed descriptions of the IP headers contained in packets in the capture buffer. The headers are displayed in the order that the packets were seen by the network adapter.

If the IP packet encapsulates either a TCP or UDP packet, the IP header will be colored according to its source:

Sent from an application (The target port number was recognized as a TCP or UDP service port).

Received by an application. (The soruce port number was recognized as a TCP or UDP service port).

Capacity of the IP Headers View

The maximum number of IP headers that can be displayed will be limited to the  packets you capture, depending on the buffer size you selected in the General Settings page of Capture Settings dialog box.

If you specified a circular buffer, up to maximum of 16384 IP headers will be displayed. When the View is full, each new line will cause the oldest line to be deleted. For example, the total number of lines can be 3500, yet only lines 1501 through 3500 will be displayed in the View, if the buffer size is 4096K.

The maximum capacity stated above is available only in the licensed version of the product.

Organization of the IP Headers View

The IP Headers View is organized as a grid with 18 columns:

•	Sequence Number

•	Source IP Address

•	Destination IP address

•	Header Size - The size of the IP header.

•	Precedence

•	TOS (Type Of Service)

•	Datagram ID

•	Don't Fragment

•	More/Only Fragment

•	Fragment Offset

•	Total IP length (header + data)

•	IP data length (data only)

•	TTL (Time To Live)

•	IP protocol number

•	IP Header checksum

The following three columns display the delta, relative, and absolute timestamps of this particular IP packet:

•	Delta time - The time between this packet and the previous packet in the same conversation. A match is made if the IP addresses are identical and/or reversed, meaning that the two addresses are communicating with each other.

•	Relative time - The time between this packet and the time when the capture was initiated..

•	Absolute time - The time according to the computer clock.

Timestamps

The timestamp in the last column of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Network Names View

The Nodes View displays a list of unique protocol addresses captured by TracePlus for the purpose of assigning a more descriptive name to the address. The view is initially sorted by descriptive name in alphanumeric order.

When a view is updated with a new packet, the Network Names View is searched for a descriptive name matching the protocol address. If a matching address is found, the address is replaced with the descriptive name. For example:

•	The IP address 192.168.1.101 becomes "John's PC (192.168.1.101)".

By double-clicking on a highlighted row, you can assign a descriptive name to a protocol address.

IP addresses are automatically assigned a name by using a "reverse address lookup". If no name is associated with this address, the text "(name not found)" will appear in the Network Names View.

Capacity of the Network Names View

The Network Names View holds up to 3500 records. When the View is full, each new record will cause the oldest record to be deleted. For example, the total number of records can be 3500, yet only records 1501 through 5000 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Organization of the Network Names View

The Network Names View is organized as a grid with 8 columns. The grid is sorted

•	Name - A name which identifies this protocol address. By double-clicking on the highlighted row, you can edit this name.

•	Type - The higher level protocol to which the protocol address belongs.

•	Protocol Address

•	MAC Address

•	Vendor - This is the manufacturer of the chipset as decoded from the MAC address.

•	First - The timestamp when the first packet containing this node address was seen.

•	Last - The timestamp of the last packet containing this node address was seen.

Sorting on a specific column

The grid can be reorganized by clicking on the header of the column to sort the grid according to the value in that column. The sort order will alternate between ascending and descending each time the column header is clicked.

Temporary Network Names

When importing TracePlus capture files (.TPF), temporary network names from the capture file will be added to the list of network names. These temporary names will be deleted when you exit TracePlus.

Temporary names can be identified in the Network Names View because the grid columns will have a light gray background color.

Creating and Editing a Network Name

To edit a network name, press the right mouse button, and you will see a popup menu. Select Edit Network Name to display the Edit Network Name dialog box.

Type the new network name or make changes to the current network name. Press Ok to store the edited name.

Timestamps

The timestamps in the last two columns of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Nodes View

The Nodes View displays a summary of packets seen accumulated by network address. The view is initially sorted by network address in alphanumeric order.

Capacity of the Nodes View

The Nodes View holds up to 5000 records. When the View is full, each new record will cause the oldest record to be deleted. For example, the total number of records can be 6500, yet only records 1501 through 6500 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Address Display Formats

A node address is the high level protocol address as recognized by TracePlus. If TracePlus cannot decode the protocol address, the MAC address is used instead.

The following protocols have uniquely formatted addresses:

•	IP Addresses (displayed as 192.168.1.1, etc.). If an IP address has been resolved to a hostname (as shown in the Network Names View), the hostname will appear as well.

•	IPX Addresses (displayed as 00-00-00-00:01-02-03-04-05-06, etc.)

•	MAC Addresses (displayed as 00:01:02:03:04:05, etc.).

802.1P/802.1Q VLANs

If the packet has a Ethernet type of 0x8100 (802.1Q/802.1P), the address will be suffixed with the phrase "[VLAN: n]", where n is a number from 0 to 4095.

Organization of the Nodes View

The Nodes View is configured as a grid with 15 columns:

•	Address - The protocol address or MAC address formatted according to the formula outlined above.

The following 3 columns represent the number of total packets sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 3 columns represent the number of total bytes sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 6 columns represent the number of total packets per node (sent+received) classified by packet size:

•	0-64 hytes

•	65-127 bytes

•	128-255 bytes

•	256-511 bytes

•	512-1023 bytes

•	Packet sizes 1024 bytes or greater

The following two columns display the first and last timestamps for a particular node address.

•	First - The timestamp when the first packet containing this node address was seen.

•	Last - The timestamp of the last packet containing this node address was seen.

Sorting on a specific column

The grid can be reorganized by clicking on the header of the column to sort the grid according to the value in that column. The sort order will alternate between ascending and descending each time the column header is clicked.

If you are sorting by protocol address, the addresses will be sorted first by protocol (IP, MAC/NetBIOS/AppleTalk, IPX), then by actual address.

The grid is resorted by the specified column and sort order automatically every 6 seconds.

Timestamps

The timestamps in the last two columns of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Packet Details View

The Packet Details View displays the contents of a single packet existing in the capture buffer. This view is only available when a Capture window is active. The View consists of a split window, where each pane displays one of two formats:

•	Decoded (each field of the packet is translated into a human readable format)

•	Hexidecimal with ASCII translation

Selecting a Packet for Display

To select a packet you want to see in the Packet Details view, merely select a packet that is visible in the following views:

•	The Packets View

•	The Data View

•	The IP Headers View

•	The TCP Headers View

Each time you click on the mouse in one of the aforementioned views, the packet displayed will be updated to the packet you selected.

Once the packet is displayed, it will continue to be displayed even if the Capture buffer is set to Circular, and the packet itself is overwritten when the Capture buffer wraps.

Organization of the Packet Details View

The Packet Details View consists of a splitter window, which means that the window is split into two panes. The upper pane is the Decoded View, and the lower pane is the Hexidecimal View.

The bar between the panes can be grabbed with the mouse and adjusted so that one pane can be larger than the other.

Keyboard Navigation

Move to the previous packet in the active Capture view	F2
Move to next packet in the active Capture view	F3
Move to the first packet in the active Capture view	F4
Move to the last packet in the active Capture view	F5
Switch to the next pane	F6
Switch to the previous pane	Shift+F6
Toolbar Navigation

Move to the first packet in the active Capture view

Move to the previous packet in the active Capture view

Move to next packet in the active Capture view

Move to the last packet in the active Capture view


The Packets View

The Packets View displays the contents of the capture buffer in an easy to read format. One record appears for each packet in the capture buffer.

Capacity of the Packets View

The maximum number of packets that can be displayed will be limited to the  packets you capture, up to the maximum buffer size you specified.

If you specified a circular buffer, the maximum number of packets is based on the following algorithm:

     Maximum buffer size / 2048 = Maximum number of packets

For example, a buffer size of 32 megabytes will result in:

     32 MB / 2048 = 16384 packets displayed

When the View is full, each new packet will cause the oldest line to be deleted. For example, the total number of packets captured can be 2000, yet only packets 2501 through 4500 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Address Display Formats

The Source and Destination addresses are the high level protocol addresses as recognized by TracePlus. If TracePlus cannot decode the protocol address, the MAC address is used instead.

The following protocols have uniquely formatted addresses:

•	IP Addresses (displayed as 192.168.1.1, etc.). If an IP address has been resolved to a hostname (as shown in the Network Names View), the hostname will appear as well.

•	IPX Addresses (displayed as 00-00-00-00:01-02-03-04-05-06, etc.)

•	MAC Addresses (displayed as 00:01:02:03:04:05, etc.).

Packet Coloring

The packets captured are displayed according to the color assigned to them in the Display Options dialog box. To assign a color to a network protocol, select Display Options from the Settings menu, then choose the Protocol Colors tab.

Organization of the Packets View

The Packets View is organized as a grid with 9 columns:

•	Sequence number

•	Selection checkbox

•	Source address (can be in the form of a MAC address, IP address/hostname, or IPX address)

•	Destination address (can be in the form of a MAC address, IP address/hostname, or IPX address)

•	Protocol summary

•	Size of packet

•	VLAN number (displayed if the packet has a Ethernet type of 0x8100 (802.1Q/802.1P)

The following two columns display the delta and absolute timestamps of this particular packet:

•	Delta time - The time between this packet and the previous packet in the same conversation. A match is made if the IP addresses are identical and/or reversed, meaning that the two addresses are communicating with each other.

•	Absolute time - The time according to the computer clock.

Timestamps

The timestamp in the last column of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Protocols View

The Protocols View displays a summary of packets seen sorted by network protocol and accumulated for each network address specified by that protocol.

Capacity of the Protocols View

The Protocol View holds up to 7500 records. When the View is full, each new record will cause the oldest record to be deleted. For example, the total number of records can be 9000, yet only records 1501 through 9000 will be displayed in the View.

The maximum capacity stated above is available only in the licensed version of the product.

Address Display Formats

A node address is the high level protocol address as recognized by TracePlus. If TracePlus cannot decode the protocol address, the MAC address is used instead.

The following protocols have uniquely formatted addresses:

•	IP Addresses (displayed as 192.168.1.1, etc.). If an IP address has been resolved to a hostname (as shown in the Network Names View), the hostname will appear as well.

•	IPX Addresses (displayed as 00-00-00-00:01-02-03-04-05-06, etc.)

•	MAC Addresses (displayed as 00:01:02:03:04:05, etc.).

Organization of the Protocols View

The Protocols View is configured as a grid with 16 columns:

•	Protocol description

•	Address

The following 3 columns represent the number of total packets sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 3 columns represent the number of total bytes sent and received by a node followed by a breakdown of that figure (sent versus received).

•	Total

•	In

•	Out

The following 6 columns represent the number of total packets per node (sent+received) classified by packet size:

•	0-64 bytes

•	65-127 bytes

•	128-255 bytes

•	256-511 bytes

•	512-1023 bytes

•	Packet sizes 1024 bytes or greater

The following two columns display the first and last timestamps for a particular node address.

•	First - The timestamp when the first packet containing this node address was seen.

•	Last - The timestamp of the last packet containing this node address was seen.

802.1P/802.1Q VLANs

If the packet has a Ethernet type of 0x8100 (802.1Q/802.1P), the protocol description will be suffixed with the phrase "[VLAN: n]", where n is a number from 0 to 4095.

Sorting on a specific column

The grid can be reorganized by clicking on the header of the column to sort the grid according to the value in that column. The sort order will alternate between ascending and descending each time the column header is clicked.

If you are sorting by protocol address, the addresses will be sorted first by protocol (IP, MAC/NetBIOS/AppleTalk, IPX), then by actual address.

As of version 1.17.000, the grid is resorted by the specified column and sort order automatically every 6 seconds.

Timestamps

The timestamps in the last two columns of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


The Sizes View

The Sizes View displays the breakdown of packets by their size. The chart is updated in realtime every two seconds.

Size Categories

There are six categories of packet sizes:

•	0-64 bytes

•	65-127 bytes

•	128-255 bytes

•	256-511 bytes

•	512-1023 bytes

•	Packet sizes 1024 bytes or greater

Chart Formats

There are three chart formats to select from:

Pie

Vertical Line

Horizontal Line

The type of chart you select will be remembered by TracePlus the next time you use it.

Each chart type can be printed (in color if you have a color printer) by selecting Print from the File menu.

TIP: You can change chart types by right clicking on the chart itself, and selecting a different chart type from the popup menu.


The Statistics View

The Statistics View displays various of the network traffic in realtime.

Organization of the Statistics View

The Statistics View consists of a grid with the following 8 sections:

•	General statistics, such as total packets, total bytes, and total packets categorized by address type (broadcast, multicast, and unicast.

•	Packet sizes divided into categories according to the size of the packet.

•	IP Packets, categorized by IP protocol.

•	TCP/IP packets, categorized by subprotocol. The most common IP subprotocols are represented.

•	NetBEUI (or NetBIOS) packets, categorized in three types: Name, Datagram , and Session.

•	LLC Packets (no categorization)

•	IPX Packets, categorized by subprotocol. The most common IPX subprotocols are represented.

•	AppleTalk Packets (no categorization)

Each section consists of a header followed by a list of statistics. Each statistic is displayed as two separate values:

•	In - Value based on packets whose target MAC address is the network adapter that TracePlus is monitoring.

•	Out - Value based on packets whose source MAC address is the network adapter that TracePlus is monitoring.

NOTE: If Disable Loopback is enabled, all packets transmitted from the selected network adapter will be ignored. Therefore the Out column will display an asterisk instead of a numeric value.


The TCP Headers View

The IP Headers View shows detailed descriptions of the IP headers contained in packets in the capture buffer. The headers are displayed in the order that the packets were seen by the network adapter.

Each TCP header is colored according to its source:

Sent from an application (The target port number was recognized as a TCP service port).

Received by an application. (The soruce port number was recognized as a TCP service port).

Capacity of the TCP Headers View

The maximum number of TCP headers that can be displayed will be limited to the  packets you capture, depending on the buffer size you selected in the General Settings page of Capture Settings dialog box.

If you specified a circular buffer, up to maximum of 16384 TCP headers will be displayed. When the View is full, each new line will cause the oldest line to be deleted. For example, the total number of lines can be 3500, yet only lines 1501 through 3500 will be displayed in the View, if the buffer size is 4096K.

The maximum capacity stated above is available only in the licensed version of the product.

Organization of the TCP Headers View

The TCP Headers View is organized as a grid with 19 columns:

•	Sequence Number

•	Source IP address

•	Target IP address

•	Source port number

•	Target port number

•	Source sequence number

•	ACK sequence number

•	TCP header length

•	Reserved

•	Session Bits

•	TCP window size

•	TCP header checksum

•	Urgent data

The following three columns represent the values of the first TCP option field (if present). TCP option fields are present if the TCP header length exceeds 20 bytes.

•	Option type - If there is no TCP options, this column will display "N/A".

•	Length

•	Option value

The following three columns display the delta, relative, and absolute timestamps of this particular TCP packet:

•	Delta time - The time between this packet and the previous packet in the same conversation. A match is made if the IP addresses are identical and/or reversed, meaning that the two addresses are communicating with each other.

•	Relative time - The time between this packet and the time when the capture was initiated.

•	Absolute time - The time according to the computer clock.

Timestamps

The timestamp in the last column of the grid has a resolution which is dependent on the Windows platform that you are running, and represents the time when the network driver received the packet from the network adapter.

•	If you are running Windows 95/98/ME, the timestamp will reflect an accuracy of 1 millisecond. The actual displayed value will be in microseconds, however the three least significant digits will always be zero.

•	If you are running Windows NT 4.x/2000 or Windows XP, the timestamp will reflect a true accuracy of 1 microsecond. Therefore all digit positions in the actual displayed value are significant.


Toolbar

Open an existing Capture file (.TPF)

Save the active Capture view as a .TPF file

Print the active Statistics or Capture view

Change the printer and printing options

Specify a Network Adapter as the source of packets

Define TCP/IP protocols and associated port numbers

Change packet filters for the active Capture window

Define display options for the Capture window

Reset the Global Statistics and Network Names views

Creates a new Capture Window and starts capturing packets

Stops the capture in the active Capture window

Pauses (and restarts) the capture in the active Capture window

Display the active chart as a Pie chart

Display the active chart as a Vertical Bar chart

Display the active chart as a Horizontal Bar chart

Move to the first packet in the active Capture view

Move to the previous packet in the active Capture view

Move to next packet in the active Capture view

Move to the last packet in the active Capture view


Triggers

The Triggers page defines criteria that will start the capture of packets automatically. When you push Ok from the Capture Settings dialog box to start the trace, no packets will be captured until the trigger criteria is met.

There are four types of triggers available:

•	Network addresses

•	Network statistics

•	Packet sizes and types

•	Network protocols

Network Addresses

A capture can be started when a packet containing one or more specified network addresses is seen. The types of network addresses supported are:

•	IP addresses

•	IPX addresses

•	MAC addresses

Additionally, you can define the direction in which the packet is sent:

•	Bidirectional communication between node 1 and node 2, shown as 1 <-> 2.

•	Node 1 sending packets to node 2, shown as 1 -> 2.

•	Node 2 sending packets to node 1, shown as 2 -> 1.

Network Statistics

A capture can be started by the result of a network statistic fitting a user-defined value. There are three statistics that can be monitored:

•	Kilobytes per second

•	Packets per second

•	Utilitization

Logic can be further applied to the calculated statistic in order to determine if it meets a criteria:

•	Above the a user defined value

•	Below a user defined value

Packet Sizes and Types

This list specifies a trigger based on the physical characteristics of a packet. There are three criteria:

Frame Types

Select the desired frame type of the packets you want to capture.

Packet Sizes

The capture will start when a packet matching the selected range of packet sizes

Packet Types

The capture will start when a packet matching the selected Packet type  The definition of each Packet type is as follows:

•	Normal packets are between 60 bytes and the maximum Ethernet frame size, which is 1514 bytes.

•	Oversized packets are packets that are greater than 1500 bytes in length.

•	Undersized packets are packets that are less than 60 bytes in length.

Network Protocols

This list specifies a criteria based on the network protocol contained within the packet. The capture will be started if a packet contains one of the selected network protocols.

NOTE: If the packet is a protocol not selected from this list, the capture will not be started.


Unhide All

This option unhides all previously hidden packets in the Packets View.