?_|¿ÿÿÿÿ<‘2ˆ2lpQ/Ë<hÖd  B†&ÿƒ•WordMicrosoft Word‚ ‡ \- ‚ûŒCourier New…-„üò…- …ú„"…-‹Zã ˆ„üÿ…-…ð ‚ú ƒ"…-…ð„üò…- …ú„"…-‹ü •…-…ð…-…ð†&ÿ‡‹ö‰S ÷…- …ú„"…-‹S kŠ…-…-…ð…- …úÿ„"…-‹íS Š…-…-…ð„üò…- …ú„"…-‹ÊS ÷Š…-…ð…-…ð†&ÿ“†g|þ ƒúÿ„"…-…-(Í$vø^÷Gõ0òíçòààØÏÏÀŲº§®¢••‡‹yŠkvk…-…- …úƒ"…-ƒü…-&É%vø^÷Gõ0òíçòààØÏÏÀŲº§®¢••‡‹yŠk…-…ð…-†&ÿƒ†&ÿ“ZgP þ…-…-(Í$^øv÷Žõ¤òºíÏçâàôØ Ï Å" º. ®8 ¢? •E ‡I yJ k^k…-…- …úƒ"…-…-&É%^øv÷Žõ¤òºíÏçâàôØ Ï Å" º. ®8 ¢? •E ‡I yJ k…-…ð…-†&ÿƒ…-…-‹i©R@…-…-ƒ‹a¡ZH…„û½ÿ‚¼‰@ Arial…-‚ ‡Zœ….‰2 Zœ•- \Local))%%….‚……‡§¯….‰2 §¯- \LAN)00….‡d}………-‡ôf….‰2 ôf›- \Segment-%)<%)….‡d}„û­ÿ‚“@Times New Roman…-……'ÿÿ…- …ú„"…-‹q ] R @…-…-…ð„üŸ…- …ú„"…-‹ Y o ¬…-…ð…-…ð„üŸ…- …ú„"…-‹ ¡o ô…-…ð…-…ð„üò…- …ú„"…-‹ƒ p ` e …-…ð…-…ð„üÌ…- …ú„"…-‹U “ á n …-…ð…-…ð…-…-‹v N X O…-…-ƒ‹n F ` W……-‚ ‡e i….+‰2 e iÅ- \NDIS network adapter,00-)%4)%%)%)%….‡d}……‡¸ é….‰2 ¸ é §- \CMM2 or GAM088%)408….‡d}………-‡ m….‰2 m•- \Board0)%)….‡d}„û­ÿ‚¼“@Times New Roman…-……'ÿÿ…-…-‹ ê ät …-…-ƒ‹ â ì| ……-‚ ‡ì³ ….‰2 ì³ —- \Remote0%<)%….‡d}……‡9é ….‰2 9é - \LAN)00….‡d}………-‡†  ….‰2 †  ›- \Segment-%)<%)….‡d}…-……'ÿÿ…-…-‹¬FÁX…-…-ƒ‹£>Ê`……-‚ ‡ʽ….‰2 ʽ- \Surveyor-)%%%)….‡d}………-‡Á….‰2 Á- \Software-)4%%….‡d}…-……'ÿÿ…-…-‹àf©…-…-ƒ‹×^±…„ûœÿ‚¼‰@ Arial…-‚ ‡….‰2  £- \Local Host==88H=8!….‡d}„ûœÿ‚“@Times New Roman…- ……'ÿÿ†&ÿ“€#™'…- …ú„"…- ‹™$‹…-…-…ð …- …ú„"…- ‹^ºÇ…-…-…ð ‚ü…- …ú„"…- ‹ Àæ…-…-…ð …- …ú„"…- ‹D¦0˜…-…-…ð …- …ú„"…- ‹D0…-…-…ð †&ÿ“|ýª, …úÿ„"…- …- •$€¥'€'€…-…ð …-†&ÿƒ†&ÿ“‡£# …úƒ"…- …-%‹ ž…-…ð …-†&ÿƒ†&ÿ“× ð…- …ú„"…- ‹ñ ã…-…-…ð …- …ú„"…- ‹¶¡…-…-…ð …- …ú„"…- ‹úd§=…-…-…ð …- …ú„"…- ‹,ýï…-…-…ð …- …ú„"…- ‹,äÖ…-…-…ð †&ÿ“Óå …úÿ„"…- …- •$×éü××é…-…ð …-†&ÿƒ†&ÿ“Þïû  …úƒ"…- …-%âóö…-…ð …-†&ÿƒ…-…-‹³ àØ…-…-ƒ‹« éá……-‚ ‡é÷….‰2 é÷›- \Storage-)%)%….‡d}………-‡6….‰2 6—- \Device0%%%%….‡d}…-……'ÿÿ…- …ú„"…- ‹Ú&º…-…-…ð „üŸ…- …ú„"…- ‹õ¹× …-…ð …-…ð „üŸ…- …ú„"…- ‹õr×Å…-…ð …-…ð „üò…- …ú„"…- ‹ëÈö…-…ð …-…ð „üÌ…- …ú„"…- ‹±ø<Ó…-…ð …-…ð …-…-‹ßÀ…-…-ƒ‹ÖÉ……-‚ ‡Î;….‰2 Î;•- \NDIS,00-….‡d}……‡!°….‰2 !° §- \CMM2 or GAM088%)408….‡d}………-‡t4….‰2 t4•- \Board0)%)….‡¸Á¢…-……'ÿÿ…-…-‹S ¶» µ…-…-ƒ‹J ®à ½……-‚ ‡à ½….‰2 à ½ §- \Remote HostH8Y=!8H=8!….‡¸Á¢…- ……'ÿÿ…-…-‹‰îƒ…-…-ƒ‹æÊŒ……-‚ ‡ÊŒ…. ‰2 ÊŒ¯- \Local Monitor/))%%8)))….‡¸Á¢………-‡Œ….#‰2 Œµ- \Transmit/Capture)%)%<0%))%….‡¸Á¢…-……'ÿÿ…- …ú„"…- ‹à½ ÁŸ…-…-…ð …-…-‹³ ò³…-…-ƒ‹« û¼……-‚ ‡….%‰2 ¹- \TCP/IP Connection)0--0)))%%))….‡¸Á¢………-‡S….&‰2 S»- \(LAN, modem, etc.))00<))%<%%….‡¸Á¢…-……'ÿÿ…-…-‹‰ö ÂY…-…-ƒ‹î Êa……-‚ ‡Êa…."‰2 Êa³- \Remote Monitor/0%<)%8)))….‡¸Á¢………-‡a….#‰2 aµ- \Transmit/Capture)%)%<0%))%….‡¸Á¢…-……'ÿÿ†&ÿ“B?¿µ …-„üs…- …Bÿ$j~jmKmKmHmEoCrCuC} C} C€ Eƒ H… K† }† }u Ku S} Sz Qw Nu K} T} TuK}N}Q{SxSuKuK~‚… ‘$h£¢uhH ‘${« µ} {P …-…-…ð †&ÿƒ…- …ú„"…- ‹ú Ï Û ²…-…-…ð †&ÿ“×Ä h …-…-‹¯ Ä …-…-ƒ‹¦ Ì (……-‚ ‡Ì …….‰2 Ì …- \Surveyor-)%%%)….‡¸Á¢………-‡ ‰….‰2  ‰- \Software-)4%%….‡¸Á¢…-……'ÿÿ†&ÿ“|{ ›† …- …ú„"…- ‹y ™~ ‹…-…-…ð …- …ú„"…- ‹y ^ Ç…-…-…ð …- …ú„"…- ‹m  æ…-…-…ð …- …ú„"…- ‹ž ¦Š ˜…-…-…ð …- …ú„"…- ‹ž Š …-…-…ð †&ÿ“|W ª† …úÿ„"…- …- •$€[ ¥ € €[ …-…ð …-†&ÿƒ†&ÿ“‡b £} …úƒ"…- …-%‹f žx …-…ð …-†&ÿƒ†&ÿƒ†&ÿ“Ób óm …- …ú„"…- ‹` ñe ã…-…-…ð …- …ú„"…- ‹` ¶û …-…-…ð …- …ú„"…- ‹T d =…-…-…ð …- …ú„"…- ‹† ýq ï…-…-…ð …- …ú„"…- ‹† äq Ö…-…-…ð †&ÿ“Ó? m …úÿ„"…- …- •$×C üh ×h ×C …-…ð …-†&ÿƒ†&ÿ“ÞI ûd …úƒ"…- …-%âM ö_ …-…ð …-†&ÿƒ†&ÿƒ……-‚ ……-…-‹Ð Ä Æ…-…-ƒ‹Ç ¼  Î……-‡ ….%‰2  ¹- \TCP/IP Connection)0--0)))%%))….‡¸Á¢………-‡m ….&‰2 m »- \(LAN, modem, etc.))00<))%<%%….‡¸Á¢…-……'ÿÿ†&ÿƒKlÓ¿ …úƒ"…- …-%P•Í• …úƒ"…- …ð ‘%}qP•}¸ ‘% ¹Í• r…-…ð …-†&ÿƒ…-…-‹ÂA7…-…-ƒ‹ ºI?……-‚ ‡I´….‰2 I´‘- \Data0%%….‡d}………-‡–Š….‰2 –Š—- \Stream-%%<….‡d}…-……'ÿÿ†&ÿƒôÿ h…N…-…- … •$)D:D3)")… …úƒ"…- ‘% 1D^  ‘%Xc*)ýÿc…-…ð …-†&ÿƒ†&ÿ“Ê †8 Í …-…- … •$ù à à ù … …úƒ"…- ‘%Ó ‰  à . ‰ ‘%/ É Ô É…-…ð …-†&ÿƒ†&ÿ“D,Ž  …úƒ"…- …-%iXis…-…ð …- ‘$ŠZi0IZ ‘$Hqi›‰q…-…-†&ÿƒ†&ÿ“:$Do …úƒ"…- …-%IfI…-…ð …- ‘$j?I) ‘$h(>Ihi…-…-†&ÿƒ…-…-‹Ð . þ £ …-…-ƒ‹Ç &  « ……-‚ ‡ ….‰2  ‘- \Data0%%….‡d}………-‡S ö ….‰2 S ö —- \Stream-%%<….‡d}…-……'ÿÿ†&ÿ“ûúù¸ …úƒ"…- …-%%Δ…-…ð …- ‘$1ÿÿ< ‘$³ô¡Öv…-…-†&ÿƒ…- …úf„"…- ‹¼â8P…-…-…ð …- …úf„"…- ‹ Ã1…-…-…ð …- …úf„"…- ‹kFæµ…-…-…ð …- …úf„"…- ‹ @›®…-…-…ð …- …úf„"…- ‹îip…-…-…ð …- …úf„"…- ‹F LÁ»…-…-…ð …- …úf„"…- ‹- F¨µ…-…-…ð …- …úÿ„"…- ‹âÜù…-…-…ð …-…-‹q°Ÿ%…-…-ƒ‹i¨¨-……-‚ ‡¨f….‰2 ¨f›- \Network0%4)%….‡d}…-……'ÿÿ†&ÿ“:â =- …úƒ"…- …-%f  …-…ð …- ‘$hæ > h' ‘$( 8 ç …-…-†&ÿƒ†&ÿ“ÉÉ Ú …úƒ"…- …-%Õî õî …-…ð …- ‘$÷Í Íî ÷ …-…-†&ÿƒ†&ÿˆ· ˆí …úƒ"…- …-%Ûè Û5 …-…ð …- ‘$ü7 Û »7 …-…-†&ÿƒ†&ÿƒD!Ít …úƒ"…- …-%IJÇJ …úƒ"…- …ð ‘%v&IJvm ‘%šnÇJš'…-…ð …-†&ÿƒ†&ÿ“± Ñ Ü % …úƒ"…- …-%¶ ú Ö û …úƒ"…- …ð ‘%ã Ö ¶ ú ã  ‘%©  Ö û © Ø …-…ð …-†&ÿƒ†&ÿ“±  Ü j …úƒ"…- …-%¶ ? Ö @ …úƒ"…- …ð ‘%ã  ¶ ? ã b ‘%© d Ö @ ©  …-…ð …-†&ÿƒ…-/ðlp ( \€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿð‚w‚pwƒpøˆ„‡pøˆµ‡pø€ˆ‡pøˆ€‡pøˆ€‡pøˆˆ€‡pøˆ€ˆ‡pø€ˆˆ‡pøˆœ‡pøˆ€‡pøˆ€‡pø€ˆ‡pøˆ„‡pøˆƒ‡pÿƒ÷pÿ‚pð÷? |bm16¥E |bm17SG |bm18EM |bm19ÔR |bm2%¼ |bm20ÃÕ|bm21_Û|bm22WV|bm23¶|bm24¯|bm25 |bm26ö |bm27}|bm28|bm29³|bm3× |bm30X"|bm31á'|bm32-|bm33\2|bm34ç7|bm35)=|bm36ýI|bm37´O|bm38´k|bm39Ï¿|bm4ä |bm40ZÅ|bm41ÝÊ|bm42{Ð|bm43¬Õ|bm44ŽÚ|bm45Çß|bm460á|bm47•â|bm48¶ç|bm49Sí|bm5Hè |bm50Ïò|bm51`ø|bm52ùý|bm53„|bm54! |bm55H|bm56â|bm57o|bm58ü|bm59s|bm6ê |bm60M|bm61ø|bm62|bm63Ð6|bm64’@|bm65%|bm66¼'|bm67¯k|bm68s-|bm69 /|bm7v÷ |bm70ÿG|bm71…|bm72^q|bm73ý®|bm74õ¯|bm75ê°|bm76ã±|bm77ܲ|bm78Õ³|bm79δ|bm8©ø |bm80ǵ|bm81»¶|bm82´·|bm83­¸|bm84¦¹|bm85Ÿº|bm86˜»|bm87‘¼|bm88н|bm9Úù |bm98 w ¹ lpu$¼ @8 )†&ÿƒ•WordMicrosoft Word‚ ‡ ‚ûŒCourier New…-„û­ÿ‚“@Times New Roman…-…‚ ƒ††&ÿ‚ÿþÿ‰¥ƒ….‚ ‚ ‚ÿ‚ƒü…- ƒúÿ„"…-…‹¤ƒ ‡ R†&ÿƒ•WordMicrosoft Word‡ R ‚û‡…-…„ûÖÿ‚—Times New Romanð…-‚ ……ƒü…- …ú„"…-ƒ ‹#*‹ ‚ú ƒ"…-…ð„üÿ…-………- …ú„"…- ‹Ï!…-…ð …-………ƒ‹ò€¿`…„ûÖÿ‚‰"Arial…- ‰2 À`¯RCapture Buffer   ……'ÿÿ……- …ú„"…- ‹ˆ°G…-…ð …-………ƒ‹]¢ Y……- #‰2 !YµRReal-Time Buffer  $  ……'ÿÿ… …ú„"…- ‡Ä‡¸ …-…ð ……‚ü„…- …úÿ„"…- •$üÀ· ©Ä…-…ð …-…ð …… …ú„"…- ‡Å‡`7…-…ð ……‚ü„…- …úÿ„"…- •$5o4a+WLW…-…ð …-…ð …… …ú„"…- ‡Ž*‡Œo…-…ð ……‚ü„…- …úÿ„"…- •$h™lŒg†‹…-…ð …-…ð ………ƒ‡§qn…„ûÎÿ‚‰"Arial…- ƒ2 pƒRNet$……'ÿÿ……ƒ‹§Rn‰……- ‰2 p‰›RDisplay$  ……'ÿÿ……ƒ‹€[4Ð…„û½ÿ‚"Arial…- )‰2 6ÐÁRSurveyor + Interface-%!%!%'%%%"%……'ÿÿ… …ú„"…- ‡’‡‡’Ê…-…ð …… …ú„"…- ‡“U‡“q…-…ð ……‚ü„…- …úÿ„"…- •$i m“i†ˆ“…-…ð …-…ð ……-…ð…ð…ð …ð …ð …- ‚ú ƒ"…-…'ÿÿ†&ÿƒ…'ÿÿ……-++lpi;þ,YîU G.†&ÿƒ•WordMicrosoft Word‚ ‡ Ø R‚ûŒCourier New…-ƒü…- …ú„"…-‹6 „üÿ…- ‚ú ƒ"…-…ð†&ÿ“ß¶0ï†&ÿ“ݲ3ò„üò…- …ú„"…-‹Ô1µ…-…ð…-…ð„üŸ…- …ú„"…-‹ðÅÒ…-…ð…-…ð„üŸ…- …ú„"…-‹ð~ÒÑ…-…ð…-…ð„üò…- …ú„"…-‹æ Ã…-…ð…-…ð„üÌ…- …ú„"…-‹¸Dß…-…ð…-…ð†&ÿƒ…- ƒúÿ„"…-‹ÇÌ…-…-ƒ‹¾Õ"…„û­ÿ‚¼‰@ Arial…-‚ ‡Ë6….‰2 Ë6‘RØ NDIS<<7….‡b„¯………-‡X…."‰2 X³RØ network adapter3.A3 ..3.3. ….‡¸Á¢„û­ÿ‚¼“@Times New Roman…-……'ÿÿ…-…-‹+@¯…-…-ƒ‹"•H·……-‚ ‡Hñ….‰2 HñRØ Surveyor73 ...3 ….‡¸Á¢………-‡§õ….‰2 §õRØ Software73A. .….‡¸Á¢„û­ÿ‚“@Times New Roman…-……'ÿÿ…-…-‹½ç.)…-…-ƒ‹´ß62…„ûœÿ‚¼‰@ Arial…-‚ ‡62….‰2 62 §RØ Host SystemH=8!C88!8Y….‡¸Á¢„ûœÿ‚“@Times New Roman…- ……'ÿÿ„üÌ…- …ú„"…- ‹…Ï´t…-…ð …-…𠃋zž……-‚ ‡¾¦….‰2 ¾¦ §RØ Host System<3.7...J….‡¸Á¢………-‡….‰2 —RØ MemoryE.J3 .….‡¸Á¢…-……'ÿÿ…- …ú„"…- ‹Y|¬È…-…-…𠃋Nq·Ô…„û½ÿ‚¼‰@ Arial…- ‚ ‡·$….‰2 ·$›RØ Capture0%))%….‡¸Á¢………- ‡@….‰2 @—RØ Buffer0)%….‡¸Á¢„û­ÿ‚@ Arial Black…- ……'ÿÿ…- …ú„"…- ‹6PH…-…-…ð …-…-‹Æ+ 7m …-…-ƒ‹½# ?v ……-‚ ‡?v ….‰2 ?v §RØ Host SystemH=8!C88!8Y….‡¸Á¢…- ……'ÿÿ…- …ú„"…- ‹Ö ¤ˆ…-…-…ð …-…-‹`kÑ­…-…-ƒ‹WcÙ¶……-‚ ‡Ù¶….‰2 Ù¶ §RØ Host SystemH=8!C88!8Y….‡¸Á¢…- ……'ÿÿ†&ÿƒwÔêE†&ÿƒsГ܅- …ú„"…- ‹Ï‘Ô‚…-…-…ð …- …ú„"…- ‹ÏUj¾…-…-…ð ‚ü…- …ú„"…- ‹ÂpÝ…-…-…ð …- …ú„"…- ‹ôà…-…-…ð …- …ú„"…- ‹ô„àv…-…-…ð †&ÿƒs…­¡…Ü …úÿ„"…- …- •$w±œ×w×w±…-…ð …-†&ÿƒ†&ÿƒ~…¸›…Ó …úƒ"…- …-%‚¼–Î…-…ð …-†&ÿƒ†&ÿƒ†&ÿƒÎ>íI…- …ú„"…- ‹<ëAÝ…-…-…ð …- …ú„"…- ‹<°×…-…-…ð …- …ú„"…- ‹0_Ý8…-…-…ð …- …ú„"…- ‹aøMê…-…-…ð …- …ú„"…- ‹aßMÑ…-…-…ð †&ÿƒÎ…ü…I …úÿ„"…- …- •$Ò÷DÒDÒ…-…ð …-†&ÿƒ†&ÿƒÙ…%õ…@ …úƒ"…- …-%Ý)ð;…-…ð …-†&ÿƒ†&ÿƒ†&ÿ‡6 õ‰a ð…-…-‹ßb õt …-…-ƒ‹×Z ý| ……-‚ ‡ý¶ ….‰2 ý¶ RØ Surveyor73 ...3 ….‡¸Á¢………-‡\º ….‰2 \º RØ Software73A. .….‡¸Á¢…-……'ÿÿ†&ÿ“2 |­ ô†&ÿ“2 |R ‡…- …ú„"…- ‹zP B …-…-…ð …- …ú„"…- ‹z } …-…-…ð …- …ú„"…- ‹nà œ …-…-…ð …- …ú„"…- ‹ \ ‹N …-…-…ð …- …ú„"…- ‹ C ‹5 …-…-…ð †&ÿ“2 Y` ‡ …úÿ„"…- …- •$6 ][ ‚6 ‚6 ]…-…ð …-†&ÿƒ†&ÿ“= cZ ~ …úƒ"…- …-%A gU y…-…ð …-†&ÿƒ†&ÿƒ†&ÿ“ é­ ô…- …ú„"…- ‹è« ìœ …-…-…ð …- …ú„"…- ‹èo ‚Ø …-…-…ð …- …ú„"…- ‹Û ˆ÷ …-…-…ð …- …ú„"…- ‹ · ù© …-…-…ð …- …ú„"…- ‹ ž ù …-…-…ð †&ÿ“ Æ» ô …úÿ„"…- …- •$‘ ʶ ï‘ ï‘ Ê…-…ð …-†&ÿƒ†&ÿ“˜ е ë …úƒ"…- …-%œ Ô° æ…-…ð …-†&ÿƒ†&ÿƒ†&ÿƒ†&ÿ“s¥…-…-‹y¦Ž¸…-…-ƒ‹qž—À……-‚ ‡—ú….‰2 —úRØ Surveyor73 ...3 ….‡¸Á¢………-‡öþ….‰2 öþRØ Software73A. .….‡¸Á¢…-……'ÿÿ†&ÿ“o锆&ÿ“oŽ'…- …ú„"…- ‹Œ~…-…-…ð …- …ú„"…- ‹Qµº…-…-…ð …- …ú„"…- ‹»Ù…-…-…ð …- …ú„"…- ‹@™+‹…-…-…ð …- …ú„"…- ‹@€+r…-…-…ð †&ÿ“où' …úÿ„"…- …- •$sý˜"s"sý…-…ð …-†&ÿƒ†&ÿ“z– …úƒ"…- …-%~‘…-…ð …-†&ÿƒ†&ÿƒ†&ÿ“ɉ锅- …ú„"…- ‹ˆçŒÙ…-…-…ð …- …ú„"…- ‹ˆ¬"…-…-…ð …- …ú„"…- ‹{Z(4…-…-…ð …- …ú„"…- ‹­ô™æ…-…-…ð …- …ú„"…- ‹­Û™Í…-…-…ð †&ÿ“Éfø” …úÿ„"…- …- •$ÍjóÍÍj…-…ð …-†&ÿƒ†&ÿ“Õpñ‹ …úƒ"…- …-%Ùt솅-…ð …-†&ÿƒ†&ÿƒ†&ÿƒ…- …ú„"…- ‹/wÃ…-…-…𠃋#lÏ……- ‚ ‡ý….‰2 ý ¡RØ Real-Time0%%)<%….‡¸Á¢………- ‡Ú;….‰2 Ú;—RØ Buffer0)%….‡¸Á¢…- ……'ÿÿ……-‚ …†&ÿ“Ó^Ä „üò…- …ú„"…-‹éÅ ^2…-…ð …-…ð„üŸ…- …ú„"…-‹n ç:…-…ð …-…ð„üŸ…- …ú„"…-‹¸ ç„ …-…ð …-…ð„üò…- …ú„"…-‹$p…-…ð …-…ð„üÌ…- …ú„"…-‹Ã"Ó…-…ð …-…ð…-…-‹Ð¸ b;…-…-ƒ‹Ç° jC……-‡` …..‰2 ` ËRØ Gigabit Analysis ModuleA3.3<3....E333.….‡¸Á¢…-……'ÿÿ…- …ú„"…- ‹ž× & …-…-…ð …-…-‹à| þÈ …-…-ƒ‹×t Ñ ……- ‚ ‡$ ….‰2 $ ›RØ Capture0%))%….‡¸Á¢………- ‡S@ ….‰2 S@ —RØ Buffer0)%….‡¸Á¢…- ……'ÿÿ†&ÿ“ø ¨ „üò…- …ú„"…-‹ƒ  ÷r…-…ð …-…ð„üŸ…- …ú„"…-‹© ®€ z…-…ð …-…ð„üŸ…- …ú„"…-‹© ø€ Ä…-…ð …-…ð„üò…- …ú„"…-‹› d Q…-…ð …-…ð„üÌ…- …ú„"…-‹\ T¼ …-…ð …-…ð…- …ú„"…- ‹Q À Ý…-…-…ð …-…-‹V #° ¥…-…-ƒ‹M ¹ ­……- ‚ ‡¹ å….‰2 ¹ å›RØ Capture0%))%….‡¸Á¢………- ‡ ….‰2  —RØ Buffer0)%….‡¸Á¢…- ……'ÿÿ…-…-‹` ð ° ™…-…-ƒ‹X è ¹ ¡……- ‚ ‡¹ £….‰2 ¹ £ ¡RØ Real-Time0%%)<%….‡¸Á¢………- ‡ á….‰2  á—RØ Buffer0)%….‡¸Á¢…- ……'ÿÿ…-…-‹p ù  {…-…-ƒ‹h ñ ƒ……-‚ ‡ [….,‰2  [ÇRØ Century Media Module 2<.33 .E.3.E333..….‡¸Á¢…-……'ÿÿ…- …ú„"…- ‹Q {À Ë…-…-…ð †&ÿ“ç  + …úƒ"…- …-% 5 þ…-…ð …- ‘$ 7 ì 7 ‘$ë ü & ü…-…-†&ÿƒ†&ÿ“'¢[Å …úƒ"…- …-%AÎA˜…-…ð …- ‘$WÐA¦,Ð ‘$+–AÀV–…-…-†&ÿƒ†&ÿ“xW­ …úƒ"…- …-%4’*’…-…ð …- ‘$6| ’6§ ‘$(¨R’(}…-…-†&ÿƒ…-¯¦lpÜÂÀ  ˆ ð‚Ì‚ ‡ ‡ €‡ÚõïÌC ̃ƒ(ƒ‚T  @€ÿ @ € ÿ @@@€@ÿ@`@`€`ÿ`€@€€€ÿ€ @ € ÿ À@À€ÀÿÀÿ@ÿ€ÿÿÿý @ € ÿ @ € ÿ @ @@ €@ ÿ@ ` @` €` ÿ` € @€ €€ ÿ€   @  €  ÿ  À @À €À ÿÀ ÿ @ÿ €ÿ ÿÿ ¢@@@€@ÿ@ @@ @€ @ÿ @@@@Ø€@@ÿ@@`@@`@€`@ÿ`@€@@€@€€@ÿ€@ @@ @€ @ÿ @À@@À@€À@ÿÀ@ÿ@@ÿ@€ÿ@ÿÿ@ý`@`€`ÿ` `@ `€ `ÿ `@`@@`€@`ÿ@```@``€``ÿ``€`@€`€€`ÿ€` `@ `€ `ÿ `À`@À`€À`ÿÀ`ÿ`@ÿ`€ÿ`ÿÿ`Æ€@€€€ÿ€ €@ €€ €ÿ €@€@@€€@€ÿ@€`€@`€€`€ÿ`€€€@€€€´ÿ€€ €@ €€ €ÿ €À€@À€€À€ÿÀ€ÿ€@ÿ€€ÿ€ÿÿ€ý @ € ÿ   @  €  ÿ  @ @@ €@ ÿ@ ` @` €` ÿ` € @€ €€ ÿ€   @  €  ÿ  À @À €À ÿÀ ÿ @ÿ €ÿ ÿÿ ýÀ@À€ÀÿÀ À@ À€ Àÿ À@À@@À€@Àÿ@À`À@`À€`Àÿ`À€À@€À€€Àÿ€À À@ À€ Àÿ ÀÀÀ@ÀÀ€ÀÀÿÀÀÿÀ@ÿÀ€ÿÀÿÿÀúÿ@ÿ€ÿÿÿ ÿ@ ÿ€ ÿÿ ÿ@ÿ@@ÿ€@ÿÿ@ÿ`ÿ@`ÿ€`ÿÿ`ÿ€ÿ@€ÿ€€ÿÿ€ÿ ÿ@ ÿ€ ÿÿ ÿÀÿ@Àÿ€ÀÿÿÀÿÿÿ@ÿÿ€ÿÿÿ‚ßÿŠßßÿààÛÿÿÛ‹ÿÿÛààÿßßÿàÛàŒÛÛààÿßßÿÛÛ àŠÿßßÿÿÛààü‘ààÛÿÿßßÿÿààü’üààÿÿßßÿÛààü’üŒààÛÿß’ÿÛààü‚üŒààÛÿßßÿÛààü‚’’üŒààÛÿßßÿÛààü‚’’ü³ààÛÿßßÿÛààüüüüààÛÿßß’’ÛààüüüüààÛ’’ßß’ÛÛ à‰ÛÛ’ßßÿ’ÛàÛš’ÿßßÿÿ’Û’ÛÛààÛÛ’Û’ÿÿßßÿƒ’’ÿàƒÿ’’ÿƒß߃¯¦lpÜÂÀ  ˆ ð‚Ì‚ ‡ ‡ €‡ÚõïÌC ̃ƒ(ƒ‚T  @€ÿ @ € ÿ @@@€@ÿ@`@`€`ÿ`€@€€€ÿ€ @ € ÿ À@À€ÀÿÀÿ@ÿ€ÿÿÿý @ € ÿ @ € ÿ @ @@ €@ ÿ@ ` @` €` ÿ` € @€ €€ ÿ€   @  €  ÿ  À @À €À ÿÀ ÿ @ÿ €ÿ ÿÿ ¢@@@€@ÿ@ @@ @€ @ÿ @@@@Ø€@@ÿ@@`@@`@€`@ÿ`@€@@€@€€@ÿ€@ @@ @€ @ÿ @À@@À@€À@ÿÀ@ÿ@@ÿ@€ÿ@ÿÿ@ý`@`€`ÿ` `@ `€ `ÿ `@`@@`€@`ÿ@```@``€``ÿ``€`@€`€€`ÿ€` `@ `€ `ÿ `À`@À`€À`ÿÀ`ÿ`@ÿ`€ÿ`ÿÿ`Æ€@€€€ÿ€ €@ €€ €ÿ €@€@@€€@€ÿ@€`€@`€€`€ÿ`€€€@€€€´ÿ€€ €@ €€ €ÿ €À€@À€€À€ÿÀ€ÿ€@ÿ€€ÿ€ÿÿ€ý @ € ÿ   @  €  ÿ  @ @@ €@ ÿ@ ` @` €` ÿ` € @€ €€ ÿ€   @  €  ÿ  À @À €À ÿÀ ÿ @ÿ €ÿ ÿÿ ýÀ@À€ÀÿÀ À@ À€ Àÿ À@À@@À€@Àÿ@À`À@`À€`Àÿ`À€À@€À€€Àÿ€À À@ À€ Àÿ ÀÀÀ@ÀÀ€ÀÀÿÀÀÿÀ@ÿÀ€ÿÀÿÿÀúÿ@ÿ€ÿÿÿ ÿ@ ÿ€ ÿÿ ÿ@ÿ@@ÿ€@ÿÿ@ÿ`ÿ@`ÿ€`ÿÿ`ÿ€ÿ@€ÿ€€ÿÿ€ÿ ÿ@ ÿ€ ÿÿ ÿÀÿ@Àÿ€ÀÿÿÀÿÿÿ@ÿÿ€ÿÿÿ‚ßÿŠßßÿààÛÿÿÛ‹ÿÿÛààÿßßÿàÛàŒÛÛààÿßßÿÛÛ àŠÿßßÿÿÛààü‘ààÛÿÿßßÿÿààü’üààÿÿßßÿÛààü’üŒààÛÿß’ÿÛààü‚üŒààÛÿßßÿÛààü‚’’üŒààÛÿßßÿÛààü‚’’ü³ààÛÿßßÿÛààüüüüààÛÿßß’’ÛààüüüüààÛ’’ßß’ÛÛ à‰ÛÛ’ßßÿ’ÛàÛš’ÿßßÿÿ’Û’ÛÛààÛÛ’Û’ÿÿßßÿƒ’’ÿàƒÿ’’ÿƒß߃oflpþÎü’ ¿†&ÿ•H¼  †&ÿ†&ÿ“TNPP8Q=PÑu ‘& TNPPð †&ÿ&TNPP ‡ H‡ ût ƒúÿ„"…-ƒü…- †&ÿ †&ÿ …ú…f"…-‚ü…f…-‡ f… ‹ƒ}UH‡ f‹V±'|‡ f‹Þ±°|‡ f‹±å‚°‡ f‹ƒU°‡ f‹Þ°ä‡ f‹±‚‡ f‹Vµ'‡ f‹ƒµUL‡ f‹Þµ°€‡ f‹Þž '´ †&ÿ„û`ÿ‚Š"ArialT…-….‚ ‚ ÿ‚‚…‡2 ¼æ—SHOMITIks}…,b-… †&ÿ&TNPP †&ÿ…-…-…ð…ð…û‚¼"Systemn…-…ð~ul!1ÿ8Surveyor Help$Surveyor from Shomiti Systems, Inc.$Surveyor from Shomiti Systems, Inc.BCB("Glossary_Btn","&Glossary","JI(`Surveyor.hlp>Gloss',`Index')")BrowseButtons()CB("ID_EXIT","Close","Exit()")ZglossGlossary((fQÿÿàÿÿàZ howtosmlSurveyor Help( QÿÿàÿÿàZ howtolrgSurveyor HelpQ=<ÖQÿÿàÿÿàZ (w95sec)Surveyor Help2Q2QQÿÿàÿÿàZmainz [àrÿÿà  šîà? ×? ÿÿÿÿ EÿÿÿÿQ1ŠÿÿÿÿÿÿÿÿQèToolbars and Buttons> ' €.€ ˆ‚€‚ÿButtons and Toolbars’eQ!- *€Ê€ˆˆ‚€€€‚ÿToolbars and their buttons are shown below. Click on a button for a description of its function.:[' €&€œŒ‚€‚ÿSURVEYOR TOOLBAR4!0 0€ €ˆˆ‚€‡"€‚ÿH![×' €B€œŒ‚€‚ÿMODULE TOOLBAR ( SUMMARY VIEW)4 0 0€ €ˆˆ‚€‡"€‚ÿ=×H' €,€œŒ‚€‚ÿDETAIL VIEW TOOLBAR4 |0 0€ €ˆˆ‚€‡"€‚ÿ<H¸' €*€œŒ‚€‚ÿDATA VIEWS TOOLBARH|B T€€ˆˆ‚€†"€†"€†"€‚ÿ>¸>' €.€œŒ‚€‚ÿCAPTURE VIEW TOOLBAR>|9 B€€ˆˆ‚€†"€†"€‚ÿH>ÄB T€€ ˆˆ‚€†"€†"€ †"€‚ÿ>|9 B€€ˆˆ‚€†"€†"€ ‚ÿFÄH' €>€œŒ‚€‚ÿCREATE/MODIFY FILTER TOOLBAR5}0 0€ €ˆˆ‚€†"€ ‚ÿ 7H´' € €œŒ‚€‚ÿSTATE TOOLBAR4}è0 0€ €ˆˆ‚€‡"€ ‚ÿF´.1$ÿÿÿÿÿÿÿÿÿÿÿÿ. Capture Filter Button?èm' €0€˜ˆ‚€‚ÿCapture Filter ButtonŸw. ( €î€ˆˆ‚€‚‚ÿDisplay the State window for capture filters. The window displays a previously opened filter or the default filter.FmR1$ÿÿÿÿÿÿÿÿÿÿÿÿR0Display Filter Button? ‘' €0€˜ˆ‚€‚ÿDisplay Filter ButtonŸwR0( €î€ˆˆ‚€‚‚ÿDisplay the State window for display filters. The window displays a previously opened filter or the default filter.N‘~1ÿÿÿÿÿÿÿÿÿÿÿÿ~BTransmit Specification ButtonG 0Å' €@€˜ˆ‚€‚ÿTransmit Specification Button}V~B' €¬€ˆˆ‚€‚ÿBrings up the Transmit specification dialog box to define a transmit specification.LÅŽ1-ÿÿÿÿÿÿÿÿÿÿÿÿŽo Transmit from Buffer ButtonEBÓ' €<€˜ˆ‚€‚ÿTransmit from Buffer ButtonœuŽo ' €ê€ˆˆ‚€‚ÿBrings up a the dialog box to select a capture file and then load the capture file to the module for transmission.< Ó« 1¸ÿÿÿÿÿÿÿÿÿÿÿÿ« ' Help Button5o à ' €€˜ˆ‚€‚ÿHelp ButtonG« ' ( €>€ˆˆ‚€‚‚ÿDisplays the help contents.Aà h 1ÿÿÿÿÿÿÿÿÿÿÿÿh F Open File Button:' ¢ ' €&€˜ˆ‚€‚ÿOpen File Button¤|h F ( €ø€ˆˆ‚€‚‚ÿOpens a capture file (.CAP). A dialog box will display showing the current directory with all files with extension .CAP.A¢ ‡ 1Ùÿÿÿÿÿÿÿÿÿÿÿÿ‡  Save File Button:F Á ' €&€˜ˆ‚€‚ÿSave File Button^6‡  ( €l€ˆˆ‚€‚‚ÿSaves the current contents of this view to a file.; Á Z 1*ÿÿÿÿÿÿÿÿÿÿÿÿZ I Search Box4  Ž ' €€˜ˆ‚€‚ÿSearch Box»’Z I ) €%€ˆˆ‚€‚‚ÿUse the box to specify an ASCII text string to search for. Once the string is entered, press the search button to the right of the search box.> Ž ‡ 1tÿÿÿÿÿÿÿÿ ÿÿÿÿ‡ ½Search Button7I ¾ ' € €˜ˆ‚€‚ÿSearch ButtonÿÖ‡ ½) €­€ˆˆ‚€‚‚ÿStart search of the capture file contents for an ASCII string. Specify the string in the search box to the left. The first instance of the string is found starting from the current position in the capture file.< ¾ ù1pÿÿÿÿÿÿÿÿ ÿÿÿÿù9@Copy Button5½.' €€˜ˆ‚€‚ÿCopy ButtonÿÖù9@) €­€ˆˆ‚€‚‚ÿCopies the current contents of summary pane for pasting into other documents. A window displays with the text converted to ASCII format. Use the window to select the te.9@½xt you want and copy it to the clip board.= .v@1Õÿÿÿÿÿÿÿÿ ÿÿÿÿv@APrint Button69@¬@' €€˜ˆ‚€‚ÿPrint Buttonb:v@A( €t€ˆˆ‚€‚‚ÿPrint the currently selected line in the Summary Pane.= ¬@KA1Ñÿÿÿÿÿÿÿÿ ÿÿÿÿKAßAPrint Button6AA' €€˜ˆ‚€‚ÿPrint Button^6KAßA( €l€ˆˆ‚€‚‚ÿPrint the contents of the currently selected view.AA B1]ÿÿÿÿÿÿÿÿ ÿÿÿÿ B°E3F' €.€˜ˆ‚€‚ÿCreate Filter ButtoneõEÀF( €Ê€ˆˆ‚€‚‚ÿCreates a new filter. The default filter appears in the State or the Create/Modify Filter window.E3FG1UÿÿÿÿÿÿÿÿÿÿÿÿGHOpen a Filter Button<ÀFAG' €*€˜ˆ‚€‚ÿOpen Filter ButtonÔ«GH) €W€ˆˆ‚€‚‚ÿOpens a filter. A dialog box displays to select the file. Capture filters are designated with an extension of .CFD files and display filters with an extension of .DFD.CAGXH1YÿÿÿÿÿÿÿÿÿÿÿÿXHnISave Filter Button<H”H' €*€˜ˆ‚€‚ÿSave Filter ButtonÚ±XHnI) €c€ˆˆ‚€‚‚ÿSaves the current filter to a file. A dialog box displays to specify the file name and directory. Capture filters are saved as .CFD files and display filters as .DFD files.= ”H«I1Ïÿÿÿÿÿÿÿÿÿÿÿÿ«I=JPrint Button6nIáI' €€˜ˆ‚€‚ÿPrint Button\4«I=J( €h€ˆˆ‚€‚‚ÿPrints the current contents of the State window.; áIxJ1 ÿÿÿÿÿÿÿÿÿÿÿÿxJHKCut Button4 =J¬J' €€˜ˆ‚€‚ÿCut ButtonœtxJHK( €è€ˆˆ‚€‚‚ÿCut the selected State or ELSE IF statement. The button does not work if other types of statements are selected.; ¬JƒK1(ÿÿÿÿÿÿÿÿÿÿÿÿƒKpLAdd Button4 HK·K' €€˜ˆ‚€‚ÿAdd Button¹ƒKpL) €!€ˆˆ‚€‚‚ÿAdds a new level if an ELSE statement or ROOT statement is selected. Adds a new ELSE if statement if a State or an IF statement is selected.H·K¸L1oÿÿÿÿÿÿÿÿÿÿÿÿ¸LßMShow\Hide Detail ButtonApLùL' €4€˜ˆ‚€‚ÿShow/Hide Detail Button潸LßM) €{€ˆˆ‚€‚‚ÿShows or hides the details of the current filter. Details are the number of filters used per state (maximum = 8) and the types of frames being captured for each IF or ELSE IF statement.Y(ùL8N1ÿÿÿÿÿÿÿÿÿÿÿÿ8NçNLoad Filter Button (Capture Filter Only)=ßMuN' €,€˜ˆ‚€‚ÿLoad Filter Button rJ8NçN( €”€ˆˆ‚€‚‚ÿLoad the contents of the Filter window to the currently active module.[*uNBO19ÿÿÿÿÿÿÿÿÿÿÿÿBO,€Unload Filter Button (Capture Filter Only)@çN‚O' €2€˜ˆ‚€‚ÿDisable Filter Button žwBO,€' €î€ˆˆ‚€‚ÿDisable the current capture filter. Subsequent starting of the module will capture all‚O,€çN packets (use default filter).?‚Ok€1ÿÿÿÿÿÿÿÿÿÿÿÿk€=Trigger Button8,€£€' €"€˜ˆ‚€‚ÿTrigger Buttonšsk€=' €æ€ˆˆ‚€‚ÿMove to the trigger position in the current capture file. If no trigger position exists, move to the first line.C£€€1k ÿÿÿÿÿÿÿÿ€¼öKeyboard Shortcuts<=¼' €*€ ˆ‚€‚ÿKeyboard Shortcuts7€ó' € €œŒ‚€‚ÿFUNCTION KEYSý©¼ðƒT v€S€ˆˆ†le€ƒƒ‚€ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ƒƒ‚ÿKeySummary ViewDetail ViewF1HelpHelpF2System SettingsCapture View Display OptionsF3Module SettingsModule SettingsF4Module Monitor View PreferencesCreate Display FilterF5Connect to RemoteCreate Capture FilterF6Load Capture FilterLoad Capture FilterF7Open Capture FileExpert Summary ViewF8Save CaptureSave CaptureF9Go to Detail ViewCapture ViewF10Start/StopStart/StopF11N/AN/AF12N/AN/A=ó-„' €,€œŒ‚€‚ÿFROM ALL WINDOWS...i5ðƒ–„4 8€j€VˆˆA‚Ã}†Ai€ƒ‚ƒ‚ƒ‚ÿAlt + F4Close WindowCtrl + OOpenCtrl + SSave >-„Ô„' €.€œŒ‚€‚ÿFROM SUMMARY VIEW...|H–„P…4 8€€VˆˆA‚Ã}†Ai€ƒ‚ƒ‚ƒ‚ÿCtrl + TStart ModuleCtrl + PStop ModuleCtrl + RGo to Detail View=Ô„…' €,€œŒ‚€‚ÿFROM DETAIL VIEW..._-P…ì…2 4€Z€VˆˆA‚Ã}†Ai€ƒ‚ƒ‚ÿCtrl + TStart ModuleCtrl + PStop ModuleF…2†' €>€œŒ‚€‚ÿFROM CAPTURE VIEW WINDOW....s4ì…¥‡? L€i€VˆˆA‚Ã}†Ai€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿHomeSelect the first lineEndSelect the last linePage upScroll up one pagePage downScroll down one pageUp arrowSelect the preceding lineDown arrowSelect the next lineRight arrowMove data in Summary pane one character to the rightLeft arrow Move data in Summary pane one character to the leftK$2†ð‡' €H€œŒ‚€‚ÿFROM THE CAPTURE FILTER WINDOW..._/¥‡Oˆ0 0€^€Vˆˆi›~†i‰€ƒ‚ÿCtrl + NBring up new default capture filterN ð‡ˆ. ,€@€Vˆˆi›~„i€ƒ‚ÿCtrl + PPrint capture filterR"Oˆïˆ0 0€D€Vˆˆi›~†i‰€ƒ‚ÿHomeSelect the first statement=öˆ,‹G \€í€Vˆˆi›~„i€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿEndSelect the last statementPage upScroll up one pagePage downScroll down one pageUp arrowSelect the preceding statementDown arrowSelect the next statementTabSelect next stateShift + Tab Select previous statePlusExpand state (Numeric pad only)Asterisk (*)Expand branch (Numeric pad only)Minus (-)Collapse branch (Numeric pad only)Ctrl + AsteriskExpand all branches (Numeric pad only)SpaceBring up dialog box to edit statementDouble-clickBring up dialog box to edit statement fïˆÌ: B€Í€Vˆˆi›~„i€ƒ‚ƒ‚ƒ‚ÿRight mouseList possible actionsInsertAdd a statement or add a state.If a ROOT or ELSE statement is selected, add a state.If an IF statement is selected, add an ELSE IF statement before the ELSE statement.If an ELSE IF selected, add an ELSE IF statement after the currently selected statement.If a state is selected, add an IF statement; if an IF statement already exists for the state, add an ELSE IF statement.DeleteDelete statement or state.If an ELSE IF selected, remove the statement.If a state is selected, remove the entire state.If any other statement is selected, Delete performs no action.*,‹ö' €€ˆˆ‚€‚ÿ?Ì5Ž1"ÿÿÿÿÿÿÿÿÿÿÿÿ5ŽCapture Button=örŽ' €,€˜ˆ‚€‚ÿCapture Mode Button¦~5Ž( €ü€ˆˆ‚€‚‚ÿPlaces the currently selected resource in capture mode. This button is gray if the resource is currently active (started).?rŽW1ŽÿÿÿÿÿÿÿÿÿÿÿÿW²ÀMonitor Button=”' €,€˜ˆ‚€‚ÿMonitor Mode ButtonéW²À) €Ó€ˆˆ‚€‚‚ÿActivates the monitor functions for the currently selected resourc”²Àe. If the resource does not support monitoring functions, the resource is put into capture mode. This button is gray if the resource is currently active (started).@”òÀ1%ÿÿÿÿÿÿÿÿÿÿÿÿòÀ×ÁTransmit Button>²À0Á' €.€˜ˆ‚€‚ÿTransmit Mode Button§òÀ×Á( €þ€ˆˆ‚€‚‚ÿPlaces the currently selected resource in transmit mode. This button is gray if the resource is currently active (started).C0ÁÂ1çÿÿÿÿÿÿÿÿÿÿÿÿ¾ÂDetail View Button<×ÁVÂ' €*€˜ˆ‚€‚ÿDetail View Buttonh@¾Â( €€€ˆˆ‚€‚‚ÿBrings up the Detail View for the currently active resource.CVÂÃ1ŒÿÿÿÿÿÿÿÿÿÿÿÿÃJÄLoad Filter Button<¾Â=Ã' €*€˜ˆ‚€‚ÿLoad Filter Button äÃJÄ) €É€ˆˆ‚€‚‚ÿBrings up a dialog box to select a capture filter (.CFD extension). If a capture filter is opened, that filter is applied to the currently selected resource. This button is gray if the resource is currently active (started).E=ÃÄ1¨ÿÿÿÿÿÿÿÿ ÿÿÿÿÄòÅUnload Filter Button>JÄÍÄ' €.€˜ˆ‚€‚ÿUnload Filter Button%üÄòÅ) €ù€ˆˆ‚€‚‚ÿIf a filter is loaded for the currently selected module, the filter is disabled. This button has no function if the currently selected resource is in transmit or monitor only mode. This button is gray if the resource is currently active (started).MÍÄ?Æ1Ðÿÿÿÿÿÿÿÿ!ÿÿÿÿ?ÆÂÇTransmit Capture File Button9òÅxÆ' €$€˜ˆ‚€‚ÿTransmit ButtonJ!?ÆÂÇ) €C€ˆˆ‚€‚‚ÿBrings up a dialog box to select a transmit specification (.TSP extension) or a capture file (.CAP extension) for transmit. This button has no function if the currently selected resource is in capture or monitor mode. This button is gray if the resource is currently active (started).BxÆÈ1ÿÿÿÿÿÿÿÿ"ÿÿÿÿÈáÈName Table Button;ÂÇ?È' €(€˜ˆ‚€‚ÿName Table Button¢zÈáÈ( €ô€ˆˆ‚€‚‚ÿBrings up the name table dialog box for editing the current name table or saving /loading a name table to/from a file.A?È"É1‚ÿÿÿÿÿÿÿÿ#ÿÿÿÿ"ÉcÊOpen File Button:áÈ\É' €&€˜ˆ‚€‚ÿOpen File ButtonÞ"ÉcÊ) €½€ˆˆ‚€‚‚ÿOpens a file, typically a capture file (.CAP). A dialog box displays showing all files with extension .CAP in the current directory. From the Summary Viewer, selecting a capture file to open will bring up Capture View.< \ÉŸÊ1ÿÿÿÿÿÿÿÿ$ÿÿÿÿŸÊyËSave Button5cÊÔÊ' €€˜ˆ‚€‚ÿSave Button¥}ŸÊyË( €ú€ˆˆ‚€‚‚ÿSaves the current contents of the capture buffer to a file. A dialog box displays to specify the file name and directory.= ÔʶË1ÿÿÿÿÿÿÿÿ%ÿÿÿÿ¶Ë‹ÌStart Button6yËìË' €€˜ˆ‚€‚ÿStart ButtonŸw¶Ë‹Ì( €î€ˆˆ‚€‚‚ÿStarts a module. The module captures or transmits packets, depending on whether mode is set to transmit or capture.< ìËÇÌ1æÿÿÿÿÿÿÿÿ&ÿÿÿÿÇÌqÍStop Button5‹ÌüÌ' €€˜ˆ‚€‚ÿStop ButtonuMÇÌqÍ( €š€ˆˆ‚€‚‚ÿStops a module. The module ceases to capture packets or transmit packets.CüÌ´Í1pÿÿÿÿÿÿÿÿ'ÿÿÿÿ´ÍáÎPacket View Button=qÍñÍ' €,€˜ˆ‚€‚ÿCapture View ButtonðÇ´ÍáÎ) €€ˆˆ‚€‚‚ÿSelects Capture View mode for viewing captured information. You can see protocol decodes in this view. Capture View has its own toolbar to allow you to select other views of captured information.GñÍ(Ï1'ÿÿÿÿÿÿÿÿ(ÿÿÿÿ(ÏHost Table View Button@áÎhÏ' €2€˜ˆ‚€‚ÿHost Table View Button x(Ï( €ð€ˆˆ‚€‚‚ÿSelects Host Table View for viewing information. You can see MAC stations and their associated traffic in this hÏáÎview.LhÏ`1Mÿÿÿÿÿÿÿÿ)ÿÿÿÿ`aNetwork Station View ButtonN'®' €N€˜ˆ‚€‚ÿNetwork Layer Host Table View Button³Š`a) €€ˆˆ‚€‚‚ÿSelects Network Layer Host Table View for viewing information. You can see network (IP/IPX) and their associated traffic in this view.P®±1]ÿÿÿÿÿÿÿÿ*ÿÿÿÿ±¾Application Station View ButtonR+a' €V€˜ˆ‚€‚ÿApplication Layer Host Table View Button»’±¾) €%€ˆˆ‚€‚‚ÿSelects Application Layer Host Table View for viewing information. You can see application stations and their associated traffic in this view.H1'ÿÿÿÿÿÿÿÿ+ÿÿÿÿåHost Matrix View ButtonA¾G' €4€˜ˆ‚€‚ÿHost Matrix View Buttonžvå( €ì€ˆˆ‚€‚‚ÿSelects Host Matrix View for viewing information. You can see all conversations between MAC stations in this view.OG41Wÿÿÿÿÿÿÿÿ,ÿÿÿÿ4<Network Conversion View ButtonJ#å~' €F€˜ˆ‚€‚ÿNetwork Layer Matrix View Button¾•4<) €+€ˆˆ‚€‚‚ÿSelects Network Layer Matrix View for viewing information. You can see all network layer conversations and their associated traffic in this view.U$~‘1cÿÿÿÿÿÿÿÿ-ÿÿÿÿ‘ŸApplication Conversation View ButtonN'<ß' €N€˜ˆ‚€‚ÿApplication Layer Matrix View ButtonÀ—‘Ÿ) €/€ˆˆ‚€‚‚ÿSelects Application Layer Matrix View for viewing information. You can see all application conversations and their associated traffic in this view.R!ßñ1‰ÿÿÿÿÿÿÿÿ.ÿÿÿÿñ(Protocol Distribution View ButtonK$Ÿ<' €H€˜ˆ‚€‚ÿProtocol Distribution View ButtonìÃñ() €‡€ˆˆ‚€‚‚ÿSelects Protocol Distribution View for viewing a chart of the distribution of major protocols. Control buttons in this view allow you to customize the way you view the protocol distribution. T#<|1ÿÿÿÿÿÿÿÿ/ÿÿÿÿ|E Frame Size Distribution View ButtonM&(É' €L€˜ˆ‚€‚ÿFrame Size Distribution View Button|U|E ' €ª€ˆˆ‚€‚ÿSelects Frame Size Distribution View for viewing the distribution of frame sizes. AɆ 1ÿÿÿÿÿÿÿÿ0ÿÿÿÿ† d VLAN View Button:E À ' €&€˜ˆ‚€‚ÿVLAN View Button¤w† d - *€î€ˆˆ‚€€€‚ÿBrings up VLAN view for viewing network traffic on virtual LANs. Cisco’s ISL protocol is the only VLAN recognized.LÀ ° 1>ÿÿÿÿÿÿÿÿ1ÿÿÿÿ° ¢ Address mapping View ButtonAd ñ ' €4€˜ˆ‚€‚ÿAddress Map View Button±ˆ° ¢ ) €€ˆˆ‚€‚‚ÿBrings up Address Map View for viewing associations between MAC station names and addresses and network station names and addresses.Kñ í 1©ÿÿÿÿÿÿÿÿ2ÿÿÿÿí K MAC Statistics View ButtonD¢ 1 ' €:€˜ˆ‚€‚ÿMAC Statistics View Buttonòí K ( €å€ˆˆ‚€‚ÿBrings up MAC Statistics View for graphically viewing packet and error counters. This view also contains module and capture buffer status information. The view displays appropriate error counters depending on the mode, capture or transmit.X'1 £ 1qÿÿÿÿÿÿÿÿ3ÿÿÿÿ£ ¼Utilization/Error View Button (Capture)L%K ï ' €J€˜ˆ‚€‚ÿUtilization/Error View Button (Rx)ͤ£ ¼) €I€ˆˆ‚€‚‚ÿBrings up a strip chart that plots utilization and number of errors over time. The table for this view contains packet counters and error counters for receive. Y(ï 1rÿÿÿÿÿÿÿÿ4ÿÿÿÿ:@Utilization/Error View Button (Transmit)L%¼a' €J€˜ˆ‚€‚ÿUtilization/Error View Button (Tx)ͤ:@) €I€ˆˆ‚€‚‚ÿBrings up a strip chart that plots utilization and number of errors over time. The table for this view contains packea:@¼t counters and error counters for transmit.Ja„@1bÿÿÿÿÿÿÿÿ5ÿÿÿÿ„@œAAlarm List and Log ButtonC:@Ç@' €8€˜ˆ‚€‚ÿAlarm List and Log ButtonÕ¬„@œA) €Y€ˆˆ‚€‚‚ÿBrings up a table showing all alarm groups assigned to this resource. It lists alarm groups by name and identifies the type of alarm group, MAC, Token Ring, or Network.?Ç@ÛA1Êÿÿÿÿÿÿÿÿ6ÿÿÿÿÛAfBRefresh Button8œAB' €"€˜ˆ‚€‚ÿRefresh ButtonS,ÛAfB' €X€ˆˆ‚€‚ÿUpdate the information in all open views.IB¯B1Eÿÿÿÿÿÿÿÿ7ÿÿÿÿ¯B«CDuplicate Address ButtonBfBñB' €6€˜ˆ‚€‚ÿDuplicate Address Buttonº’¯B«C( €%€ˆˆ‚€‚ÿBrings up a table showing all duplicate IP and IPX addresses. Both the network and the MAC addresses detected for each duplicate are displayed.CñBîC1²ÿÿÿÿÿÿÿÿ8ÿÿÿÿîC]EExpert View Button<«C*D' €*€˜ˆ‚€‚ÿExpert View Button3ÿîC]E4 6€ÿ€ˆˆ‚€€€€€‚ÿBrings up a table showing all expert symptoms detected. There are two views of the expert information. The Analysis tab shows all expert symptoms detected. The Overview tab shows the total number of expert symptoms detected in each expert category.Q *D®E1uÿÿÿÿÿÿÿÿ9ÿÿÿÿ®EÒFApplication Response Time ButtonJ#]EøE' €F€˜ˆ‚€‚ÿApplication Response Time ButtonÚ±®EÒF) €c€ˆˆ‚€‚‚ÿBrings up a table showing the applications detected and their minimum, maximum, and average response times. The number of connections for each application is also displayed.@øEG1ëÿÿÿÿÿÿÿÿ:ÿÿÿÿG½GSettings Button9ÒFKG' €$€˜ˆ‚€‚ÿSettings ButtonrJG½G( €”€ˆˆ‚€‚‚ÿBrings up a dialog box to select global settings for a Capture Filter.U$KGH1.ÿÿÿÿÐ;H`H]OCapture and Display Filters OverviewN'½G`H' €N€ ˆ‚€‚ÿCapture and Display Filters OverviewÆH&K) €;€ˆ‚€‚‚ÿFor most data analysis operations, you'll want to look at only a subset of all data. Capture filters allow you to capture a subset of the network data. Filters allow you to select and count data in just about any way you can imagine. Display filters allow you to view a subset of the data you have already captured. They can be used to refine your view of captured information. For example, you might choose to capture all packets sent/received by a specific IP network station. Later, you might decide you want to look at the data for specific types of packets that are flowing through the station. A display filter allows you to view this subset of captured data.jB`HL( €…€ˆ‚€‚ÿSurveyor uses a layered approach to developing filters. If you want a simple filter, all filter options can be specified from a single window. However, if you need to create a very advanced filter with multiple states and tests to refine exactly what you're looking for, Surveyor supports a complete filtering language.{G&K N4 6€€ˆˆ‚€ã†€‰€‚ÿBefore trying to write your own filters, we suggest that you look at some of the example filters provided with the product. This will give you an idea of the types of filters that can be created. Once you discover all the capabilities of the interface, you'll have a powerful tool for getting exactly the data you want.2 L=N' €€œŒ‚€‚ÿSEE ALSO º N]Of š€u€ˆˆ‚ãÊ e¨€‰€‚ãHû…€‰€‚ãxˆ ]€‰€‚ã6Ì&s€‰€‚ã†îž%€‰€‚‚ÿGetting Started with the Filter Interface Simple Filters Advanced Filters Hints and Tips for Using FiltersStandard Filter Elements and Filter Element TemplatesZ)=N·O1ê ÿÿÿÿ<·O€Ê…Getting Started with the Filter InterfaceS,]O€' €X€ ˆ‚€‚ÿGetting Started with the Filter I·O€]OnterfaceÄ™·OÚ€+ $€3€ˆˆ‚€€‚ÿFor most users, filters can be created and applied from a single window. The overview below describes a simple way to get started with the interface.ý¥€׃X ~€O€VˆˆÈ:‚H€ƒ‚ƒ†"€ ‚ƒ†"€€€‚ƒ€€‚ƒ€€‚ÿ1.Select the resource you want to filter from the Resource Browser.2.Press the Detail View button.3.Press the Create/Modify Capture Filter button to bring up the Modify/Create Filter window.4.Click on a pre-defined filter element for the Available Filters box (right side of window). Suggestion: Try WWW_HTTP to collect HTTP traffic only.5.Select a specific station within the traffic. Enter an address in the Conversation area and click the Enable button. Enter addresses by selecting their corresponding names in the name table. Suggestion: Try selecting one MAC station from the name table. You will now capture only HTTP traffic for a single station.µzÚ€Œ„; F€ö€VˆˆÈ:‚H€ƒ€€‚ƒ†"€‚ÿ6.Press the ==> button. The filter element appears in the Combination Filter box.7.Press the Load Filter button.>׃Ê…) €+€ˆˆ‚€‚‚ÿOnce you are familiar with the basic steps and can create a subset of data within the capture buffer, you can look at the more complex features of the interface such as display filters, logic combinations, setting the capture buffer trigger position, and multi-state logic.?Œ„ †1 öƒô = †A†Simple Filters8Ê…A†' €"€ ˆ‚€‚ÿSimple Filters£n †ä‡5 8€Ý€ˆ‚€€ €€ €‚‚ÿSimple filters can be created using one interactive screen called the Create/Modify Filter window. To create a filter, you first select a resource and bring up Detail View. The Display Filter window is accessed by pressing the Create/Modify Display Filter button on the Detail View toolbar. You define the mask for a simple filter using any of the following:ùÇA†݈2 2€€VˆˆÈ:‚H€ ƒ€€‚ÿ·Pre-defined filter elements. A pre-defined filter element looks for a specific data pattern or a collection of data patterns. The filter element is supplied by Surveyor and cannot be changed.‡Uä‡dŠ2 2€«€VˆˆÈ:‚H€ ƒ€€‚ÿ·User-defined filter elements. A user-defined filter element also looks for a specific data pattern or a collection of data patterns. The element is created by the user in hexadecimal, decimal, or ASCII. You can base a user-deinfed filter element on a pre-defined filter element or use the filter interface to enter all data patterns.úÈ݈^‹2 2€‘€VˆˆÈ:‚H€ ƒ€€‚ÿ·Filter combination. A filter combination is built up from various user-defined or pre-defined filter elements. Logical operators such as AND, OR, and NOT are used to create the logic sequence.ÂdŠ Œ2 2€!€VˆˆÈ:‚H€ ƒ€€‚ÿ·Conversation. This is a mask specific to the source and destination addresses, including the protocol type and the direction of traffic.ˆY^‹¨/ ,€³€ˆ‚€‚€ €‚ÿEach Display or Capture filter applies only to the currently active resource. Once you have created and saved a unique filter element, you can access it from other resources.The Create/Modify Filter window has its own toolbar from which you can save, open, and create filters. Buttons are used to load and unload filters from the resource.2 ŒÚ' €€œŒ‚€‚ÿSEE ALSO?ͨr ²€›€ˆˆ‚ã)SO€‰€‚ãŠ, €‰€‚ãtà€‰€‚ãV^âM€‰€‚ãY%l$€‰€‚ã©\j[€‰€‚ÿActivating Capture and Display FiltersCreating and Applying a Conversation Creating Filter Elements Creating Filter Element Combinations Frame TypesSelecting Filter Elements U$Ún1†Ð>n¼›Creating and Applying a ConversationN'¼' €N€ ˆ‚€‚ÿCreating and Applying a ConversationËn“Á. *€;€ˆ‚€€ €‚ÿA conversation provid¼“Áes a convenient way to add addresses to a filter. You specify conversations for the filter by filling out the Conversation portion of the Create/Modify Filter window. The row consists of a protocol selection, frame type selection, two station addresses, a direction indicator, and an enable/disable check box. Refer to the table below for field definitions that comprise a conversation. D¼×Á* $€4€ ˜˜‚€ € ‚ÿDefining Conversations™)“ÁpÂp#°€RæD€€ŒŒÿ$€€ŒŒ‚€ €‚ÿ€2€ŒŒ‚ÿ$€4€ˆŒ‚€ €‚ÿÿÿConversation ElementDescriptione×ÁÕÂI#b€8æD€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿProtocolMAC, IP, or IPXÊ€pŸÃJ#b€æD€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿFrame Type All, EV2 (EthernetII), SNAP, 8022 (IEEE 802.2), 8023 (IEEE 802.3) Frame type applies to IP-layer addresses only.ˆ?ÕÂ'ÄI#b€~æD€€ˆŒ‚€‚ÿ€(€ˆŒ‚‚ÿÿÿStation Address 1Complete IP, IPX, or MAC station address.šNŸÃÁÅL#f€æD€€ˆŒ‚€‚ÿ€<€ˆŒ‚‚‚‚ÿÿÿTraffic Direction Indicator<-> Capture/Display all traffic between Station 1 and Station 2-> Capture/Display only the traffic where Station 1 is the Source Address and Station 2 is the Destination Address<- Capture/Display only the traffic where Station 2 is the Source Address and Station 1 is the Destination Addressˆ?'ÄIÆI#b€~æD€€ˆŒ‚€‚ÿ€(€ˆŒ‚‚ÿÿÿStation Address 2Complete IP, IPX, or MAC station address.´[ÁÅýÆY#‚€¶æD€€ˆŒ‚€‚ÿ€&€ˆŒ‚ÿ€(€ˆ‚‚ÿÿÿEnable check boxEnable (include) or Disable the conversation as part of the filter. ãºIÆàÇ) €u€ˆ‚€‚‚ÿOnce you select a valid address from the name table, the Enable box is automatically checked and the station address pattern is imported to the current pattern at the correct offset.AýÆ!È' €4€”Œ‚€ ‚ÿProtocol and Frame Type”GàǵÊM h€€ˆ‚€‚€ €€ €€ €€ €€ €€ €‚ÿThe protocol and the frame type are selected from pull-down boxes. Surveyor automatically restricts you from entering combinations that make no sense. If the station address is not the same type as the protocol selected, an error message appears. For example, if you set the protocol to IPX, you are not allowed to insert a MAC address. Only the frame types used with the selected protocol are allowed. For example, if the protocol is set to IP you can only select EV2 or SNAP. If the protocol is set to MAC, the frame type is set to All and no options are available.;!ÈðÊ' €(€”Œ‚€ ‚ÿStation Addresses.µÊÍ. *€€ˆ‚€€ €‚ÿStation addresses can be entered directly or by double-clicking on the button after either Station Address field. Double-clicking on either button brings up the current name table to select an address. The Name Table window shows all name and address associations, including the protocol and the frame type. The name and address associations displayed are those in the currently active name table. Double-clicking on a name table entry will load that name into the currently-selected Station Address field.P)ðÊnÍ' €R€ˆ‚€‚ÿThere are three station address types:¥SÍÏR r€§€VˆÈ:„H€€ƒ€€‚€€ƒ€€‚€€ƒ€€‚ÿ• MAC address – 12 hexadecimal digits.For example, 34FD34AA0001.• IP dot notation address – 4 decimal numbers in the range of 0 to 255, separated by dots. For example, 12.235.96.2.• IPX address – 20 hexadecimal digits (without port number) or 22 hexadecimal digits (with port number). For example, 34FD34AA0001000000A1.; nÍNÏ2 4€€v ˆŒÓ€Á€1†ÒÀ€€‚ÿNote:æÏs3 4€Í€v ŒŒ½€Á€„ˆ¼ÀÒ€€‚ÿYou will probably want to build a name table with the names and addresses of stations on your network. If you have a name tablNÏse for your network, be sure to load the name table so names are available in the Name Table window. 7üNϪ; D€ù€ˆ‚€€€‚€€€€‚ÿIf no value is entered for a Station Address field, all stations are captured. For example, if you set an address for Station 1, no address for Station 2, and set the direction to -> all packets having Station 1 as the Source Address are captured, regardless of the Destination Address.Use wildcards when specifying addresses to capture data on more than one station. An X used as a character for an address string means that any value will be accepted for that position; for example, 343F4AXXXXXX.Esï' €<€”Œ‚€ ‚ÿTraffic Direction Indicator᪠: B€Ã€ˆ‚€€€€€€€‚ÿThe direction indicator allows you to select a direction between stations. You can filter for packets going from Station 1 to Station 2 (->), Station 2 to Station 1 (<-), or gather packets in either direction (<->). :ïD' €&€”Œ‚€ ‚ÿEnable Check Box-ÿ q. *€ÿ€ˆ‚€€ €‚ÿTo apply the conversation to your filter, make sure that the Enable check box is selected. A single conversation is defined. If you want to use additional conversations, you can create an advanced filter or use wildcard characters as described above.*D›' €€ˆˆ‚€‚ÿJqå1‚ô ‘ ?å(y Selecting Filter ElementsC›(' €8€ ˆ‚€‚ÿSelecting Filter ElementsCåk 0 .€'€ˆ‚€€€‚‚‚ÿTo select a filter element, click on the element in the window and press the ==> button, or double-click on the filter element. The filter element is added to the filter combination box.Filter elements are the primary building blocks of a filter combination. A filter element contains the patterns for creating the logical conditions that will be used as a test against incoming frames. Filter elements are always assigned a name and that name is referenced in the filter combination. Filter element templates are provided which can be used as is, or you can define your own filter elements. See "Standard Filter Elements" in Appendix B for the filter elements supplied with Surveyor. Pre-defined filter elements are shown in red. You cannot alter the pre-defined filter elements.-ù(˜ 4 6€ó€ˆ‚€€€€€‚ÿMost filter elements have a defined offset and pattern within a frame. However, some elements have no specific offset and length, such as MatchAll. Some template filter elements have predefined values, such as MAC_DA_Broadcast (FFFFFFFFFFFF).7k Ï ' € €”Œ‚€ ‚ÿMacro Filters€F˜ O : B€€ˆ‚€€€€ €€€‚ÿThe standard filter elements provide templates that can be a combination of a few conditions – they can be more sophisticated than a simple byte-by-byte mask. For example, HTTP, TELNET, and SNMP are provided as single filter elements, but they consist of both source and destination ports. In other words, the element itself contains an OR condition, and will capture a value whether it appears in the offset for the source address or the offset for the destination address. The example Info window below shows the exact mask and conditions for the filter element WWW_HTTP.*Ï y ' €€ˆˆ‚€‚ÿIO  1E@ %LCreating Filter ElementsBy ' €6€ ˆ‚€‚ÿCreating Filter Elements. 2. *€€ˆ‚€€€‚ÿUser-defined elements allow precise control over the information captured or displayed. User-defined filter elements display in black under User_Defined_Filters in the filter elements list. Use the templates to aid in the creation of filter elements. ýÈ;B5 8€‘€ˆˆ‚€‚€€€€‚ÿThe small fields define the data patterns that comprise a filter element. The offset defines the position within the packet to start comparing the packe2;By t contents with the values in the pattern. If a match occurs, then this portion of the condition is satisfied. The pattern can be specified as a decimal, hexadecimal, or ASCII value. Use the Data format pull-down box to the right to specify if the pattern is in decimal, hexadecimal, or ASCII. Use the Offset format pull-down box to specify if the column and row headers display in decimal or hexadecimal. Note that although you can display the data in different fomats, all fomats use a byte boundary. Only byte quantities can be entered or displayed.1å2lDL f€Ë€ˆ‚€€ €€ €€€€ €€ €€ €‚ÿThe Name field shows the name of the filter element. Surveyor assigns a default name such as F1.Enter a unique name for the filter element in this field. Once you create a filter element and click on the ==> button, the name will appear in the filter elements list under User_Defined_Filters and in the Filter Combination box. You must use the ==> button so the filter element name appears in the Filter Combination box for the pattern to be used in the current filter.O;B»F: B€+€ˆ‚€€€€€€ €‚ÿFor example, assume you want to filter the IP destination address for the value 206.250.221.1. You could select the IP_DA template filter element and then change the template filter element to your needs. If you make a change to a pre-defined filter element, Surveyor assigns a name to the new filter element, which you can change in the Name field. The new filter element can be used to create the filter combinations you require for filtering frames. Use the ==> button to use the new filter element in the current filter.IýlDIL f€û€ˆ‚€€€€€€€€€€€€€‚ÿAny specific value you create for filter elements can have "don't care" values. For example, assume you're only looking for FF34 in the first two bytes of the MAC destination address. You could specify the values in your filter as FF34XXXXXX, where X indicates you don't care about the values in the last three offsets. Note that for IP addresses using decimal values you can only use X characters for complete sub-addresses. For example, 128.XXX.2.2 is allowed, but 128.12X.2.2 is not allowed.¬w»F°J5 8€ï€ˆ‚€€€‚€ €‚ÿThe hex or decimal patterns display in black or magenta. The magenta color indicate the bytes are a macro pattern, such as the logical OR of two different elements, or a conversation. Displays in magenta do not provide a complete view of the filter element in the Create/Modify Filter window. The information window provides complete details about any macro pattern. !óIÑK. *€ç€ˆˆ‚€€€‚ÿUse the Info.. button to see the exact offsets, patterns, and logical operators you have used to create the filter element. ASCII patterns display in hexadecimal in this window. Many ASCII patterns have no corresponding display character.*°JûK' €€ˆ‚€‚ÿ*ÑK%L' €€ˆˆ‚€‚ÿU$ûKzL1± @AzLÈL§‰Creating Filter Element CombinationsN'%LÈL' €N€ ˆ‚€‚ÿCreating Filter Element CombinationsÐzLÎN6 :€¡€ˆ‚€‚‚€ €€ €‚ÿA filter combination provides a way to create a more refined search for specific data. The filter combinations are built by selecting a combination of filter elements, operators, and custom counters. An example filter combination is shown below:MAC_SA AND (SMTP OR FTP)The Filter Combination field shows the syntax for the condition. Double-click on filters elements or single-click on operators (buttons) and they appear in the Filter Combination field. ÎÈLé€A P€€ˆ‚€€€€€‚ãY%l$€‰€‚ÿIf the operation you perform makes no sense to create a Filter Combination, the operation is not allowed. For example, an OR operator makes no sense after an AND operator. As another example, inserting a filter element immediately afterÎNé€%L another filter element makes no sense and the operation is not allowed.In addition to setting up a logical combination of filter elements, you can also select which frame types to include by selecting check boxes.fÎNv' €Ì€ˆ‚€‚ÿThe following table describes the buttons that are used as operators to create filter combinations.V,é€Ì* $€X€ ˜˜‚€ € ‚ÿOperator Buttons for Filter Combinations‹vW‚p#°€6ßN€€ŒŒÿ$€€ŒŒ‚€ €‚ÿ€€ŒŒ‚ÿ$€€ˆŒ‚€ €‚ÿÿÿButtonDescription̓Ì$ƒJ#b€ßN€€ˆŒ‚€‚ÿ€ €ˆŒ‚‚ÿÿÿANDInsert logical AND operator. The AND operator has a higher priority than the OR operator (i.e., will be interpreted first).k"W‚ƒI#b€DßN€€ˆŒ‚€‚ÿ€ €ˆŒ‚‚ÿÿÿORInsert logical OR operator.m$$ƒüƒI#b€HßN€€ˆŒ‚€‚ÿ€ €ˆŒ‚‚ÿÿÿNOTInsert logical NOT operator.&܃"…J#b€¹ßN€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿ(Insert Open Parentheses. Along with the closed parentheses, establishes the ordering and interpretation of the operands. For example, MAC_SA AND SMTP OR FTP is interpreted differently from MAC_SA AND (SMTP OR FTP).Ãzüƒå…I#b€ôßN€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿ)Insert Closed Parentheses. Along with the open parentheses, establishes ordering and interpretation of the operands."…d‡`#Ž€?ßN€€ˆŒ‚€‚ÿ€€ˆŒ‚ÿ$€€ŒŒ‚€€‚ÿÿÿCounter 1Adds a filter element for testing against a value. The most common use of Counter 1 is to increment the counter based on a condition (e.g., receiving a broadcast packet) and then begin capture once a threshold is reached. Counter 1 is a setting for capture filters only.4å…ñ‡Y#‚€hßN€€ŒŒ‚ÿ€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿClearClears the entire filter combination box.°gd‡¡ˆI#b€ÎßN€€ˆŒ‚€‚ÿ€ €ˆŒ‚‚ÿÿÿCEClears the Last Entry. Erases only the last operator or element added to the filter combination.Ü’ñ‡}‰J#b€%ßN€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿActionSpecifies the action to take when the end of the current state is reached. See Actions in the Advanced Filters section of this chapter.*¡ˆ§‰' €€ˆ‚€‚ÿ< }‰ã‰10‘ gˆB㉊6ÀFrame Types5§‰Š' €€ ˆ‚€‚ÿFrame Typesžc㉶Œ; D€Ç€ˆ‚€€ €‚€ €€ €‚ÿFour types of frames can be collected and displayed. Refine your selection criteria by selecting only a subset of all frame types. If all boxes are checked, all frame types will be subjected to the other filter criteria you have specified in the Create/Modify Filter window.The frame type check boxes allow you to select the types of frames you want to capture. For example, if you want to capture only good frames, leave the Good Frames box checked and deselect all other frame types. If you want to capture only error frames, leave all frame types selected with the exception of the Good Frames box.M#Š* $€F€ ˜˜‚€ €‚ÿCapture and Display Frame Types¶Œ’p#°€>ßN€€ŒŒÿ$€€ŒŒ‚€ €‚ÿ€€ŒŒ‚ÿ$€ €ˆŒ‚€ €‚ÿÿÿFrame TypeDescriptiont+ŽI#b€VßN€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿGood FramesFrames that have no errors.®e’´ŽI#b€ÊßN€€ˆŒ‚€‚ÿ€&€ˆŒ‚‚ÿÿÿCRC Error FramesAll frames that contain CRC or Alignment errors (this will include runt frames).”KŽHI#b€–ßN€€ˆŒ‚€‚ÿ€€ˆŒ‚‚ÿÿÿFragmentsAll fragments. All fragments are also considered CRC errors. ¥L´Ž ÀY#‚€˜ßN€€ˆŒ‚€‚ÿ€€ˆŒ‚ÿ€ €ˆ‚‚ÿÿÿOther FramesAll other types of frames. For example, an oversize frame.H À§‰*H6À' €€ˆ‚€‚ÿA ÀwÀ1W ÿÿÿÿnCwÀ±À×ËAdvanced Filters:6À±À' €&€ ˆ‚€‚ÿAdvanced FiltersÓwÀ„ÄD V€!€ˆ‚€‚€ €†"€€ €€ €‚ÿTo create more precise Surveyor filters, you use a graphical scripting language. You'll find it intuitive and easy to use if you have experience doing simple programming or experience working with meta-languages. After you become familiar with this graphical scripting language, you'll have a powerful tool for getting exactly the data you want. It is recommended that you first have an understanding of simple filters before attempting to create advanced filters.For simple filters you use the Modify/Create Filter window to specify filter conditions. Actually, the conditions specified in this window form only one statement this is part of a filter structure which can have many different states, multiple conditions, and perform a variety of actions based on which filter criteria is satisfied. Click on the State button in the Modify/Create Filter window to view the State window for the filter}N±ÀÇ/ ,€€ˆ‚€€ €‚‚ÿFrom the State window you view the entire structure of the filter. The windows show all the filter statements and the structure of the filter. Each statement is composed of conditions and actions to take if the condition is satisfied. Dialog boxes are used to create/modify the statements. You do not need to memorize specific syntax. Convenient buttons are available to save, create, open, load, and unload Capture and Display filters. You can also add/delete statements from the toolbar or from the menus. When you add or modify a statement, its associated dialog box is displayed. c5„ÄdÈ. *€k€ˆ‚€€ €‚ÿAll changes and additions to the filter are made from dialog boxes. Dialog boxes appear when you double-click on the statements shown in the window; keystrokes and the right mouse button are context sensitive within the State window. You can write and attach a description to a Capture or Display Filter.s/Ç×ÊD V€_€ˆˆ‚€€ €€ãûn£€‰€‚€€‚ÿKeystrokes in the State window are also context sensitive. For example, pressing the Insert key when the ROOT statement is selected inserts a new State; pressing the Insert key on a State inserts an IF statement. See keyboard shortcuts for a list of keystroke actions and their results.You can expand or collapse states of the filter from the menus if you need more room to view other states in the window. Collapsed states (also called branches) are surrounded by dashed line. The currently selected statement is highlighted with a red border.2 dÈ Ë' €€œŒ‚€‚ÿSEE ALSOÎj×Ê×Ëd ˜€Ô€ˆˆ‚ã-X?³€‰€‚ãÏk/B€‰€‚ã2­€‰€‚ãY§Æp€‰€‚ãOÿÎù€‰€‚ÿActions Filter Structure Rules for Capture and Display FiltersStatements States W& Ë.Ì1` €‚ D.Ì~̹Capture and Display Filter DifferencesP)×Ë~Ì' €R€ ˆ‚€‚ÿCapture and Display Filter Differencesì.Ì’Í( €Ù€ˆ‚€‚ÿDisplay and capture filters are activated in different ways. Also, some options for capture filters are not used in display filters. Some options available in capture filters make no sense for display and are therefore not supported:uH~ÌÎ- *€€VˆÈ:‚H€ƒ€‚ÿ·Display filters do not use custom counters (Counters 1, 2, or 3). ü¼’ÍÏ@ N€y€VˆÈ:‚H€ƒ€€ €€ €€ €‚ÿ·The action for display filters is Display. Actions for capture filters are Capture and Trigger. Actions for capture filters include incrementing counters (Counters 1, 2, or 3).5ÎD. *€€VˆÈ:‚H€ƒ€‚ÿ·Display filters do not have global settings. The Settings button in the Filter Display window is not active when viewing a display filter. Global settings for the capture filter include a global value yoÏD×Ëu can set for Counter 1 and a buffer trigger position.HÏŒ* $€<€”Œ‚€ € ‚ÿActivating Display FiltersÇhDS_ Œ€Õ€ˆ‚€†"€€ €€ €†"€€ €€ €‚€ €€ €‚ÿActivate a display filter by pressing the button on the Create/Modify Filter or State toolbar. Unload a display filter by pressing the press the button on the State or Create/Modify Filter toolbar. If you close the window, the display filter is no longer active.You can keep the display filter loaded at all times; if you make changes, the next time you view data in Capture View the new filter will be used immediately. If you already have a Capture View window open for the capture file, select the Refresh... option from the File menu in Capture View to refresh the view using the new filter.HŒ›* $€<€”Œ‚€ € ‚ÿActivating Capture FiltersÆS¹X ~€‘€ˆ‚€†"€€€€ €€ €†"€€ €€ €‚ÿThe capture filter must be loaded to the hardware module. It is not active until you press the button on the State or Create/Modify Filter toolbar. It remains active for that module until you unload the filter. Unload a capture filter by pressing the press the button on the State or Create/Modify Filter toolbar. Since capture filters are associated with a hardware module, different capture filters can be loaded to different modules.A›ú1¼€A Eú4¿ Filter Structure:¹4' €&€ ˆ‚€‚ÿFilter Structureã³ú0 .€g€ˆˆ‚€€€‚‚‚ÿThe capture or display filter consists of labels and a series of statements that define actions. The actions result in the subset of data that is captured or displayed by Surveyor. The statements and labels have an order, structure, and syntax. You always start and stay in State0 until an action takes you to a different state.The capture file has the following structure:Root statement (Contains settings for global variables)Hø4_ P n€ñ€ˆˆ„H€ƒ€€ƒƒƒƒƒƒƒƒ‚ƒ€€ƒƒƒƒƒƒƒƒ‚ÿSTATE0 identifier (Label for GoTo actions)IF statement (Specify conditions and actions)ELSE IF statement (optional - same structure as IF statement)other ELSE IF statementsELSE statement (if no conditions satisfied, take these actions)STATE1 identifier (Label for GoTo actions)IF statement (Specify conditions and actions)ELSE IF statement (optional - same structure as IF statement)other ELSE IF statementsELSE statement (if no conditions satisfied, take these actions)`¿ K d€+€ˆˆ„H€ƒƒƒƒ‚ƒƒƒƒ‚ƒƒƒƒ‚ƒ€€ƒƒƒƒƒƒƒƒ‚ÿ.........STATE7 identifier (Label for GoTo actions)IF statement (Specify conditions and actions)ELSE IF statement (optional - same structure as IF statement)other ELSE IF statementsELSE statement (if no conditions satisfied, take these actions)7_ ö 1¢n€Fö & y@States0 ¿ & ' €€ ˆ‚€‚ÿStatesVö |< F€5€ˆˆ‚€‚‚ƒƒƒƒƒƒƒ‚ƒƒƒƒƒ‚ÿStates are similar to labels (addresses) for a set of statements. States allow multiple sets of statements in a filter. You can specify up to 8 states. You always start and stay in State0 until an action takes you to a different state.In most instances, you will only need only one or two states in a filter. Here is example filter showing three states:STATE0IF (DA=Santosh) GoTo State1ELSE IF (DA=Yancy) GoTo State2ELSE GoTo CurrentStateSTATE1IF (DA_IP_Filter1) Counter1; Capture; GoTo CurrentStateELSE GoTo State0ñÁ& y@0 .€ƒ€ˆˆ‚€ƒƒƒƒƒ‚‚ÿSTATE2IF (DA_IP_Filter2) Counter2; Capture; GoTo CurrentStateELSE GoTo State0States are selected in the action portion of dialog boxes for statements. CurrentState means stay in the state number that contains the statement. When you select a state other than the current state, a GoTo phrase will display as part of the statement i|y@¿ n the Filter window. The GoTo state always displays for the ELSE statement, even if it's the current state.; |´@17A 3…G´@è@îFStatements4 y@è@' €€ ˆ‚€‚ÿStatementsÍ¥´@µB( €K€ˆˆ‚€‚ÿStatements create a condition and specify actions to be taken if the condition is satisfied. Once a condition is true, the next condition is not examined. For the next frame you remain in the current state or go to a different state, depending on the GoTo action specified in the statement. If no condition is met, the actions in the ELSE statement are taken. Below is a synopsis of the logic sequence for statements: Ö¤è@‹D2 2€I€ˆˆ„€ƒƒƒƒ‚‚ÿIF statement IF (these conditions are satisfied) THEN (take these actions, go to State x)ELSE IF statementIF (these conditions are satisfied) THEN (take these actions, go to State x)ELSE IF statement IF (these conditions are satisfied) THEN (take these actions, go to State x)ELSE statementELSE (take these actions, go to State x)There is also a ROOT statement which sets global variables for capture filters.7صBÂF_ Œ€µ€ˆˆ‚€€€€€€€€€†"€†"€€€‚€€‚ÿFor IF or ELSE IF statements, the conditions of the statement are created using the Create/Modify Filter window. If you are adding a statement, you cannot load the filter until you return to the State window. The and buttons on the Create/Modify Filter toolbar are disabled.The dialog box for the ELSE statement specifies the actions when no conditions for previous statements are satisfied. You can only specify actions and the next state to execute. ,‹DîF) "€€ˆˆ„€‚ÿ8ÂF&G1€=ŠH&GWGµMActions1 îFWG' €€ ˆ‚€‚ÿActions¸&GH( €!€ˆˆ‚€‚ÿActions are set in the action portion of the dialog box for IF and ELSE IF statements. Actions are all that can be set in an ELSE statement. =WGLH' €,€œŒ‚€‚ÿCAPTURE FILTER ONLYT-H H' €Z€ˆˆ‚€‚ÿActions available for capture filters are:DLHäJ5 8€€Vˆˆ±S~„±€ƒ‚ƒ‚ƒ‚ƒ‚ÿCapture Capture the frame.TriggerCapture the frame and mark it as a trigger. In view mode, a trigger frame is numbered as frame zero and marked with the name TRIGGER.CounterIncrement the custom counter. Counter 1, Counter 2, Counter 3, or any combination of the custom counters can be incremented.GoTo State Go to a state. The state can be the current state or any other state defined in the capture filter. The state is like a label or routine name in a program. It's there so it can be referenced by a GoTo action.ç³ HËK4 6€g€ˆˆ‚€âŸö%°€‰€‚ÿIf Trigger is selected as an action, Capture is automatically selected as well. The only function of trigger is to mark a frame to specify the post trigger buffer position.=äJL' €,€œŒ‚€‚ÿDISPLAY FILTER ONLYT-ËK\L' €Z€ˆˆ‚€‚ÿActions available for display filters are:Y(LµM1 0€Q€Vˆˆ±S~„±€ƒ‚ƒ‚ÿDisplay is the only action available in statements for display filters.GoTo State Go to a state. The state can be the current state or any other state defined in the display filter. The state is like a label or routine name in a program. It's there so it can be referenced by a GoTo action.L\LN1å3…Ç INQNÿ‚Rules of the Capture FilterP)µMQN' €R€ ˆ‚€‚ÿRules of the Capture or Display FilteržqNïN- *€â€VˆÈ:‚H€ƒ€‚ÿ·Counter 1 is the only custom counter that can be used as an element to create a filter element combination.­nQNœO? N€Ü€VˆÈ:‚H€ƒ€€€€€€€‚ÿ·There is always at least one IF and one ELSE statement per state. ELSE IF statements are optional.€SïN(€- *€¦€VˆÈ:‚H€ƒ€‚ÿ·The Post Trigger Buffer Position must be greater thœO(€µMan zero and less than 100.˜_œOÀ€9 B€¾€VˆÈ:‚H€ƒ€€€€€‚ÿ·There is always one and only one ROOT statement; you can't delete the ROOT statement.rE(€2- *€Š€VˆÈ:‚H€ƒ€‚ÿ·In the capture filter, setting trigger will always set capture.ÍœÀ€ÿ‚1 0€9€VˆÈ:‚H€ ƒ€€‚ÿ·There are a maximum number of filters within analyzer-card hardware; there are 8 for CMM2s and 4 for GAMs. Depending on the number of states, the micro filters, and the logic combinations used, it is possible to exceed the maximum number of hardware filters. Contact Shomiti customer support if you are experiencing problems with writing complex filters that exceed the maximum number of hardware filters.Q 2Pƒ1–gˆ€JPƒšƒºÁHints and Tips for Using FiltersJ#ÿ‚šƒ' €F€ ˆ‚€‚ÿHints and Tips for Using Filters~QPƒ„- *€¢€VˆˆÈ:‚H€ ƒ€‚ÿ·Remember to load the Capture filter on the module before you start capture.욃2…. *€Ù€VˆˆÈ:‚H€ ƒ€‚ÿ·If you want to look at captured data in many different ways, use display filters rather than capture filters. Capture large blocks of unfiltered data and look at different subsets of the data by using a variety of display filters.•b„Ç…3 6€Ä€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Use the Info button to find out the exact mask and logical operations in a filter element.‘d2…X†- *€È€VˆˆÈ:‚H€ ƒ€‚ÿ·Use conversations for capturing or displaying station-to-station or router-to-router activity.ŒYÇ…ä†3 6€²€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Always attach a description to a filter you are saving with the Description menu.ÕX†ó‡: B€«€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To see which capture filter is associated with the current resource, choose Active TSP and Capture Filter from the Module menu. The capture filter name is also displayed in the status bar in Detail view.#ï䆉4 6€ß€VˆˆÈ:‚H€ ƒ€€€‚ÿ·In the Create/Modify Filter window, make sure that the elements you want in the filter are displayed in the Filter Combination box. If an element is not displayed in the Combination box, it is not part of the filter to be applied. „W󇚉- *€®€VˆˆÈ:‚H€ ƒ€‚ÿ·Be sure to check the Enable box to include a conversation as part of your filter.D‰ÞŠ. *€-€VˆˆÈ:‚H€ ƒ€‚ÿ·AND operations narrow the search results and are typically used between elements that define masks for different offsets and lengths. Using AND operations between filter elements that define masks for the same offsets and lengths often result in filtering out all packets.¶ˆš‰”‹. *€€VˆˆÈ:‚H€ ƒ€‚ÿ·OR operations expand the search results and are useful between filter elements that define masks for the same offsets and lengths.‚OÞŠŒ3 6€ž€VˆˆÈ:‚H€ ƒ€€€‚ÿ·To edit a statement in the State window, double-click on the statement.ïÁ”‹. *€ƒ€VˆˆÈ:‚H€ƒ€‚ÿ·Use the right mouse button to learn about the options available for any statement in a filter. You can immediately see what options are possible depending on where you are in the filter. …IŒŠ< H€”€VˆˆÈ:‚H€ƒ€†"€€ €‚ÿ·Use the button to add states or statements to the State window.”XŽ< H€²€VˆˆÈ:‚H€ƒ€†"€€ €‚ÿ·Use the button to go to the State window to create a mulit-state logic filter.…QŠ£4 6€£€VˆˆÈ:‚H€ ƒ€€€‚ÿ·From the Detail View pane of the Capture View window, you can copy the contents of any field to create a Capture or Display filter. Select the field with the left mouse and then click the right mouse. Selections for copy to capture or display filter appear. Select the option you want and the Create/Modify Filter window appears.ÞªŽÁ4 6€U€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Click the right mouse button on a tab£Áÿ‚le entry in Host Table, Network Table, Application Table, Host Matrix, Network Matrix, or Application Matrix view to bring up a menu for creating a filter. You will get a choice of creating a capture or display filter. When you make a choice from the menu, the Create/Modify Filter window opens with the address(es) from the table entry in the address fields for creating a filter.-£ºÁ* $€€VˆÈ:„H€‚ÿf5Á Â1X@͉K  ñ Standard Filter Elements and Filter Element TemplatesP)ºÁpÂ' €R€ ˜‚€‚ÿStandard Filter Elements and Templates°/  Ã#Ò€^ä0 F » €€ˆˆÿ€€ˆˆ‚€ ‚ÿ€&€ˆˆ‚‚ÿ€@€ˆˆ‚‚ÿ€P€ˆˆ‚‚ÿÿÿFilter Element DescriptionOffsetValueþÖpÂÄ( €­€ˆˆ‚€‚ÿAll filter elements and templates supplied with Surveyor are described below. Templates need to be given a value and saved as a user-defined filter element before they can be used in a capture or display filter.g8 Ã…Ä/ .€p€6 „„ŽŽ†…€ €‚ÿSurveyor Filter Elements and Templates, Ethernet EV2ã5ÄhÅ®#,jê;QÆ€€6„„ŽŽ‚ÿ.€€6„„ŽŽ†‹€ €‚ÿ.€&€6„„ŽŽ†‹€ €‚ÿ.€D€6„„ŽŽ†‹€ €‚ÿ.€X€6„„ŽŽ†‹€ €‚ÿÿÿFilter ElementDescriptionOffsetValueh…ÄÆ±#2Ðê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €°€6„„ŽŽ†‹ÿ"€²€6„„ŽŽ†‹‚ÿ €º€6„„ŽŽ†‹ÿ"€¼€6„„ŽŽ†‹‚ÿÿÿAppleTalkCollect all AppleTalk packet types embedded in Ethernet Version II frames.12HEX 809B \hŎDZ#2¸ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €˜€6„„ŽŽ†‹ÿ"€š€6„„ŽŽ†‹‚ÿ €¢€6„„ŽŽ†‹ÿ"€¤€6„„ŽŽ†‹‚ÿÿÿARPCollect all ARP packet types embedded in Ethernet Version II frames.12HEX 0806FÆÔÈ·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €¾€6„„ŽŽ†‹ÿ(€À€6„„ŽŽ†‹‚ÿ €æ€6„„ŽŽ†‹ÿ&€è€6„„ŽŽ†‹‚ÿÿÿDNS (TCP)Collect all frames with an DNS port when TCP is embedded in an Ethernet II frame.12 23 34 OR 36HEX 0800HEX 06 DEC 0.53GŽÇÊ·#‡a·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €²€6„„ŽŽ†‹ÿ(€´€6„„ŽŽ†‹‚ÿ €Ú€6„„ŽŽ†‹ÿ&€Ü€6„„ŽŽ†‹‚ÿÿÿLDAPCollect all frames with an LDAP port when TCP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 06DEC 389&u#‡ ±#2êê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €¼€6„„ŽŽ†‹ÿ"€¾€6„„ŽŽ†‹‚ÿ €Ä€6„„ŽŽ†‹ÿ"€Æ€6„„ŽŽ†‹‚ÿÿÿMAC_DATemplate for setting a destination address. Filters for addresses at the MAC level.0HEX XXXXXXXXXXXXúIa ±#2’ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€&€6„„ŽŽ†‹‚ÿ €f€6„„ŽŽ†‹ÿ"€h€6„„ŽŽ†‹‚ÿ €n€6„„ŽŽ†‹ÿ"€p€6„„ŽŽ†‹‚ÿÿÿMAC_DA_BROADCASTCollect all broadcast frames. 0HEX FFFFFFFFFFFùH‡ z ±#2ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €b€6„„ŽŽ†‹ÿ"€d€6„„ŽŽ†‹‚ÿ €j€6„„ŽŽ†‹ÿ"€l€6„„ŽŽ†‹‚ÿÿÿMAC_SATemplate for setting a source address.6HEX XXXXXXXXXXXX@‰ º ·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €®€6„„ŽŽ†‹ÿ(€°€6„„ŽŽ†‹‚ÿ €Ú€6„„ŽŽ†‹ÿ&€Ü€6„„ŽŽ†‹‚ÿÿÿNFSCollect all frames with an NFS port when UDP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 11 DEC 2049B‹z ü ·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €²€6„„ŽŽ†‹ÿ(€´€6„„ŽŽ†‹‚ÿ €Þ€6„„ŽŽ†‹ÿ&€à€6„„ŽŽ†‹‚ÿÿÿNNTPCollect all frames with an NNTP port when TCP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 06DEC 0.119eº ³#6Êê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €’€6„„ŽŽ†‹ÿ$€”€6„„ŽŽ†‹‚ÿ €¤€6„„ŽŽ†‹ÿ$€¦€6„„ŽŽ†‹‚ÿÿÿOSPFCollect all frames where OSFP is embedded in Ethernet II frames.12 23HEX 0800 DEC 89öEü @±#2Šê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €j€6„„ŽŽ†‹ÿ"€l€6„„ŽŽ†‹‚ÿ €t€6„„ŽŽ†‹ÿ"€v€6„„ŽŽ†‹‚ÿÿÿPacket_TypeTemplate for setting the packet type.12@ºÁHEX XXXXi0A±#2Òê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€4€6„„ŽŽ†‹‚ÿ €¨€6„„ŽŽ†‹ÿ"€ª€6„„ŽŽ†‹‚ÿ €²€6„„ŽŽ†‹ÿ"€´€6„„ŽŽ†‹‚ÿÿÿPacket_Type_Novell8023 Filter element for collecting Novell 802.3 packet types.12HEX XXXXFFFF ?ˆ@oB·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €¬€6„„ŽŽ†‹ÿ(€®€6„„ŽŽ†‹‚ÿ €Ø€6„„ŽŽ†‹ÿ&€Ú€6„„ŽŽ†‹‚ÿÿÿPOPCollect all frames with a POP port when TCP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 06DEC 0.110B‹0A±C·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €´€6„„ŽŽ†‹ÿ(€¶€6„„ŽŽ†‹‚ÿ €à€6„„ŽŽ†‹ÿ&€â€6„„ŽŽ†‹‚ÿÿÿQ.931Collect all frames with a Q.931 port when TCP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 06DEC 1720>‡oBïD·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €¬€6„„ŽŽ†‹ÿ(€®€6„„ŽŽ†‹‚ÿ €Ø€6„„ŽŽ†‹ÿ&€Ú€6„„ŽŽ†‹‚ÿÿÿRIPCollect all frames with a RIP port when UDP is embedded in Ethernet II frames.12 23 34 OR 36HEX 0800HEX 11 DEC 520e±CF³#6Êê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €’€6„„ŽŽ†‹ÿ$€”€6„„ŽŽ†‹‚ÿ €¤€6„„ŽŽ†‹ÿ$€¦€6„„ŽŽ†‹‚ÿÿÿRSVPCollect all frames where RSVP is embedded in Ethernet II frames.12 23HEX 0800 DEC 46EŽïDLG·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €¶€6„„ŽŽ†‹ÿ(€¸€6„„ŽŽ†‹‚ÿ €â€6„„ŽŽ†‹ÿ&€ä€6„„ŽŽ†‹‚ÿÿÿRTCPCollect all frames with an RTCP port when UDP is embedded in an Ethernet II frame.12 23 34 OR 36HEX 0800HEX 11 DEC 0.161CŒFH·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €¶€6„„ŽŽ†‹ÿ(€¸€6„„ŽŽ†‹‚ÿ €â€6„„ŽŽ†‹ÿ&€ä€6„„ŽŽ†‹‚ÿÿÿSMTPCollect all frames with an SMTP port when TCP is embedded in an Ethernet II frame.12 23 34 OR 36HEX 0800HEX 06DEC 0.25€ÅLGJ»#D‹ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €²€6„„ŽŽ†‹ÿ&€´€6„„ŽŽ†‹‚ÿ €Î€6„„ŽŽ†‹ÿ0€Ð€6„„ŽŽ†‹‚ÿÿÿSNMPCollect all frames with an SNMP port when UDP is embedded in Ethernet II frames.12 23 43 HEX 0800 HEX 11 DEC 200 OR DEC 201 OR DEC 202 OR DEC 203 OR DEC 204 OR DEC 205cH%K³#6Æê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €Ž€6„„ŽŽ†‹ÿ$€€6„„ŽŽ†‹‚ÿ € €6„„ŽŽ†‹ÿ$€¢€6„„ŽŽ†‹‚ÿÿÿTCPCollect all frames where TCP is embedded in Ethernet II frames.12 23HEX 0800 HEX 06DJiL·#<ê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€€6„„ŽŽ†‹‚ÿ €¸€6„„ŽŽ†‹ÿ(€º€6„„ŽŽ†‹‚ÿ €à€6„„ŽŽ†‹ÿ&€â€6„„ŽŽ†‹‚ÿÿÿTELNETCollect all frames with a TELNET port when UDP is embedded in Ethernet II frames.12 23 34OR 36HEX 0800 HEX 06 DEC 0.23c%KM³#6Æê;QÆ(€€6„„ŽŽ†‹€‚ÿ"€ €6„„ŽŽ†‹‚ÿ €Ž€6„„ŽŽ†‹ÿ$€€6„„ŽŽ†‹‚ÿ € €6„„ŽŽ†‹ÿ$€¢€6„„ŽŽ†‹‚ÿÿÿUDPCollect all frames where UDP is embedded in Ethernet II frames.12 23HEX 0800 HEX 11GiLÆN·#€µ€/ .€|€6 „„ŽŽ†…€ €‚ÿSurveyor Filter Elements and Templates, Ethernet SNAP, LLCä6H€™®#,lê;QÆ€€6„„ŽŽ‚ÿ.€€6„„ŽŽ†…€ €‚ÿ.€(€6„„ŽŽ†…€ €‚ÿ.€F€6„„ŽŽ†…€ €‚ÿ.€Z€6„„ŽŽ†…€ €‚ÿÿÿFilter Element DescriptionOffsetValueOµ€™‚±#2žê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €‚€6„„ŽŽ†…ÿ"€„€6„„ŽŽ†…‚ÿ €Œ€6„„ŽŽ†…ÿ"€Ž€6„„ŽŽ†…‚ÿÿÿDSAP Template for setting the LLC destination address point.14HEX XXöE™ƒ±#2Šê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €f€6„„ŽŽ†…ÿ"€h€6„„ŽŽ†…‚ÿ €p€6„„ŽŽ†…ÿ"€r€6„„ŽŽ†…‚ÿÿÿSNAPFilter element for collecting SNAP frames.14HEX AAAA03=‰™‚Ì„´#6ê;QÆ(€€6„„ŽŽ†…€‚ÿ"€"€6„„ŽŽ†…‚ÿ €Ò€6„„ŽŽ†…ÿ$€Ô€6„„ŽŽ†…‚ÿ €ä€6„„ŽŽ†…ÿ$€æ€6„„ŽŽ†…‚ÿÿÿSNAP_AppleTalkFilter element for collecting AppleTalk packet types embedded in Ethernet SNAP frames.14 20HEX AAAA03 HEX 809B0}ƒü…³#6úê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €º€6„„ŽŽ†…ÿ$€¼€6„„ŽŽ†…‚ÿ €Ì€6„„ŽŽ†…ÿ$€Î€6„„ŽŽ†…‚ÿÿÿSNAP_ARPFilter element for collecting ARP packet types embedded in Ethernet SNAP frames.14 20HEX AAAA03 HEX 0806.{Ì„*‡³#6öê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €¶€6„„ŽŽ†…ÿ$€¸€6„„ŽŽ†…‚ÿ €È€6„„ŽŽ†…ÿ$€Ê€6„„ŽŽ†…‚ÿÿÿSNAP_IPFilter element for collecting IP packet types embedded in Ethernet SNAP frames.14 20HEX AAAA03 HEX 0800L˜ü…vˆ´#61ê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €Ü€6„„ŽŽ†…ÿ$€Þ€6„„ŽŽ†…‚ÿ €î€6„„ŽŽ†…ÿ$€ð€6„„ŽŽ†…‚ÿÿÿSNAP_IP_DATemplate for setting the IP destination address, when IP is embedded in an Ethernet SNAP frame.14 38HEX AAAA03DEC XXX.XXX.XXX.XXXG“*‡½‰´#6'ê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €Ò€6„„ŽŽ†…ÿ$€Ô€6„„ŽŽ†…‚ÿ €ä€6„„ŽŽ†…ÿ$€æ€6„„ŽŽ†…‚ÿÿÿSNAP_IP_SATemplate for setting the IP source address, when IP is embedded in an Ethernet SNAP frame.14 34HEX AAAA03DEC XXX.XXX.XXX.XXX/|vˆìг#6øê;QÆ(€€6„„ŽŽ†…€‚ÿ"€€6„„ŽŽ†…‚ÿ €º€6„„ŽŽ†…ÿ$€¼€6„„ŽŽ†…‚ÿ €Ì€6„„ŽŽ†…ÿ$€Î€6„„ŽŽ†…‚ÿÿÿSNAP_IPXFilter element for collecting IPX packet types embedded in Ethernet SNAP frames.14 20HEX AAAA03HEX 8137oE½‰[Œ*#$‚Šê;QÆ(€€6„„ŽŽ†…€‚ÿ €€6„„ŽŽ†…ÿJ€€6„„ŽŽš‹±AÑañ¡1Á‚ÿH€n€6„„ŽŽš‹±AÑañ¡1ÁÿJ€p€6„„ŽŽš‹±AÑañ¡1Á‚ÿH€x€6„„ŽŽš‹±AÑañ¡1ÁÿJ€z€6„„ŽŽš‹±AÑañ¡1Á‚ÿÿÿSSAP Template for setting the LLC source address.15HEX XXC슞Œ@ P€€6„„ŽŽš‹±AÑañ¡1Á€‚ÿe7[Œ. ,€n€6 „„ŽŽ†¢€ €‚ÿStandard Filter Elements and Templates, Token Ring .žŒ1+ &€€6„„ŽŽ†¢€‚ÿá7Žª#$n QÆ€€6„„ŽŽ‚ÿ,€€6„„ŽŽ†¢€ €‚ÿ,€(€6„„ŽŽ†¢€ €‚ÿ,€F€6„„ŽŽ†¢€ €‚ÿ,€Z€6„„ŽŽ†¢€ €‚ÿÿÿFilter Element DescriptionOffset Valuej1)­#*Ô QÆ&€€6„„ŽŽ†¢€‚ÿ €:€6„„ŽŽ†¢‚ÿ€¢€6„„ŽŽ†¢ÿ"€¤€6„„ŽŽ†¢‚ÿ€²€6„„ŽŽ†¢ÿ"€´€6„„ŽŽ†¢‚ÿÿÿMAC_Active_Monitor_PresentCollect all Active Monitor Token Ring MAC frames. 1 17HEX 05 HEX 05þQŽ3À­#*¢ QÆ&€€6„„ŽŽ†¢€‚ÿ €€6„„ŽŽ†¢‚ÿ€p€6„„ŽŽ†¢ÿ"€r€6„„ŽŽ†¢‚ÿ€€€6„„ŽŽ†¢ÿ"€‚€6„„ŽŽ†¢‚ÿÿÿMAC_BeaconCollect all Beacon Token Ring)3ÀºÁ MAC frames.1 17HEX 02 HEX 02]);Á«#&º QÆ&€€6„„ŽŽ†¢€‚ÿ €0€6„„ŽŽ†¢‚ÿ€ž€6„„ŽŽ†¢ÿ € €6„„ŽŽ†¢‚ÿ€¨€6„„ŽŽ†¢ÿ €ª€6„„ŽŽ†¢‚ÿÿÿMAC_Change_ParametersCollect all Change Parameters Token Ring MAC frames. 17HEX 0C[3ÀC­#*¶ QÆ&€€6„„ŽŽ†¢€‚ÿ €$€6„„ŽŽ†¢‚ÿ€„€6„„ŽŽ†¢ÿ"€†€6„„ŽŽ†¢‚ÿ€”€6„„ŽŽ†¢ÿ"€–€6„„ŽŽ†¢‚ÿÿÿMAC_Claim_TokenCollect all Claim Token Token Ring MAC frames.1 17HEX 03 HEX 03\;ÁJë#&¸ QÆ&€€6„„ŽŽ†¢€‚ÿ €0€6„„ŽŽ†¢‚ÿ€œ€6„„ŽŽ†¢ÿ €ž€6„„ŽŽ†¢‚ÿ€¦€6„„ŽŽ†¢ÿ €¨€6„„ŽŽ†¢‚ÿÿÿMAC_Duplicate_AddressCollect all Duplicate Address Token Ring MAC frames.17HEX 07iCÂ_Ĭ#(Ò QÆ&€€6„„ŽŽ†¢€‚ÿ €<€6„„ŽŽ†¢‚ÿ€´€6„„ŽŽ†¢ÿ €¶€6„„ŽŽ†¢‚ÿ€¾€6„„ŽŽ†¢ÿ"€À€6„„ŽŽ†¢‚‚ÿÿÿMAC_Initialize_Ring_StationCollect all Initialize Ring Station Token Ring MAC frames.17HEX 0D÷LJÃVÅ«#&˜ QÆ&€€6„„ŽŽ†¢€‚ÿ € €6„„ŽŽ†¢‚ÿ€|€6„„ŽŽ†¢ÿ €~€6„„ŽŽ†¢‚ÿ€†€6„„ŽŽ†¢ÿ €ˆ€6„„ŽŽ†¢‚ÿÿÿMAC_Lobe_TestCollect all Lobe Test Token Ring MAC frames.17HEX 08ùN_ÄOÆ«#&œ QÆ&€€6„„ŽŽ†¢€‚ÿ €"€6„„ŽŽ†¢‚ÿ€€€6„„ŽŽ†¢ÿ €‚€6„„ŽŽ†¢‚ÿ€Š€6„„ŽŽ†¢ÿ €Œ€6„„ŽŽ†¢‚ÿÿÿMAC_Poll_ErrorCollect all Poll Error Token Ring MAC frames.17HEX 27 `VÅZÇ«#&À QÆ&€€6„„ŽŽ†¢€‚ÿ €4€6„„ŽŽ†¢‚ÿ€¤€6„„ŽŽ†¢ÿ €¦€6„„ŽŽ†¢‚ÿ€®€6„„ŽŽ†¢ÿ €°€6„„ŽŽ†¢‚ÿÿÿMAC_Remove_Ring_StationCollect all Remove Ring Station Token Ring MAC frames.17HEX 0BýROÆWÈ«#&¤ QÆ&€€6„„ŽŽ†¢€‚ÿ €&€6„„ŽŽ†¢‚ÿ€ˆ€6„„ŽŽ†¢ÿ €Š€6„„ŽŽ†¢‚ÿ€’€6„„ŽŽ†¢ÿ €”€6„„ŽŽ†¢‚ÿÿÿMAC_Report_ErrorCollect all Report Error Token Ring MAC frames.17HEX 29 bZÇdÉ«#&Ä QÆ&€€6„„ŽŽ†¢€‚ÿ €6€6„„ŽŽ†¢‚ÿ€¨€6„„ŽŽ†¢ÿ €ª€6„„ŽŽ†¢‚ÿ€²€6„„ŽŽ†¢ÿ €´€6„„ŽŽ†¢‚ÿÿÿMAC_Report_Monitor_ErrorCollect all Report Monitor Error Token Ring MAC frames.17HEX 28 ^WÈmÊ«#&¼ QÆ&€€6„„ŽŽ†¢€‚ÿ €2€6„„ŽŽ†¢‚ÿ€ €6„„ŽŽ†¢ÿ €¢€6„„ŽŽ†¢‚ÿ€ª€6„„ŽŽ†¢ÿ €¬€6„„ŽŽ†¢‚ÿÿÿMAC_Report_NAUM_ChangeCollect all Report NAUM Change Token Ring MAC frames.17HEX 26mdɆˬ#(Ú QÆ(€€6„„ŽŽ†¢€‚ÿ €B€6„„ŽŽ†¢‚ÿ€¾€6„„ŽŽ†¢ÿ €À€6„„ŽŽ†¢‚ÿ€È€6„„ŽŽ†¢ÿ €Ê€6„„ŽŽ†¢‚ÿÿÿMAC_Report_New_Active_MonitorCollect all Report New Active Monitor Token Ring MAC frames.17HEX 25qmʣ̬#(â QÆ(€€6„„ŽŽ†¢€‚ÿ €F€6„„ŽŽ†¢‚ÿ€Æ€6„„ŽŽ†¢ÿ €È€6„„ŽŽ†¢‚ÿ€Ð€6„„ŽŽ†¢ÿ €Ò€6„„ŽŽ†¢‚ÿÿÿMAC_Report_Ring_Station_AddressCollect all Report Ring Station Address Token Ring MAC frames.17HEX 22&z†ËÉͬ#(ô QÆ(€€6„„ŽŽ†¢€‚ÿ €P€6„„ŽŽ†¢‚ÿ€Ø€6„„ŽŽ†¢ÿ €Ú€6„„ŽŽ†¢‚ÿ€â€6„„ŽŽ†¢ÿ €ä€6„„ŽŽ†¢‚ÿÿÿMAC_Report_Ring_Station _AttachmentsCollect all Report Ring Station Attachments Token Ring MAC frames.17HEX 24m£Ìâά#(Ú QÆ(€€6„„ŽŽ†¢€‚ÿ €B€6„„ŽŽ†¢‚ÿ€¾€6„„ŽŽ†¢ÿ €À€6„„ŽŽ†¢‚ÿ€È€6„„ŽŽ†¢ÿ €Ê€6„„ŽŽ†¢‚ÿÿÿMAC_Report_Ring_Station_StateCollect all Report Ring Station State Token Ring MAC frames.17HEX 23hÉÍ «#&Ð QÆ&€€6„„ŽŽ†¢€‚ÿ €<€6„„ŽŽ†¢‚ÿ€´€6„„ŽŽ†¢ÿ €¶€6„„ŽŽ†¢‚ÿ€¾€6„„ŽŽ†¢ÿ €À€6„„ŽŽ†¢‚ÿÿÿMAC_Report_Transmit_ForwardCollect all Report Transmit Forward Token Ring MAC frames.17HEX 2AâÎ ºÁfâΫ#&Ì QÆ&€€6„„ŽŽ†¢€‚ÿ €:€6„„ŽŽ†¢‚ÿ€°€6„„ŽŽ†¢ÿ €²€6„„ŽŽ†¢‚ÿ€º€6„„ŽŽ†¢ÿ €¼€6„„ŽŽ†¢‚ÿÿÿMAC_Request_InitializationCollect all Request Initialization Token Ring MAC frames.17HEX 20s <¬#(æ QÆ(€€6„„ŽŽ†¢€‚ÿ €H€6„„ŽŽ†¢‚ÿ€Ê€6„„ŽŽ†¢ÿ €Ì€6„„ŽŽ†¢‚ÿ€Ô€6„„ŽŽ†¢ÿ €Ö€6„„ŽŽ†¢‚ÿÿÿMAC_Request_Ring_Station_AddressCollect all Request Ring Station Address Token Ring MAC frames.17HEX 0E(|d¬#(ø QÆ(€€6„„ŽŽ†¢€‚ÿ €R€6„„ŽŽ†¢‚ÿ€Ü€6„„ŽŽ†¢ÿ €Þ€6„„ŽŽ†¢‚ÿ€æ€6„„ŽŽ†¢ÿ €è€6„„ŽŽ†¢‚ÿÿÿMAC_Request_Ring_Station _AttachmentsCollect all Request Ring Station Attachments Token Ring MAC frames.17HEX 10o<¬#(Þ QÆ(€€6„„ŽŽ†¢€‚ÿ €D€6„„ŽŽ†¢‚ÿ€Â€6„„ŽŽ†¢ÿ €Ä€6„„ŽŽ†¢‚ÿ€Ì€6„„ŽŽ†¢ÿ €Î€6„„ŽŽ†¢‚ÿÿÿMAC_Request_Ring_Station_StateCollect all Request Ring Station State Token Ring MAC frames.17HEX 0FõJdt«#&” QÆ&€€6„„ŽŽ†¢€‚ÿ €€6„„ŽŽ†¢‚ÿ€x€6„„ŽŽ†¢ÿ €z€6„„ŽŽ†¢‚ÿ€‚€6„„ŽŽ†¢ÿ €„€6„„ŽŽ†¢‚ÿÿÿMAC_ResponseCollect all Response Token Ring MAC frames.17HEX 00Ww¬#(® QÆ&€€6„„ŽŽ†¢€‚ÿ €"€6„„ŽŽ†¢‚ÿ€€€6„„ŽŽ†¢ÿ €‚€6„„ŽŽ†¢‚ÿ€Ž€6„„ŽŽ†¢ÿ"€€6„„ŽŽ†¢‚ÿÿÿMAC_Ring_PurgeCollect all Ring Purge Token Ring MAC frames.1 17HEX 04HEX 04 st—­#*æ QÆ&€€6„„ŽŽ†¢€‚ÿ €<€6„„ŽŽ†¢‚ÿ€´€6„„ŽŽ†¢ÿ"€¶€6„„ŽŽ†¢‚ÿ€Ä€6„„ŽŽ†¢ÿ"€Æ€6„„ŽŽ†¢‚ÿÿÿMAC_Standby_Monitor_PresentCollect all Standby Monitor Present Token Ring MAC frames.1 17HEX 06 HEX 06Zwœ«#&´ QÆ&€€6„„ŽŽ†¢€‚ÿ €.€6„„ŽŽ†¢‚ÿ€˜€6„„ŽŽ†¢ÿ €š€6„„ŽŽ†¢‚ÿ€¢€6„„ŽŽ†¢ÿ €¤€6„„ŽŽ†¢‚ÿÿÿMAC_Transmit_ForwardCollect all Transmit Forward Token Ring MAC frames.17HEX 09@—Ÿ Ã#V€ QÆ&€€6„„ŽŽ†¢€‚ÿ€€6„„ŽŽ†¢ÿ €€6„„’ކ‚ÿ€f€6„„’ކÿ$€h€v„„ŽŽs†‚ÿ"€n€v„„ŽŽs†ÿ €p€6„„ŽŽ†‚ÿÿÿNON_MACCollect all non-MAC Token Ring frames.1HEX 40è œ‡ Û#† QÆ€€6„„ŽŽ†ÿ&€€6„„ŽŽ†¢€‚ÿ€€6„„ŽŽ†¢ÿ$€ €v„„ŽŽs†‚ÿ"€€v„„ŽŽs†ÿ$€€v„„ŽŽs†‚ÿ"€€v„„ŽŽs†ÿ €€6„„ŽŽ†‚ÿÿÿ*Ÿ ± ' €€ˆˆ‚€‚ÿH‡ ù 1J͉ Lù 2 KCapture Filter Examples9± 2 ' €$€ ˆ‚€‚ÿFilter Examples"Æù T \ †€€ˆˆ‚€‚ã1Þ¿D€‰€‚ã2Þ¿D€‰€‚ã³ùŽ€‰€‚ãÙ,ù€‰€‚ÿThree filter examples are described in the following help topics. Click on the example name to view the example.Capture Conversation - Filter example to collect a conversation between two stations.Filter Combination - Filter example showing a combination of filter elements.Filter TCP Port - Filter example showing a user-defined filter for a TCP Port.Advanced Filter - Filter example showing an advanced, multi-state logic filter.÷Ã2 K4 6€‡€ˆˆ‚€€€€€‚ÿFilter examples are supplied with Surveyor. To find more examples, look in the ..\examples\filter directory. Select the Description menu item to access a description of any filter example.AT Œ1E‚ „ MŒÜ9FFilter Example 1P)KÜ' €R€ ˆ‚€‚ÿFilter Example 1, Capture Conversation"ÞŒ AD V€½€ˆ‚€€ € €€€€ €€ €‚‚ÿThe Create/Modify Filter window below shows a capture filter which captures all packets going to and coming from two MAC stations. The conversation is specified by entering the two MAC addresses, using the <-> indicatoÜ AKr to capture packets in both directions. The enable check box is selected to apply the conversation to the filter. The filter element is named in the Filter name box as Station7and8.Click on areas of the figure below for more specific information.\Ü—A1 2€º€ˆˆ‚€†"€‚‚ÿ The steps used to create the filter element and load it to a resource are shown below: ‡ A¡Dƒ Ô€€VˆˆÈ:‚H€ƒ€€‚ƒ†"€€€€€‚ƒ†"€€€€€‚ƒ€€€€‚ƒ€€‚ƒ€€€€‚ÿ1.Press the New button.2.Press the Name button for StationAddress1. Select the address from the name table and click OK.3.Press the Name button for StationAddress2. Select the address from the name table and click OK.4.Pull down the Direction box and set the indicator to bi-directional (<->).5.Be sure the Enable check box is selected in the Conversation area.6.Enter the name of the new filter element in the Filter Name box. The new filter element name will appear in the User_Defined_Filters section of the filter browser. The filter element is saved and will be available for other filtering operations.n0—AF> J€c€VˆˆÈ:‚H€ƒ€€‚ƒ†"€‚ƒ‚ÿ7.Press the ==> button to apply the filter element. The filter element appears in the Filter Combination box. 8.Press the Load Filter button to load the filter to the resource.9.You are now ready to start capture. The capture buffer will contain only the packets that pass through the filter.*¡D9F' €€ˆˆ‚€‚ÿAFzF1Ð   NzFÈFƒFilter Example 2N'9FÈF' €N€ ˆ‚€‚ÿFilter Example 2, Filter Combination2õzFúH= H€ë€ˆ‚€€ € €€ €€ €‚ÿThe Create/Modify Filter window below shows the capture filter with a logical combination built in the Combination box. This filter collects all traffic from a single station that make use of the HTTP or the FTP protocols. The two template filter elements are combined with an OR statement to collect both types of protocols. The two filter elements are named HTTP_Activity_Station2 for the user-defined HTTP filter element and FTP_Activity_Station2 for the user-defined FTP filter element. ¨yÈF¢J/ ,€ó€ˆ‚€€€‚‚ÿThe conversation is specified without a second station and uses the -> indicator. Traffic is to captured in the sending the direction for a single station, regardless of the other station in the conversation. In the example, the station address has been defined as part of each user-defined filter element.Click on areas of the figure below for more specific information.å­úH‡K8 >€]€ˆˆ‚€†"€‚€€‚ÿ The following steps describe how to create two filter elements, logically combine them using an OR operator, and load the resulting Filter Combination to a resource:ãq¢JjNr ²€å€VˆˆÈ:‚H€ƒ€€‚ƒ†"€€€€€‚ƒ€€€€‚ƒ€€‚ƒ€€€€€€‚ÿ1.Select the WWW_HTTP pre-defined filter element from the Available Filters box.2.Press the Name button for StationAddress1. Select the address from the name table and click OK.3.Pull down the Direction box and set the indicator to source address (->).4.Be sure the Enable check box is selected in the Conversation area.5.Enter the name (HTTP_Activity_Station2) of the new filter element in the Filter Name box. The new filter element name will appear in the User_Defined_Filters section of the filter browser. The filter element is saved and will be available for other filtering operations.'à‡K€G \€Á€VˆˆÈ:‚H€ƒ€€‚ƒ€€€€€€‚ƒ‚ÿ6.Using the FTP pre-defined filter element as the starting point, repeat steps 1 through 5 to create a similar user-defined element for FTP.7.Highlight the HTTP_Activity_Station2 element in the User_Defined_Filters section of the filter browser. Press the ==> button to apply the filter element. The filter element appears jN€9Fin the Filter Combination box.8.Press the OR operator button. The operator is appended to the filter element in the Filter Combination box. V jNó‚J b€€VˆˆÈ:‚H€ƒ€€€€€€‚ƒ†"€‚ƒ‚ÿ9.Highlight the FTP_Activity_Station2 element in the User_Defined_Filters section of the filter browser. Press the ==> button to apply the filter element. The filter element appears in the Filter Combination box. You now have two filter elements in the Combination box connected by an OR operator.10Press the Load Filter button to load the filter to the resource.11.You are now ready to start capture. The capture buffer will contain only the packets sent from Station2 that have an FTP or HTTP port address.*€ƒ' €€ˆˆ‚€‚ÿR!ó‚oƒ15 „ ŠOoƒºƒ¾Filter Example 3, Filter TCP PortK$ƒºƒ' €H€ ˆ‚€‚ÿFilter Example 3, Filter TCP PortÝ«oƒ—‡2 2€W€ˆ‚€€ € €‚‚ÿThe Create/Modify Filter window below shows the capture filter with a filter for a TCP Port. This filter collects all traffic that uses of the BootPS protocol. Surveyor has pre-defined filter elements for many, but not all, well-known TCP ports. For the BootPS protocol, you need to create a user-defined filter element.Create the new filter element by selecting another TCP Port filter element, such as WWW_HTTP. This will automatically give you the offsets and lengths for the values you need for the new filter element. Change the port number by editing offsets 22 through 25, changing the value to the port number for BootPS, decimal 67. Offsets 22 and 23 contain the value for the source port number and offsets 24 and 25 contain the value for the destination port number. Since you cannot change a pre-defined template, when you change the port number the interface automatically assumes you are creating a new filter element.Pºƒçˆ3 4€=€ˆ‚€‚‚†"€‚ÿThe example shows the byte values in decimal format. If you the display was set to hexadecimal, you would need to convert the port number in decimal (67) to hex (43) before entering the value in the proper offset.Click on areas of the figure below for more specific information. †_—‡m‰' €¾€ˆˆ‚€‚ÿThe following steps describe how to create the BootPS filter element and load to a resource.Íçˆu‹; D€›€VˆˆÈ:‚H€ƒ€€‚ƒ€€‚ƒ‚ÿ1.Select the WWW_HTTP pre-defined filter element from the Available Filters box. This pre-defined element will serve as a starting point for creating the user-defined filter element.2.Use the Data Format pull-down box to the right of the offsets and patterns to change the display of byte data to decimal.3.Place the cursor in offset 23. Change the decimal "80" to decimal "67". This changes the port for the filter to BootPS for the source address.8m‰ôG \€q€VˆˆÈ:‚H€ƒ‚ƒ€€‚ƒ€€€€€€‚ÿ4.Place the cursor in offset 25. Change the decimal "80" to decimal "67". This changes the port for the filter to BootPS for the destination address.5.Be sure the Enable check box is NOT selected in the Conversation area. No specific stations are associated with the new filter element.6.Enter the name (BootPS_Activity) of the new filter element in the Filter Name box. The new filter element name will appear in the User_Defined_Filters section of the filter browser. The filter element is saved and will be available for other filtering operations. bu‹”> J€Ç€VˆˆÈ:‚H€ƒ€€‚ƒ†"€‚ƒ‚ÿ7.Press the ==> button to apply the filter element. The filter element appears in the Filter Combination box.8.Press the Load Filter button to load the filter to the resource.9.You are now ready to start capture. The capture buffer will contain only the packets that contain the BootPS port number in either the source or destination address.*ô¾' €€ˆ‚€‚ÿR!”À1ƒ=ŠÿÿÿÿPÀgÀ¹ÄFilter Example 3,¾À¾ Advanced FilterK$¾gÀ' €H€ ˆ‚€‚ÿFilter Example 4, Advanced FilterÄÀ„ÃY €€‰€ˆ‚€€ €€€€ €€ €‚€€€€€€€€‚ÿThe State window below shows the capture filter Example.CFD. The State window shows the structure of the filter, which has multiple states and statements. You can double-click on a statement to bring up its Create/Modify Filter window to see the details of how the statement is constructed.This filter starts collecting all packets when the first broadcast packet is encountered. Packets are tested first by the IF statement in State0. If the packet matches the broadcast mask (FFFFFFFFFFFF in the first six bytes), the packet is captured and the flow continues with State1. If the packet does not contain the Broadcast address, the packet is not captured and the next packet is filtered.5îgÀ¹ÄG \€ß€ˆ‚€€€€€€€€‚†"€‚ÿState1 is executed after the first broadcast packet is encountered. The IF statement in State1 indicates that any packet should be captured. The flow for testing packets remains in State1 until the capture process is stopped. G„ÃÅ1 ÿÿÿÿÿÿÿÿQÿÿÿÿÅÄÆFrame Type Check Boxes@¹Ä@Å' €2€˜ˆ‚€‚ÿFrame Type Check Boxes„[ÅÄÆ) €·€ˆˆ‚€‚‚ÿThese check boxes allow you to select the types of frames you want to capture with this IF statement. For example, if you want to capture only good frames, leave the Good Frames box checked and deselect all other frame types. If you want to capture only error frames, leave all frame types selected with the exception of the Good Frames box.< @ÅÇ1qÿÿÿÿÿÿÿÿRÿÿÿÿÇ5ÈInfo Button5ÄÆ5Ç' €€˜ˆ‚€‚ÿInfo ButtonÖ¨Ç È. *€Q€ˆ‚€€ €‚ÿThis button brinngs up an information window about the filter element.Use the Info.. button to find out the exact mask and logical operations in a filter element. *5Ç5È' €€ˆˆ‚€‚ÿD ÈyÈ1CÿÿÿÿÿÿÿÿSÿÿÿÿyÈxÉState Window Button=5ȶÈ' €,€˜ˆ‚€‚ÿState Window ButtonˆyÈxÉ: B€€ˆˆ‚€€€€€€€‚ÿThe State window button brings up the State window. The State window is used to create advanced filters with multi-state logic.B¶ÈºÉ1¼ÿÿÿÿÿÿÿÿTÿÿÿÿºÉ¾Conversation Area;xÉõÉ' €(€˜ˆ‚€‚ÿConversation AreaȉºÉ½Ì? L€€ˆˆ‚€‚ƒƒ‚ƒƒƒ‚ƒƒƒƒƒƒƒƒƒƒƒ‚ÿSelect a protocol, a frame type, and a direction for a conversation from the pull-down boxes. A station address that corresponds to the protocol can be entered in the Station 1 or Station 2 fields. Both fields may contain an address.Protocols:MAC, IP, or IPX.Frame Types:All, EV2 (EthernetII), SNAP, 8022 (IEEE 802.2), 8023 (IEEE 802.3)(Frame type applies to IP-layer addresses only)Directions:->Station 1 is Source Address, Station 2 is Destination Address<-Station 2 is Source Address, Station 1 is Destination Address<->Station 1 is either Source or Destination Address, Station 2 is either Source or Destination AddressÖõÉÂÏ/ ,€­€ˆˆ‚€€€‚‚ÿIf no value is entered for a Station field, all stations are captured. For example, if you set an address for Station 1, no address for Station 2, and set the direction to -> all packets having Station 1 as the Source Address are captured, regardless of the Destination Address.If the station address is not the same type as the protocol selected, an error message appears. For example, if you set the protocol to IPX, you are not allowed to insert a MAC address in the conversation. Only the frame types used with the selected protocol are allowed. For example, if the protocol is set to IP you can only select EV2 or SNAP. If the protocol is set to MAC, the frame type is set to All and no options are available.ðǽ̾) €€ˆˆ‚€‚‚ÿThe conversation canÂϾxÉ be enabled or disabled. Make sure that the conversation has the Enable check box selected to enable the conversation.An OR operation is implied when < -- > indicator is used.BÂÏ1­ÿÿÿÿÿÿÿÿUÿÿÿÿkName Table Button;¾;' €(€˜ˆ‚€‚ÿName Table ButtonØA. *€±€ˆˆ‚€€€‚ÿThe Name Table button brings up the Name Table window, showing all name and address associations including the protocol and the frame type. The name and address associations displayed are those in the currently active name table. Load the correct name table before accessing Create/Modify Filter window to make sure names are available. Double-clicking on a name table entry will load the address associated with the name into the corresponding station address field.*;k' €€ˆˆ‚€‚ÿMA¸1 ÿÿÿÿÿÿÿÿVÿÿÿÿ¸‹Create/Modify Filter ToolbarFkþ' €>€˜ˆ‚€‚ÿCreate/Modify Filter Toolbar@¸‹M h€…€ˆˆ‚€€€€€†"€€€†"€‚‚ÿThe toolbar contains buttons to Create, Save, and Open new filters. Load and Unload buttons permit you to load or unload filters directly from the Create/Modify Filter window. Press the State window button to bring up the State window. Press the Settings button to see special settings for capture filters.> þÉ1ýÿÿÿÿÿÿÿÿWÿÿÿÿɈAction Button7‹' € €˜ˆ‚€‚ÿAction ButtonˆSɈ5 8€§€ˆˆ‚€‚€€€€‚ÿPress the Actions button to bring up the Action dialog box. Check the actions to be taken if all conditions are satisfied. The action check boxes are used only when creating an advance multi-state logic filter. You do not need to use the Action button or dialog box when creating a simple filter.For advanced filters, specify in the pull-down box the state to go to once the actions are complete. Current means start the filtering test for next packet at the state containing this IF statement. If there is only one state in the filter, the only choice for the GoTo is the current state.DÌ1äÿÿÿÿÿÿÿÿXÿÿÿÿÌl Fillter Combination<ˆ ' €*€˜ˆ‚€‚ÿFilter Combinationd5Ìl / ,€k€ˆˆ‚€€€‚‚ÿThe Filter Combination field shows the syntax for the condition. You click on filters elements and then press the è button to add elements to the Filter Combination. Single-click on operators (buttons) and they appear in the Filter Combination field. If the operation you perform makes no sense to create a Filter Combination, the operation is not allowed. For example, an OR operator makes no sense after an AND operator. As another example, inserting a filter element immediately after another filter element makes no sense and the operation is not allowed.A ­ 1aÿÿÿÿÿÿÿÿYÿÿÿÿ­  @Operator Buttons:l ç ' €&€˜ˆ‚€‚ÿOperator Buttons"Û­  G \€·€ˆˆ‚€€€€€‚€€€€€€‚ÿPress the Clear button to erase the contents of the Filter Combination field. Press CE to clear the last entry in the Filter Combination field.Press the AND, OR, or NOT buttons to add operators to the filter combination. The operator displays in the Filter Combination field. The addition of operators is context sensitive; you cannot add an operator where it makes no logical sense. For example, you cannot add an AND operator immediately after an OR operator.Äç  @5 8€€ˆˆ‚€€€‚€€‚ÿUse the parentheses ) ( buttons to create the desired logical interpretation of elements in the Filter Combination field.Counter 1 is a special key that adds a filter element for testing the value of Counter 1. The most common use of Counter 1 is to set it to a particular value and then begin capture once this value is reached. The initial value for Counter 1 is set in the ROOT statement.  @l F R@1žÿÿÿÿÿÿÿÿZÿÿÿÿR@¥AAvailable Filters Box? @‘@' €0€˜ˆ‚€‚ÿAvailable Filters BoxìR@¥A( €Ù€ˆˆ‚€‚ÿThis box shows all available Filter Elements and Filter Element Templates in a hierarchical structure. Double-click on an element to add it to the Filter Combination field. This area is also referred to as the Filter Element browser.L‘@ñA1Bÿÿÿÿÿÿÿÿ[ÿÿÿÿñAçCButtons for Filter ElementsE¥A6B' €<€˜ˆ‚€‚ÿButtons for Filter Elements±vñAçC; D€í€ˆˆ‚€€€€€‚€€‚ÿThese buttons add, modify, or delete filter elements. For example, if you want to create a new filter, press the New button. Press the è button to add the Filter Element to the Filter Combination box for inclusion in a logic sequence.You can delete any user-defined Filter Element with the Delete button. You cannot delete pre-defined Filter Elements or Templates.D6B+D1Šÿÿÿÿÿÿÿÿ\ÿÿÿÿ+DqEFilter Element Name5çC`D' €€˜ˆ‚€‚ÿFilter Nameé+DqE( €Ó€ˆˆ‚€‚ÿThe Filter Name field shows the name of the Filter Element. Enter a unique name for the Filter Element in this field. Once you create a Filter Element, the name will appear in the Filter Element browser under User Defined Filters.B`D³E1–ÿÿÿÿÿÿÿÿ]ÿÿÿÿ³EIData Pattern Area;qEîE' €(€˜ˆ‚€‚ÿData Pattern Area|S³EjH) €§€ˆˆ‚€‚‚ÿThe Data Pattern box shows the masks that comprise a Filter Element. The offset defines the position within the packet. You can enter values directly into the Data Pattern box to create a filter element except for address values. Address values must be entered in the Conversation area.The pattern can be specified as a decimal, hexadecimal, or ASCII value. The Data format pull-down box to the right determines if the pattern is in decimal, hexadecimal, or ASCII. An X in any position within the pattern indicates that this is a "don't care" position and that any value will create a match.vîEI' €ì€ˆˆ‚€‚ÿUse the Offset Format box on the right to change the display of row and column headers from hexadecimal to decimal.> jHEI1ûÿÿÿÿÿÿÿÿ^EI|IFNOpen a Filter7I|I' € € ˆ‚€‚ÿOpen a FilterBEI¾I' €6€œŒ‚€‚ÿTO OPEN A CAPTURE FILTER¡B|I_K_ Œ€‹€VˆˆÈ:‚H€ƒ†"€‚ƒ€€†"€†"€€€‚ƒ‚ƒ€€‚ÿ1.From the Detail View toolbar, click the button.2.From the Create/Modify Filter toolbar, click the button. You can also use the button from the State window.3.Click on a file with an extension of .CFD.Or, use the dialog box to navigate to the location of the capture filter.4.Click the Open button.›e¾IúK6 <€Ê€ˆˆ‚€ã’ëO€‰€€‚ÿYou must load a capture filter to a module before it can be used to filter incoming packets. B_KFNÄN' €.€ ˆ‚€‚ÿModify a Filter File1Õ†N\ †€«€ˆˆ‚€‚ãÊĺ^€‰€‚ã8òèc€‰€‚ã7ÿxÚ€‰€‚ã…Šß‚€‰€‚ÿTo modify a filter, start by opening the existing capture filter (.CFD) or display filter (.DFD) file. Once the filter appears in the Filter window, you can change statements, add/delete entire new states, or add/delete staÄNFNtements to existing states. Once changes are complete, change the filter description and save the filter.Open a FilterAdd/Delete Additional Statements on Existing StatesAdd/Delete Additional StatesModify Existing StatementsCÄND0 0€&€ˆˆ‚ã÷‡_ƒ€‰€‚ÿSave a FIlterY(1ÿÿÿÿÿÿÿÿ`úÙ…Add/Delete Statements to Existing States]6Dú' €l€ ˆ‚€‚ÿAdd/Delete Additional Statements to Existing States|Ov‚- *€ž€ˆˆ‚€€€‚ÿTo add/delete statements, the State window for a filter must be displayed.<ú²‚' €*€œŒ‚€‚ÿTO ADD A STATEMENTlEv‚ƒ' €Š€ˆˆ‚€‚ÿAdding a statement to an existing state adds an ELSE IF statement.­P²‚Ë„] ˆ€¥€VˆˆÈ:‚H€ƒ‚ƒ†"€‚ƒ€€‚ƒ€€‚ƒ€†"€€€€‚ÿ1.Select the statement that you wish to precede the statement you are adding.2.Press the Insert key or the button.3.The Create/Modify Filter window appears.4.Use the Create/Modify Filter window to create the conditions and actions for the ELSE IF statement.5.Click the State button to return to the State window.?ƒ …' €0€œŒ‚€‚ÿTO DELETE A STATEMENTϞ˄Ù…1 0€?€ˆˆ‚€†"€‚ÿSelect the statement and press the Delete key or click on the button. You cannot delete an IF or ELSE statement. However, you can delete an entire state.B …†1tÿÿÿÿÿÿÿÿa†V†™ŠAdd/Delete States;Ù…V†' €(€ ˆ‚€‚ÿAdd/Delete StatesxK†Ά- *€–€ˆˆ‚€€€‚ÿTo add/delete states, the State window for a filter must be displayed.8V†‡' €"€œŒ‚€‚ÿTO ADD A STATEÏΆ%‰P n€¡€VˆˆÈ:‚H€ƒ‚ƒ†"€‚ƒ‚ƒ€€‚ƒ€€‚ƒ€€‚ÿ1.Select the ROOT statement.2.Press the Insert key or the button.3.A new state is added to the filter definition. The name of the state is the next available state number. For example, if State0 and State1 already exist, the new state is State2. Double-click on the new state.4.The Create/Modify Filter window appears.5.Use the Create/Modify Filter window to create the conditions and actions for the IF statement.6.Click the State button.‡ç‰3 4€€VˆˆÈ:‚H€ƒ‚ƒ€€‚ÿ7.The dialog box for the ELSE statement appears. Use the dialog box to select the actions for the ELSE statement.8.Click the OK button.;%‰"Š' €(€œŒ‚€‚ÿTO DELETE A STATEwG牙Š0 0€€ˆˆ‚€†"€‚ÿSelect the state and press the Delete key or click on the button. K"ŠäŠ1óÿÿÿÿÿÿÿÿbäŠ(‹êModify Existing StatementsD™Š(‹' €:€ ˆ‚€‚ÿModify Existing StatementsT䊩‹- *€¨€ˆˆ‚€€€‚ÿTo modify existing statements, the State window for a filter must be displayed.¼ƒ(‹eŒ9 @€€VˆˆÈ:‚H€ƒ€€‚ƒ€€‚ÿ1.Double-click on a statement in the State window.2.Make changes to the conditions using the Create/Modify Filter window.p<©‹ÕŒ4 8€x€Vˆˆ‘€:‚€ ƒ€€€‚ÿ·Use the Clear button to erase the current condition.rDeŒG. ,€ˆ€Vˆˆ‘€:‚€ ƒ€‚ÿ·Use the filter elements and buttons to create a new condition.yMÕŒÀ, (€š€VˆˆÈ:‚H€ƒ‚ƒ‚ÿ3.Press the Actions button.4.Make changes to Actions in the dialog box.*Gê' €€ˆˆ‚€‚ÿBÀ,Ž1Gÿÿÿÿÿÿÿÿc,ŽgŽ|ÀDescribe a Filter;êgŽ' €(€ ˆ‚€‚ÿDescribe a FilterwP,ŽÞŽ' € €ˆˆ‚€‚ÿA text description of a saved filter makes it easier to identify its purpose.’?gŽ|ÀS t€€VˆˆÈ:‚H€ƒ€€€€€€€€€€‚ƒ‚ƒ€€‚ÿ1.If the State window is displayed, choose Description from the Detail View menu bar. If the Create/Modify Filter window is displayed, choose Configuration à Description from the Detail View menuÞŽ|Àê bar.2.The Description dialog box appears. Type a text description of the filter. 3.Click the OK button.> ÞŽºÀ1 ÿÿÿÿÿÿÿÿdºÀñÀËÅSave a Filter7|ÀñÀ' € € ˆ‚€‚ÿSave a FilterwOºÀhÂ( €Ÿ€ˆˆ‚€‚ÿNote that filter elements are saved in the User Defined Filters section of the Filter browser and are not stored as separate files. You do not have to save filter elements to a file, as they will appear in the browser every time you start Surveyor. The save option is typically used to save advanced filters with multi-state logic. BñÀªÂ' €6€œŒ‚€‚ÿTO SAVE A CAPTURE FILTERo*hÂÄE X€W€VˆˆÈ:‚H€ƒ€€†"€‚ƒ‚ƒ€€‚ÿ1.From the State toolbar or the Create/Modify Filter toolbar, click the button2.Type the name of a capture filter in the File name box. The capture filter must have an extension of .CFD.Or, use the dialog box to navigate to the location of the capture filter.3.Click the Save button.BªÂ[Ä' €6€œŒ‚€‚ÿTO SAVE A DISPLAY FILTERp+ÄËÅE X€Y€VˆˆÈ:‚H€ƒ€€†"€‚ƒ‚ƒ€€‚ÿ1.From the State toolbar or the Create/Modify Filter toolbar, click the button.2.Type the name of a display filter in the File name box. The display filter must have an extension of .DFD.Or, use the dialog box to navigate to the location of the display filter.3.Click the Save button.@[Ä Æ1<ÿÿÿÿÿÿÿÿe ÆNÆYÌCreate a FilterCËÅNÆ' €8€ ˆ‚€‚ÿCreate an Advanced Filter¤q ÆòÆ3 6€â€ˆˆ‚€ã<£Ì€‰€‚ÿThe capture and display filter overview contains more detailed information on capture and display filters.ñNÆãÈd –€!€VˆˆÈ:‚H€ƒ†"€†"€‚ƒ†"€€€‚ƒ€€ãÊĺ^€‰€‚ƒ‚ÿ1.From the Detail View toolbar, click the button to create a capture filter. Click the button to create a display filter.2.Press the button to bring up the State window to create a filter.3.A default filter displays in the State window. Open a filter if you want to base the new filter on an existing filter.4.Make changes to the filter or the default filter as required.wIòÆZÉ. ,€’€Vˆˆ‘€:‚€ ƒ€‚ÿ·Double-click on statements to change there conditions and actions. ]/ãÈ·É. ,€^€Vˆˆ‘€:‚€ ƒ€‚ÿ·Use the Insert key to insert statements. pBZÉ'Ê. ,€„€Vˆˆ‘€:‚€ ƒ€‚ÿ·Use the right mouse button to list context-specific options.Û­·ÉË. *€[€ˆˆ‚€€€‚ÿOnce the filter is created, it can be saved to disk and/or loaded to the module. You must load the capture filter to the module before it can be used to filter packets.2 'Ê4Ë' €€œŒ‚€‚ÿSEE ALSO%²ËYÌs ´€e€ˆˆ‚ãÆ†i€‰€‚ãÊĺ^€‰€‚ã8òèc€‰€‚ã7ÿxÚ€‰€‚ã…Šß‚€‰€‚ã÷‡_ƒ€‰€‚‚ÿModify a FilterOpen a FilterAdd/Delete Additional Statements on Existing StatesAdd/Delete Additional StatesModify Existing StatementsSave a FIlterF4ËŸÌ1ÿÿÿÿÿÿÿÿfŸÌÞÌ Apply a Simple Filter?YÌÞÌ' €0€ ˆ‚€‚ÿApply a Simple Filter¤qŸÌ‚Í3 6€â€ˆˆ‚€ã<£Ì€‰€‚ÿThe capture and display filter overview contains more detailed information on capture and display filters. ÆÞÌÎE X€‘€VˆˆÈ:‚H€ƒ†"€†"€‚ƒ€€‚ÿ1.From the Detail View toolbar, click the button to create a capture filter. Click the button to create a display filter.2.Use the Create/Modify Filter window to select a filter element.h:‚ÍõÎ. ,€t€Vˆˆ‘€:‚€ ƒ€‚ÿ·Use the pre-defined elements in the Filter browser. {MÎpÏ. ,€š€Vˆˆ‘€:‚€ ƒ€‚ÿ·Create and apply user-defined filter elements from the Filter browser. âõΜ> J€Ç€VˆˆÈ:‚H€ƒ€€‚ƒ‚ƒ†"€‚ÿ3.Press the à button to add the element to the Filter Combination box.4.Use pÏœYÌthe logic buttons and other filter elements to create a more complex combination.5.Press the button to load the capture or display filter.oEpÏ * $€Š€ˆˆ‚€€‚ÿYou must load the filter before it can be used to filter packets.HœS1ÿÿÿÿÿÿÿÿgS•gCreate a Filter ElementB •' €6€ ˆ‚€‚ÿCreate a Filter Element þÖS“( €­€ˆˆ‚€‚ÿFilter elements are the building blocks that form conditions for selecting or rejecting packets. Filter elements have one or more offsets into the frame and a mask. Masks are specific values or "don't care" values assigned to the element, starting at the offset. If the values in the mask are matched by the contents of a packet, the packet is selected for capture or display. User-defined filter elements can be based on the filter templates supplied with Surveyor.K•0R r€€VˆˆÈ:‚H€ƒ†"€†"€‚ƒ€€‚ƒ‚ƒ†"€‚ÿ1.From the Detail View toolbar, click the button to create a capture filter. Click on the button to create a display filter.2.The Create/Modify Filter window appears.3.To base your user-defined element on a pre-existing element, click on a template from the Filter browser (left portion of the window). The offsets and values for the element or template appear in the fields at the bottom of the window. 4.If adding addresses to the filter element, press the button and select a name/address association. The address appears in the corresponding Station Address field.K“{; D€!€VˆˆÈ:‚H€ƒ‚ƒ€€‚ƒ€€‚ÿ5.If needed, change or add additional values to the offset-pattern fields at the bottom of the window.6.Enter the name of new filter element in the Filter name box. 7.The new filter element will appear in the User_Defined_Filters section of the Filter browser.ì¾0g. *€}€ˆˆ‚€€€‚ÿCreating an element does not make it part of the filter. You must add the element so it appears in the Filter Combination box on the right (use the è key) to make it part of the filter.H{¯1Òÿÿÿÿÿÿÿÿh¯ñ’Modify a Filter ElementBgñ' €6€ ˆ‚€‚ÿModify a Filter Element îÆ¯ß ( €€ˆˆ‚€‚ÿFilter elements are the building blocks that form conditions for selecting or rejecting packets. Filter elements have one or more offsets into the frame and a mask. Masks are specific values or "don't care" values assigned to the element, starting at the offset. If the values in the mask are matched by the contents of a packet, the packet is selected for capture or display. You cannot modify the pre-defined filter elements supplied with Surveyor.§Oñ† X ~€¥€VˆˆÈ:‚H€ƒ†"€†"€‚ƒ€€‚ƒ€€‚ƒ†"€‚ÿ1.From the Detail View toolbar, click the button to create a capture filter. Click on the button to create a display filter.2.The Create/Modify Filter window appears.3.Single click on the element you want to modify in the User_Defined_Filters section of the Filter browser (left portion of the window). The offsets and values for the element or template appear in the fields at the bottom of the window. 4.If modifying addresses to the filter element, press the button and select a name/address association. The address appears in the corresponding Station Address field.â¯ß h3 4€_€VˆˆÈ:‚H€ƒ‚ƒ€€‚ÿ5.If needed, change or add additional values in the offset-pattern fields at the bottom of the window.6.If desired, change the name of filter element in the Name box. *† ’' €€ˆˆ‚€‚ÿIhÛ1ŸÿÿÿÿÿÿÿÿiÛuCShow/Hide Filter DetailsB’' €6€ ˆ‚€‚ÿShow/Hide Filter Detailsª}ÛÇ- *€ú€ˆˆ‚€€€‚ÿWhen the filter is displayed in the State window, it is possible to show or hide detailed information about the filter. ‹R^@9 B€¦€VˆˆÈ:‚H€ƒ†"€€€‚ÿÇ^@’1.To toggle Show and Hide Details, click the button in the State toolbar. J#Ǩ@' €F€ˆˆ‚€‚ÿThe following details are shown:#õ^@ËA. *€ë€VˆˆÈ:‚H€ ƒ€‚ÿ·The number of filter elements used for each state are shown. A maximum of 8 filter elements can be used per state for CMM2 devices, 4 for GAM devices. This information can let you know if you are running out of filter elements for a state.€R¨@KC. *€¥€VˆˆÈ:‚H€ ƒ€‚ÿ·The types of frames that will be captured if conditions are satisfied for an IF or ELSE IF statement. The types of frames to be captured is set in the Root statement; however, the types of frames can be changed in any IF or ELSE IF statement. This information will let you know if you have changed the frame types for any statement.*ËAuC' €€ˆˆ‚€‚ÿBKC·C1Iÿÿÿÿÿÿÿÿj·CòC HActivate a Filter;uCòC' €(€ ˆ‚€‚ÿActivate a FilterF·C8D' €>€œŒ‚€‚ÿTO ACTIVATE A CAPTURE FILTERËòCVES t€›€VˆˆÈ:‚H€ƒ€€†"€‚ƒ‚ƒ†"€€€€€‚ÿ1.From the Detail View toolbar, click the button.2.Ensure the filter interface displays the filter you want to activate. 3.Press the button on the Create/Modify Filter or State toolbar.ìÄ8DBF( €‰€ˆˆ‚€‚ÿThe filter remains active for that resource until you unload the filter. Capture filters are associated with a hardware resource, different capture filters can be loaded to different resources.FVEˆF' €>€œŒ‚€‚ÿTO ACTIVATE A DISPLAY FILTERÌBF§GS t€€VˆˆÈ:‚H€ƒ€€†"€‚ƒ‚ƒ†"€€€€€‚ÿ1.From the Detail View toolbar, click the button.2.Ensure the filter interface displays the filter you want to activate. 3.Press the button on the Create/Modify Filter or State toolbar. c9ˆF H* $€r€ˆˆ‚€€‚ÿOnly one display filter applies for all view windows.= §GGH1ÿÿÿÿdŠkGH}HLOCapture Data6 H}H' €€ ˆ‚€‚ÿCapture Data yGHI' €ò€ˆˆ‚€‚ÿIf you are using a Capture Filter to filter data, the filter must be set up and loaded prior to starting the resource.?}H\I* $€*€œŒ‚€€‚ÿFROM SUMMARY VIEW~;IÚJC T€{€VˆˆÈ:‚H€ƒ‚ƒ†"€‚ƒ†"€‚ƒ‚ÿ1.Make sure that the resource you want is selected in Summary View. Click on its open window or click on the resource name in the Resource Browser.2.From the Module toolbar, click the button to set capture mode.3.From the Module toolbar, click the button; or, press Crtl + T.4.Do one of the following: Ç\IæKE X€‘€Vˆˆ‘€:„H€ƒ†"€ ‚ƒâŸö%°€‰€‚ÿa.Stop the resource manually. From the Module toolbar, click the button.b.If the post trigger buffer position is set, wait until the capture buffer fills and capture stops automatically.X1ÚJ>L' €b€ˆˆ‚€‚ÿIf desired, save the captured data to a file. >æK|L* $€(€œŒ‚€€‚ÿFROM DETAIL VIEWg&>LãMA P€Q€VˆˆÈ:‚H€ƒ†"€‚ƒ†"€‚ƒ‚ÿ1.Set the mode to Capture (Receive). The current mode for the resource displays in the window name for the selected resource. From the Detail View toolbar, click the to set capture mode.2.From the Detail View toolbar, click the button; or, press Crtl + T.3.Do one of the following:Ì|LôNE X€›€Vˆˆ‘€:„H€ƒ†"€ ‚ƒâŸö%°€‰€‚ÿa.Stop the resource manually. From the Detail View toolbar, click the button.b.If the post trigger buffer position is set, wait until the capture buffer fills and capture stops automatically.X1ãMLO' €b€ˆˆ‚€‚ÿIf desired, save the captured data to a file. V%ôN¢O1ßW…'l¢O €7ƒDisable a Capture Filter for a ModuleO(LO €' €P€ ˆ‚€‚ÿDisable a Capture Filter for a Module¢O €LOš¢O΀( €5€ˆˆ‚€‚ÿA capture filter that has been loaded to a resource can be disabled. Once the filter is disabled, all frames are captured when the resource is started.? € * $€*€œŒ‚€€‚ÿFROM SUMMARY VIEWÝ΀+‚A P€¿€VˆˆÈ:‚H€ƒ‚ƒ†"€‚ƒ†"€!‚ÿ1.Select a resource name in the Resource Browser or click on its open window.2.Click the button from the Module toolbar to make sure the resource is in capture mode.3.From the Module toolbar, click the button.> i‚* $€(€œŒ‚€€‚ÿFROM DETAIL VIEW΃+‚7ƒK d€ €VˆˆÈ:‚H€ƒ†"€‚ƒ€€€€†"€‚ÿ1.From the Detail View toolbar, click the button.2.From the Create/Modify Filter or State toolbar, click the button.Fi‚}ƒ1údŠ€m}ƒ¼ƒ…ŠLoad a Capture Filter?7ƒ¼ƒ' €0€ ˆ‚€‚ÿLoad a Capture FilterÈ }ƒ„„( €A€ˆˆ‚€‚ÿYou must load a capture filter to a resource before it can be used to filter incoming packets. The resource must be in capture mode to load a capture filter.?¼ƒÄ* $€*€œŒ‚€€‚ÿFROM SUMMARY VIEW´i„„w†K d€×€VˆˆÈ:‚H€ƒ‚ƒ†"€‚ƒ†"€"‚ƒ‚ƒ€€‚ÿ1.Select a resource name in the Resource Browser or click on its open window.2.Click the button from the Module toolbar to make sure the resource is in capture mode.3.From the Module toolbar, click the button.4.From the dialog box, select the name of the capture filter to load. Capture filters have an extension of .CFD.5.Click the OK button.>ĵ†* $€(€œŒ‚€€‚ÿFROM DETAIL VIEWÎyw†ƒˆU x€û€VˆˆÈ:‚H€ƒ†"€‚ƒ†"€‚ƒ†"€#‚ƒ†"€‚ÿ1.Click the button from the Detail View toolbar to make sure the resource is in capture mode.2.From the Detail View toolbar, click the button.3.Use the filter interface to create a filter. Or, click the button to open a previously-defined filter.4.Click the button to load the filter. The filter as displayed in the filter interface is loaded to the resource.W)µ†Ú‰. *€S€ˆˆ‚€€€‚ÿFor a simple filter, the filter elements in the filter combination box in the right of the Create/Modify Filter window defined the filter that will be loaded. The hex/decimal display at the bottom of the window does not show a complete mask of what will be loaded to the resource as a filter.6 ƒˆŠ* $€€œŒ‚€€‚ÿSEE ALSOu8Ú‰…Š= J€p€ˆˆ‚ãÊĺ^€‰€‚ã8#g†€‰€‚ÿOpen a capture filter Create a capture filterHŠÍŠ1Dÿÿÿÿk…nÍŠ‹ñÇTransmit SpecificationsI"…Š‹' €D€ ˆ‚€‚ÿTransmit Specification OverviewCÍŠY5 8€€ˆˆ‚€€€€€‚‚ÿThe Packet Blaster plug-in allows you to generate packets and send them onto a network. This can be used to force the network to respond to known or suspected problem conditions or loads. Transmitted data can answer “What If?” questions about the network or particular network resources.To transmit data, you first set up a Transmit Specification. After the Transmit Specification is loaded to a module, click on the Start button to begin transmit. You can also transmit a previously captured data file (capture file).¥{‹ À* "€÷€ˆˆ‚€‚‚‚ÿYou can transmit the contents of a capture file. Data previously collected in the capture file can be loaded to a module and sent to the network.Using Shomiti analyzer cards, you can transmit packets at full network speed or faster. This allows you to set up high traffic conditions and see how the network performs. Surveyor can also transmit a variety of user-defined packet contents to see their effect on the network.With multiple modules, transmitted data can be captured by another analyzer card. You can use the capture and view features in the Surveyor System Manager software to analyze the results, all from the same PC.Y À…Ї^Y“Â) €½€ˆˆ‚€‚‚ÿAlthough you can transmit using NDIS modules, these devices are not always accurate transmit devices. The actual rate of transmission for an NDIS module is not predictable.You can specify the frames you want in any order, with any time interval between frames. Bursts of the same frame can be specified. Frames or bursts of frames can be repeated any number of times. Frames can be from 8 to 15,000 bytes in length. Packet types can be identified and station addresses can easily be inserted in the data stream. Transmitted frames can be numbered so they can be viewed more easily at the receiving end.Ì À”Ä5 8€™€ˆˆ‚€ãÀC"K€‰€‚‚ÿBefore writing transmit specifications, we suggest that you look at some of the example specifications provided with Surveyor. This will give you an idea of the types of specifications that can be authored. Use of Transmit Specifications requires the Packet Blaster plug-in available from Shomiti.Select one of the following subjects to learn more about transmit specifications. Use the browse buttons to page through all the subjects in the tutorial.`*“ÂôÄ6 <€T€VˆˆÈ:‚H€ƒã)d €‰€‚ÿ·Transmit Specification Dialog BoxO”ÄCÅ6 <€2€VˆˆÈ:‚H€ƒã°Mì#€‰€‚ÿ·Repeating Framesm7ôİÅ6 <€n€VˆˆÈ:‚H€ƒãäÒÑB€‰€‚ÿ·Defined Streams, Activated/Deactivated StreamsECÅõÅ6 <€€VˆˆÈ:‚H€ƒã;m¥€‰€‚ÿ·BurstsK°Å@Æ6 <€*€VˆˆÈ:‚H€ƒãÝœS€‰€‚ÿ·Stream ModesQõÅ‘Æ6 <€6€VˆˆÈ:‚H€ƒã¯»"€‰€‚ÿ·Transmission ModesY#@ÆêÆ6 <€F€VˆˆÈ:‚H€ƒã‰ZÑÈ€‰€‚ÿ·Transmitting Capture FilesO‘Æ9Ç6 <€2€VˆˆÈ:‚H€ƒãDðq€‰€‚ÿ·Using Templates LêÆ…Ç6 <€,€VˆˆÈ:‚H€ƒã^”ÞI€‰€‚ÿ·Packet Editorl69ÇñÇ6 <€l€VˆˆÈ:‚H€ƒãú8Ô€‰€‚ÿ·Hints and Tips for the Transmit SpecificationR!…ÇCÈ1 ]OoCȎȼTransmit Specification Dialog BoxK$ñÇŽÈ' €H€ ˆ‚€‚ÿTransmit Specification Dialog BoxÇ–CÈUÉ1 0€/€ˆˆ‚€†"€$‚ÿTo bring up the Transmit Specification dialog box, press the button from the Detail View toolbar. The Transmit Specification dialog box contains:TŽÈÖÉ- *€¨€VˆˆÈ:‚H€ ƒ€‚ÿ·List box for viewing defined streams called the Defined Streams list box (top)j=UÉ@Ê- *€z€VˆˆÈ:‚H€ ƒ€‚ÿ·Radio buttons and fields for defining a stream (middle)e8ÖÉ¥Ê- *€p€VˆˆÈ:‚H€ ƒ€‚ÿ·Buttons for adding, modifying, or deleting streamsF@ÊëÊ- *€2€VˆˆÈ:‚H€ ƒ€‚ÿ·Transmission status§z¥Ê’Ë- *€ô€VˆˆÈ:‚H€ ƒ€‚ÿ·Buttons for loading the resource, opening/saving the specifications, adding stream using templates or Magic Packets™,ñëʾÎ; D€ã€ˆˆ‚€ãäÒÑB€‰€€€‚‚ÿThe Defined Streams list box is a synopsis of the entire specification. Each added stream displays on a separate line. Each defined stream can be activated or deactivated by double-clicking the stream. A check mark beside the stream indicates that it’s activated. Only activated streams are loaded to a resource.Specify the contents and the size of the stream using the DA, SA, Packet Type, Packet Size, and Data fields. DA and SA values can be retrieved from the currently active name table using the Names button. Sequence numbers (Start Seq# and Stop Seq#) are used to number the packets; packet numbering may be useful at the receiving end. When viewing packets at the receiving end, the two-byte sequence number is located at 32H and 33H.2ý’Ëü5 8€û€ˆˆ‚€ãÝœS€‰€‚‚ÿSet the Stream Mode using the radio buttons and the Burst check box. The stream mode defines the rate at which packets are transmitted from a resource and whether bursts of packets with a different rate will be transmitted within the stream.Set the Repeat Streams¾ÎüñÇ field to repeat the stream more than one time. This setting specifies the number of times to repeat one complete stream -- not how many times to repeat transmission of the entire specification, nor the number of bursts within the stream.ÀO¾Î¼q °€Ÿ€ˆˆ‚€€€€€€€€€€€€€€€€€‚㯻"€‰€€€€€‚ÿThe Add, Add File.., Modify, Delete, and Edit Data.. Edit buttons perform functions for a single stream. The Load Module, Open Specs, and Save Specs buttons perform functions for a complete transmit specification. Use the templates button to add packets using templates or by using Magic Packets ™.The Transmission Mode radio buttons control how many times all streams are transmitted once they are loaded to the resource. You can transmit ‘n’ times or transmit continuously. The transmission mode is not part of the transmit specification when saving to a file._.ü1Xk…JpsšDefined Streams, Activated/Deactivated StreamsX1¼s' €b€ ˆ‚€‚ÿDefined Streams, Activated/Deactivated Streamse0Ø5 8€a€ˆˆ‚€€€€€‚‚ÿA defined stream is a specification for transmitting frames from a resource. Multiple streams can be defined for a transmit specification. Define a stream using the options available from the dialog box and click the Add button. You can also add a capture file as a defined stream using the Add File… button. The stream appears in the Defined Streams list box. Streams are transmitted by the resource in the order in which they are defined.A defined stream may be activated or deactivated by double-clicking on the stream. An activated stream has a check mark next to it in the Defined Streams window; a deactivated stream has no check mark. Only activated streams are loaded to the resource when you click the Load Module button. Before loading a resource, make sure you have activated the streams you want.šsš( €5€ˆˆ‚€‚ÿThe number of streams does not necessarily equate to the number of frames transmitted, as a single stream can define multiple frames to be transmitted.AØÛ1‰O€qÛ ã@Repeating Frames:š ' €&€ ˆ‚€‚ÿRepeating Framesb;Ûw ' €v€ˆˆ‚€‚ÿThere are three ways to repeat frames when transmitting:Óˆ J K d€€Vˆˆù ~„ù€ƒ‚€€ƒ€€‚ƒ€€€€‚ÿCheck the bursts box Repeats frames of a stream with a specific timing set between the frames. The special timing is set in the Burst Gap field, the number of repetitions in the Burst Count field.Repeat Stream n TimesRepeats the stream n times. The gap between frames is set as a packet gap, frame rate, or traffic rate. The gap is referred to in the Transmit Specification as the Stream Mode.Transmission ModeYou can set the resource to loop through the entire transmit specification n number of times. Streams are repeated in the specification from first to last until you stop the resource or all streams are transmitted n times.Sw 4 6€?€ˆˆ‚€€€€‚‚‚ÿWARNING: Repeating frames using the transmission mode feature is a software function for NDIS modules. For these types of modules, there is a time gap of about 50ms between each transmission of the entire specification. Use Repeat Stream n Times or Bursts where timing issues are critical when sending frames.Ways of repeating frames can be used together. For example, assume the following two streams are defined:Stream 1; packet gap=100msec, burst count=4, burst gap=4msec, repeat frame 2 timesStream 2; packet gap=200msec, no burst:þJ ã@< F€ý€ˆˆ‚€‚‚‚‚ÿThe example results in the following:Transmit Stream 1Wait 100msecTransmit Stream 1Wait 100msecTransmit Stream 1Wait 100msecTransmit Stream 1Wait 104msecTransmit Stream 1Wait 100msecTransmit Stream 1Wait 100msecTransmit Stream 1Wait 100msecTransmit Stream 1Wait 104msecTransmitã@š Stream 2Wait 200msecIf the transmission mode is set to continuous, the entire sequence above is repeated until the resource is stopped.The Repeat Stream field sets how many times to repeat the current stream. =  A1˜Jò‚r AVA½DStream Modes6ã@VA' €€ ˆ‚€‚ÿStream Modes‹d AáA' €È€ˆˆ‚€‚ÿThe stream mode defines the rate at which packets are transmitted from a resource. The modes are:_,VA@C3 4€Y€Vˆˆi›~„i€ƒ‚ƒ‚ƒ‚ÿPacket GapThe rate is set as an interval of time between packets. The interval can be set in seconds, milliseconds, or microseconds.Frame Rate The rate is set in number of frames per second.Traffic RateThe rate is set as a percentage of the maximum speed (10Mbps or 100Mbps) for the resource.}SáA½D* "€§€ˆˆ„i€‚ÿThe minimum packet gap is .96 microseconds for 100Mbps networks and 9.6 microseconds for 10 Mbps networks. However, if you want to transmit at faster than line rate, one specific packet-gap value below the minimum. To transmit at faster than line rate, set the packet gap to 3.2 microseconds for 10 Mbps or.88 microseconds for 100 Mbps.7@CôD1Ç€Z…sôD$EºGBursts0 ½D$E' €€ ˆ‚€‚ÿBursts–_ôDºG7 <€¿€ˆˆ‚€‚‚‚‚‚ÿBursts cause a stream to be transmitted again and again. Set the Burst Count to the number of times to send the frame. An interval (packet gap) can be set between bursts.The following example shows how bursts and burst timing work. Assume three streams are defined as follows:Stream 1; Packet Gap=100msec., No burstStream 2; Packet Gap=20msec, Burst Count=3, Burst Gap=4msecStream 3; Packet Gap=5msec., No burstThe example results in the following:Transmit Stream 1Wait 100msecTransmit Stream 2Wait 20msecTransmit Stream 2Wait 20msecTransmit Stream 2Wait 24msecTransmit Stream 3Wait 5msecC$EýG1eò‚9ˆtýG9HmKTransmission Modes<ºG9H' €*€ ˆ‚€‚ÿTransmission ModesÎýGIJB R€€ˆˆ‚€€€€€‚€€‚€€‚ÿThe transmission mode is either Transmit Continuously or Transmit frames ‘n’ times. Select Transmit Continuously to transmit activated streams in a loop until the resource is stopped. Select Transmit Spec (N frames) to transmit activated streams a specific number of times. The number of times the entire specification is transmitted is set in the Time(s) field. The number of streams does not necessarily equate to the number of frames transmitted.$ü9HmK( €ù€ˆˆ‚€‚ÿWARNING: The transmission mode should always be set prior to loading the resource. The transmission mode is not saved as part of the transmit specification. Unless you set the transmission mode, you may inadvertently flood the network with packets. KIJ¸K1ÜZ…Ò‰u¸KüK§MTransmitting Capture FilesDmKüK' €:€ ˆ‚€‚ÿTransmitting Capture Files«|¸K§M/ ,€ù€ˆˆ‚€€€‚‚ÿYou can transmit the contents of a capture file as one of the streams in the transmit specification. Place a capture file as a stream into the Defined Streams list box using the Add File… button.The entire contents of the capture file is transmitted with time stamps intact. As with any other stream, you can repeat transmission of the file by using the Repeat Stream field.[*üKN1õ9ˆ¶vNVNV‚Using Templates in Transmit SpecificationsT-§MVN' €Z€ ˆ‚€‚ÿUsing Templates in Transmit Specifications¬wN5 8€ï€ˆˆ‚€€€‚€€‚ÿIf you are inserting a new stream, you can use a template as the starting point for packet data. To select a template, press the Template… button at the bottom of the Transmit Specification dialog box. Nested menus appear to select a template. When you select a template, the values of the template will replace the field values in the Transmit Specification dialog box.VN§M You can also use Magic Packet ™ to generate packets.Templates insert the required values for commonly known packet types in the data for the stream. For example, if you select the template for IPX, the value 0x8137 is inserted in the Packet Type field.©|VN·- *€ø€ˆˆ‚€€€‚ÿPress the Edit Data… button to bring up the packet editor and modify the template to create the exact packet you want. 2 é' €€œŒ‚€‚ÿSEE ALSOm/·V‚> L€^€ˆˆ‚ã|½zÙ€‰€‚ã^”ÞI€‰€‚‚ÿAdd Packet Templates Packet Editor \+鲂15Ò‰aw²‚ƒ ‡Hints and Tips for a Transmit SpecificationU.V‚ƒ' €\€ ˆ‚€‚ÿHints and Tips for a Transmit Specificationk:²‚r…1 0€u€VˆˆÈ:‚H€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1.Be careful what you transmit. The Surveyor is capable of transmitting packets at 100% of network bandwidth or more. It is possible to flood the network and cripple performance.2.Make sure that the transmit streams you want are activated before you load the transmit specification onto the resource.3.The transmission mode is not saved as part of the transmit specification, so it should be checked before each resource is loaded.4.Transmitted packets can be sent to another resource. Use sequence numbers to aid in analyzing the packets at the receiving end.o@ƒá†/ ,€€VˆˆÈ:‚H€ƒ‚ƒ‚ƒ‚ÿ5.Using bursts is the easiest way to simulate high traffic conditions.6.Always save your defined transmit specification. 7.An NDIS module cannot transmit bad physical layer error packets such as a bad CRC, runt packets, oversized packets, or undersized packets. Use GAM or CMM2 modules to generate error packets.*r… ‡' €€ˆˆ‚€‚ÿPá†[‡1x¶Šx[‡®‡õ‰Transmit Specification ExamplesS, ‡®‡' €X€ ˆ‚€‚ÿAccessing Transmit Specification ExamplesGý[‡õ‰J b€û€ˆˆ‚€‚‚ãnöЀ‰€‚ãÐKqЀ‰€‚€€‚ÿTransmit specification examples are supplied with Surveyor. Open a transmission specification file (TRANSMIT subdirectory, .TSP extension) from the Transmit Specification dialog box to see examples. Two transmit specification examples are described in the help system. Click on the example name to view the example.Example1 -- This example shows a stream that uses packet gaps.Example2 -- This example shows a stream that uses bursts.To find more examples, look in the ..\examples directory. ^-®‡SŠ1¶aáySŠªŠ/ŒTransmit Specification Example 1, Packet GapsW0õ‰ªŠ' €`€ ˆ‚€‚ÿTransmit Specification Example 1, Packet GapsP!SŠú‹/ ,€C€ˆˆ‚€€€‚‚ÿA transmit specification example in its dialog box is shown below. Press on any area of the dialog box below to find out more about the buttons, fields, and values in the example. The dialog box only shows the values for one stream. Multiple streams are defined in the specification.5ªŠ/Œ0 0€ € ˆˆ‚€†"€%‚ÿ Y(ú‹ˆŒ1§ŠÿÿÿÿzˆŒÚŒPŽTransmit Specification Example 2, BurstsR+/ŒÚŒ' €V€ ˆ‚€‚ÿTransmit Specification Example 2, BurstsAˆŒŽ/ ,€%€ˆˆ‚€€€‚‚ÿA transmit specification dialog box is shown below. Press on any area of the dialog box below to find out more about the buttons, fields, and values in the example. The dialog box only shows the values for one stream. Multiple streams are defined in the specification.5ÚŒPŽ0 0€ € ˆˆ‚€†"€&‚ÿ HŽ˜Ž1‡ÿÿÿÿÿÿÿÿ{ÿÿÿÿ˜Ž ÀActive Stream IndicatorAPŽÙŽ' €4€˜ˆ‚€‚ÿActive Stream IndicatorþÖ˜Ž À( €­€ˆˆ‚€‚ÿA check mark indicates that the stream is active. No check mark indicates that the stream is deactivated. Double-click on a stream to activate/deactivate the stream. Only active streams are loaded to a resource.ÙŽ ÀPŽGÙŽSÀ1Ÿÿÿÿÿÿÿÿÿ|ÿÿÿÿSÀ«ÃDefined Streams WindowB À•À' €6€˜ˆ‚€‚ÿDefined Streams List Box^5SÀóÂ) €k€ˆˆ‚€‚‚ÿThe defined streams list box shows a synopsis of all streams defined for the transmit specification. In the example, four streams are defined and all streams are activated. The first stream in the list, highlighted in blue, is the currently selected stream. An inactive stream in the window would be highlighted in black and no check mark would appear next to the stream.The settings for the currently selected stream show in the fields of the dialog box below the Defined Streams list box. If you select a different stream, the value of the fields will change.¸•À«Ã( €!€ˆˆ‚€‚ÿThe currently selected stream is highlighted in the highlight color for Windows. A deactivated stream is shown in the Windows inactive color.GóÂòÃ1ïÿÿÿÿÿÿÿÿ}ÿÿÿÿòÚÆDefined Streams WindowB«Ã4Ä' €6€˜ˆ‚€‚ÿDefined Streams List Boxf<òÚÆ* "€y€ˆˆ‚€‚‚‚ÿThe defined streams list box shows a synopsis of all streams defined for the transmit specification. In the example, two streams are defined and all streams are activated. The stream highlighted in blue is the currently selected stream.The settings for the currently selected stream show in the fields of the dialog box below the Defined Streams list box. If you select a different stream, the value of the fields will change.The currently selected stream is highlighted in the highlight color for Windows. A deactivated stream is shown in the Windows inactive color.A4ÄÛÆ1eÿÿÿÿÿÿÿÿ~ÿÿÿÿÛÆÿÉDA and SA Fields:šÆÇ' €&€˜ˆ‚€‚ÿDA and SA Fields<ÛÆQÉ) €'€ˆˆ‚€‚‚ÿDA and SA fields define the MAC layer source address and MAC layer destination address for selected stream. Note that the MAC address values appear in the stream synopsis in the Defined Streams window. Use an "X" in any offset of the DA or SA fields to indicate "wild card" addresses. Surveyor will generate packets with different values in that offset. For example, set the DA field to 432FFFFFXX. When transmitting packets, values will be generated either sequentially or randomly and sent for the last 2 positions of the DA.®†ÇÿÉ( € €ˆˆ‚€‚ÿThe values for the wild cards can be random or sequential, as defined by the Random Access Mode buttons below the DA and SA fields.= QÉ<Ê1Ûÿÿÿÿÿÿÿÿÿÿÿÿ<ÊÚËNames Button6ÿÉrÊ' €€˜ˆ‚€‚ÿNames Buttonh:<ÊÚË. *€u€ˆˆ‚€€€‚ÿClick on the Names... button to see the currently active name table. You can set the DA or SA from the name table and they will appear in the DA or SA fields in the Transmit Specification window. The name appears to the right of the DA or SA address if the name table contains a symbolic name for the address.< rÊÌ1Œÿÿÿÿÿÿÿÿ€ÿÿÿÿÌfÍPacket Type5ÚËKÌ' €€˜ˆ‚€‚ÿPacket TypeóÌfÍ( €ç€ˆˆ‚€‚ÿThis field sets the packet type for the current stream. Use the pull-down box to see available options. In the example stream, the packet is an IP packet. This field can also be used to enter the packet length for IEEE 802.2 or SNAP frames.< KÌ¢Í1Žÿÿÿÿÿÿÿÿÿÿÿÿ¢ÍôÎPacket Size5fÍ×Í' €€˜ˆ‚€‚ÿPacket Sizeõ¢ÍôÎ( €ë€ˆˆ‚€‚ÿThis field sets the packet size. Use the pull-down box to view common sizes. The size must be from 8 to 15,000 bytes for CMMs. The packet size must be from 64 to 1518 bytes for NDIS modules. In the example stream, the packet size is 64 bytes.P×ÍDÏ1Aÿÿÿÿÿÿÿÿ‚ÿÿÿÿDÏè Start and Stop Sequence Numbers:ôÎ~Ï' €&€˜ˆ‚€‚ÿSequence Numbers4 DϾ ( €€ˆˆ‚€‚ÿThis field sets the starting number and ending numbers for packets transmitted. It also s~Ͼ ôÎets the offset within the frame where the sequence number will be stored. In the example, frames are numbered up to 1000 and the frame number information is stored at offset 0x50. You cannot store the sequence number in the first 12 offsets of the frame. Also, you should take care not to store the sequence number in any part of the packet that contains other information that will used by the network or by the receiving station.*~Ïè ' €€ˆˆ‚€‚ÿD¾ , 14ÿÿÿÿÿÿÿÿƒÿÿÿÿ,  Stream Mode Buttons=è i ' €,€˜ˆ‚€‚ÿStream Mode Buttons³‹,  ( €€ˆˆ‚€‚ÿAn interpacket gap for a frame can be sent in three different ways; Packet Gap, Frame Rate and Traffic Rate. In the example stream, Packet Gap is selected. This activates the Packet Gap Units buttons to select a unit for the packet gap. The time of the gap is specified in the Packet Gap field. In the example, a gap of .96 microseconds is inserted after the stream has finished transmitting.Di ` 14ÿÿÿÿÿÿÿÿ„ÿÿÿÿ` P Stream Mode Buttons=  ' €,€˜ˆ‚€‚ÿStream Mode Buttons³‹` P ( €€ˆˆ‚€‚ÿAn interpacket gap for a frame can be sent in three different ways; Packet Gap, Frame Rate and Traffic Rate. In the example stream, Packet Gap is selected. This activates the Packet Gap Units buttons to select a unit for the packet gap. The time of the gap is specified in the Packet Gap field. In the example, a gap of .96 microseconds is inserted after the stream has finished transmitting.?  1¢ÿÿÿÿÿÿÿÿ…ÿÿÿÿ ò Burst Settings8P Ç ' €"€˜ˆ‚€‚ÿBurst Settings+ ò ( €€ˆˆ‚€‚ÿCheck the Bursts box to send a burst of packets with the stream. If the Burst box is checked, specify the burst using the Burst Count and Burst Gap fields. Using bursts, a single stream can be sent many times. No bursts are specified in the example stream.?Ç 1 1Ùÿÿÿÿÿÿÿÿ†ÿÿÿÿ1 Ë Burst Settings8ò i ' €"€˜ˆ‚€‚ÿBurst Settingsb91 Ë ) €s€ˆˆ‚€‚‚ÿCheck the Bursts box to send a burst of packets with the stream. If the Burst box is checked, specify the burst using the Burst Count and Burst Gap fields. Using bursts, a single frame can be sent many times. In the example stream, a burst of 100 frames is sent with a gap of 1 millisecond between each frame.?i 1“ÿÿÿÿÿÿÿÿ‡ÿÿÿÿ ^ Stream Buttons?Ë I ' €0€˜ˆ‚€‚ÿStream Action Buttonsk5 ´ 6 :€k€ˆˆ‚€‚€€‚€€‚ÿThese buttons define the transmit specification by acting on entire streams. Add - Adds a new stream after the currently selected stream in the Defined Streams window. The values displayed in the fields of the Transmit Specification window are used as the values for the new stream.Add File… - Adds a new stream defined by capture file (.CAP file) in the Defined Streams window. A dialog box appears asking for the name of the capture file. The first packet in the capture file is the defined stream. All subsequent packets in the capture file are ignored.ªdI ^ F Z€É€ˆˆ‚€€‚€€‚€€ã^”ÞI€‰€‚‚ÿModify - Changes the definition of the current stream. The values displayed in the fields of the Transmit Specification window overwrite the values of the currently selected stream.Delete - Deletes the currently selected stream.Edit Data… - Brings up the packet editor. You can use the packet editor to modify the currently selected stream. C´ ¡ 1éÿÿÿÿÿÿÿÿˆÿÿÿÿ¡ \A Transmission Modes;^ Ü ' €(€˜ˆ‚€‚ÿTransmission Modet>¡ \A 6 :€}€ˆˆ‚€€€‚‚€€‚ÿSets the type of transmission for the entire specification, either n number of times or continuous. In the example, the sequence of streams is transmitted once. The text next to the field indicates the total number of frames that will Ü \A ^ be transmitted. In the example, four streams are activated and each stream transmits only one frame. Therefore, a total of four frames are transmitted.You can transmit the entire specification a number of times by setting the Time(s) field. Remember that there is a time delay when retranslating the entire Transmit Specification.CÜ ŸA 1ÿÿÿÿÿÿÿÿ‰ÿÿÿÿŸA dD Transmission Modes;\A ÚA ' €(€˜ˆ‚€‚ÿTransmission ModeŠTŸA dD 6 :€©€ˆˆ‚€€€‚‚€€‚ÿSets the type of transmission for the entire specification, either n number of times or continuous. In the example, the sequence of streams is transmitted once. The button indicates the total number of frames that will be transmitted. In the example, 2 streams are activated which transmit a total of 101 frames. The stream that defines a burst transmits 100 frames and the other stream transmits one frame.You can transmit the entire specification a number of times by setting the Time(s) field. Remember that there is a time delay when retransmitting the entire Transmit Specification.DÚA ¨D 1gÿÿÿÿÿÿÿÿŠÿÿÿÿ¨D ËF Transmission Status=dD åD ' €,€˜ˆ‚€‚ÿTransmission Status澨D ËF ( €}€ˆˆ‚€‚ÿThe Transmission Status area provides status information about the transmission. It indicates the speed of the currently active resource, the number of streams that are active, and the total memory in the buffer required to transmit the specification. The total memory increments as you add/change streams, giving you an instant reflection of how much data you are transmitting. An error message is shown if you exceed the capture buffer size.OåD G 11ÿÿÿÿÿÿÿÿ‹ÿÿÿÿG üK Transmit Specification ButtonsH!ËF bG ' €B€˜ˆ‚€‚ÿTransmit Specification ButtonsJ G ¬I ? L€€ˆˆ‚€€€€‚€€‚€€‚ÿLoad Module - Loads the current resource with the currently defined Transmit Specification. Be sure to use the Load Module button to load the specification to the resource before you begin transmission.Open Specs... - Opens a previously saved Transmit Specification. A dialog box appears to specify the name and location of the Transmit Specification.Save Specs… - Saves the currently defined Transmit Specification to a file. A dialog box appears to specify the name and location of the Transmit Specification.PbG üK 8 >€1€ˆˆ‚€€€€‚€€‚ÿTemplate… - Shows menus that list the currently defined templates for packets. Selecting a template places the values of the template in the fields of the Transmit Specification dialog box. You can then change the values of the fields in the Transmit Specification dialog box or use the Edit Data… button to create exactly the packet you wish.Cancel - Closes the Transmit Specification dialog box. Make sure you have added/modified all streams, saved new Transmit Specifications, and loaded the resource before pressing Cancel.?¬I ;L 1°ÿÿÿÿÿÿÿÿŒÿÿÿÿ;L ¬M Repeat Streams7üK rL ' € €˜ˆ‚€‚ÿRepeat Stream:;L ¬M ( €%€ˆˆ‚€‚ÿThis field specifies how many times to repeat the current stream. In the example, the stream is only sent once. If you modified the Repeat Stream field to a value of 8, the current stream would be sent 8 times before the next stream in the transmit specification is sent.9rL åM 1VÿÿÿÿÿÿÿÿÿÿÿÿåM O Auto CRC2 ¬M N ' €€˜ˆ‚€‚ÿAuto CRCë½åM O . *€{€ˆˆ‚€€€‚ÿLeave this box checked to generate correct CRC values for all frames. You can uncheck this box and then use the packet editor (Edit Data… button) to create frames that have CRC errors.; N =O 1ÉÿÿÿÿÿÿÿÿŽÿÿÿÿ=O ž€ Data Field4 O qO ' €€˜ˆ‚€‚ÿData Field!ù=O ž€ ( €ó€ˆˆ‚€‚ÿThis data field specifies the data to be sent as part of the packet. Use the pull-down box to see commqO ž€ O only used values. Any hexadecimal values can be entered in the Data Field and sent with the packet. The first 32 bytes of data can be specified.CqO ဠ1Aÿÿÿÿÿÿÿÿÿÿÿÿဠ߂ Random Access Mode<ž€  ' €*€˜ˆ‚€‚ÿRandom Access Modešဠ߂ ( €5€ˆˆ‚€‚ÿYou can use X's as wildcards within the source or destination address. Various unique source and destination addresses will be generated during transmit if wildcards are used. The random access mode sets how these addresses are generated. If Random is selected, numbers are assigned randomly to X values in addresses. If Sequential is selected, numbers are assigned in sequential order beginning with zero. P /ƒ 1´ÿÿÿÿÿÿÿÿ/ƒ xƒ û† Create a Transmit SpecificationI"ß‚ xƒ ' €D€ ˆ‚€‚ÿCreate a Transmit SpecificationМ/ƒ H„ 4 6€9€ˆˆ‚€ãw&€‰€‚ÿThe procedure below outlines the process for creating a transmit specification. See the tutorial for complete information on transmit specifications.ŸKxƒ ç… T v€™€VˆˆÈ:‚H€ƒ†"€$‚ƒãE¡I€‰€‚ƒã)d €‰€‚ƒ‚ƒ‚ÿ1.From the Detail View toolbar, click the button.2.Open a transmit specification if you want to base the new specification on an existing specification.3.Define a stream for transmission using the dialog box.4.Click Add to add the stream to the specification.5.Repeat steps 3 and 4 to add additional streams. .H„ † ' €€œŒ‚€‚ÿTIPSæ¾ç… û† ( €}€ˆˆ‚€‚ÿOnce the specification is created, you can save it to disk and/or load it in the resource. You must load the transmit specification to the resource before it can be used to transmit data.P† K‡ 1šÿÿÿÿÿÿÿÿ‘K‡ ”‡ ý‹ Modify a Transmit SpecificationI"û† ”‡ ' €D€ ˆ‚€‚ÿModify a Transmit Specificationg%K‡ ûˆ B R€M€VˆˆÈ:‚H€ƒ†"€$‚ƒ€€‚ƒ‚ƒ‚ÿ1.From the Detail View toolbar, click the button.2.Click the Open Specs.... button.3.Type the name of a transmit specification in the File Name box.Or, click on a file with an extension of .TSP.Or, type the complete path and filename in the File Name box.4.Click the OK button.I”‡ D‰ * $€>€VˆˆÈ:‚H€ƒ‚ÿ5. Modify existing streams.ø¿ûˆ <Š 9 @€€Vˆˆ‘€:„€ƒ‚ƒ‚ƒ€€‚ƒ‚ÿa.Click on a defined stream in the Defined Streams window.b.Make changes to the stream using the dialog box.c.Click the Modify button.d.Repeat steps above to modify other streams.J D‰ †Š * $€@€VˆˆÈ:‚H€ƒ‚ÿ6.Define additional streams:¬v<Š 2‹ 6 <€ì€Vˆˆ‘€:„€ƒ‚ƒ€€‚ƒ‚ÿa.Use the dialog box to define the stream.b.Click the Add button. c.Repeat steps above to add other streams.Ë¢†Š ý‹ ) €E€ˆˆ‚€‚‚ÿStreams are always added as the last stream in the transmit specification.Once the specification is modified, save it to disk and/or load it in the resource. N2‹ KŒ 1¡ÿÿÿÿÿÿÿÿ’KŒ ’Œ Ž Open a Transmit SpecificationG ý‹ ’Œ ' €@€ ˆ‚€‚ÿOpen a Transmit Specificationp(KŒ Ž H ^€S€VˆˆÈ:‚H€ƒ†"€$‚ƒ€€‚ƒ‚ƒ€€‚ÿ1.From the Detail View toolbar, click the button.2.Click the Open Specs... button3.Type the name of a transmit specification in the File Name box. Or, click on a file with an extension of .TSP.Or, type the complete path and filename in the File Name box.4.Click the Open button.N’Œ PŽ 1—ÿÿÿÿÿÿÿÿ“PŽ —Ž À Save a Transmit SpecificationG Ž —Ž ' €@€ ˆ‚€‚ÿSave a Transmit SpecificationfPŽ À G \€A€VˆˆÈ:‚H€ƒ†"€$‚ƒ€€‚ƒ‚ƒ€€‚ÿ1.From the Detail View toolbar, click the button.2.Click the Save Spec... button3.The file must have an extension of .TSP. Type the name of a transmit specification in the File Name box. Or, type the complete path and filename in the File Name box.4.Click the OK button.—Ž À Ž L—Ž XÀ 1Ò'£…”XÀ À >È Transmit Data from a BufferE À À ' €<€ ˆ‚€‚ÿTransmit Data from a BufferΦXÀ kÁ ( €M€ˆˆ‚€‚ÿYou may transmit data from the capture buffer instead of as defined in a transmit specification. Load the resource with a capture file and then begin transmission.;À ¦Á ' €(€œŒ‚€‚ÿFROM SUMMARY VIEW"ÌkÁ Èà V z€Ÿ€VˆˆÈ:‚H€ƒ†"€'‚ƒ†"€(‚ƒ‚ƒ€€‚ƒ†"€‚ƒ‚ÿ1.From the Module toolbar, click the button to set transmit mode.2.From the Module toolbar, click the button.3.From the dialog box, select the name of the capture file to load. Capture files have an extension of .CAP.4.Click the Open button.5.From the Module toolbar, click the button; or, press Crtl + T.6.Transmit tops automatically. Only one copy of the capture file can be sent. For continuous transmission, transmit from Detail View.:¦Á Ä ' €&€œŒ‚€‚ÿFROM DETAIL VIEW £ÈÃ Æ g œ€K€VˆˆÈ:‚H€ƒ†"€'‚ƒ†"€)‚ƒ€€‚ƒ‚ƒ€€‚ƒ€€€€‚ƒ€€‚ÿ1.From the Detail View toolbar, click the button to set transmit mode.2From the Detail View toolbar, click the button.3.Click the Capture File.. Button.4.From the dialog box, select the name of a capture file to load. Capture files have an extension of .CAP.5.Click the Open button.6Select Transmit Spec (N frames) (one time) or Transmit Continuously (loop).7.Click the Load Module button.œgÄ ¨Æ 5 :€Ð€VˆˆÈ:‚H€ƒ†"€‚ƒ‚ÿ8.From the Detail View toolbar, click the button; or, press Crtl + T.9.Do one of the following:R Æ 'Ç - *€¤€Vˆˆ‘€:†H€ƒ‚ÿa.Wait until the capture buffer is empty and transmission stops automatically.ŠV¨Æ ±Ç 4 8€®€ˆˆÈ†H€ƒ†"€ ‚ÿb.Stop the resource manually. From the Detail View toolbar, click on the button.6 'Ç çÇ * $€€œŒ‚€€‚ÿSEE ALSOW'±Ç >È 0 0€N€ˆˆ‚ã?šWm€‰€‚ÿTransmit Data (Generate Traffic) Q çÇ È 1 €©•È ÙÈ © Transmit Data (Generate Traffic)J#>È ÙÈ ' €F€ ˆ‚€‚ÿTransmit Data (Generate Traffic)fÈ iÉ * $€Ì€ˆˆ‚€€‚ÿTo use a transmit specification, you must load the specification to a module before transmitting. ?ÙÈ ¨É * $€*€œŒ‚€€‚ÿFROM SUMMARY VIEW"×iÉ ÊË K d€³€VˆˆÈ:‚H€ƒ‚ƒ†"€'‚ƒ†"€(‚ƒ‚ƒ€€‚ÿ1.Select a resource name in the Resource Browser or click on its open window.2.Set the mode to Transmit. The current mode for the resource displays in the Window name for the selected resource. From the Module toolbar, click the button to set transmit mode.3.From the Module toolbar, click the button.4.From the dialog box, select the name of the transmit specification to load. Transmit specifications have an extension of .TSP.5.Click the Open button.Ì–¨É –Ì 6 :€/€VˆˆÈ:‚H€ƒ†"€‚ƒ‚ÿ6.From the Module toolbar, click the button; or, press Crtl + T.7.Wait until the capture buffer is empty and transmission stops automatically.>ÊË ÔÌ * $€(€œŒ‚€€‚ÿFROM DETAIL VIEWk–Ì ?Ï [ „€%€VˆˆÈ:‚H€ƒ‚ƒ†"€'‚ƒ†"€$‚ƒ€€‚ƒ‚ƒ€€‚ƒ€€‚ÿ1.Make sure you are in the Detail View window for the resource you want to load.2.Click the button to set transmit mode.3.From the Detail View toolbar, click the button.4.Click the Open Specs... button5.From the dialog box, select the name of a transmit specification to load. Transmit specifications have an extension of .TSP.6.Click the Open button.7.Click the Load Module button. The transmit specification must display in the Transmit Specification dialog box before it can be loaded to a resource.œgÔÌ ÛÏ 5 :€Ð€VˆˆÈ:‚H€ƒ†"€‚ƒ‚ÿ8.From the Detail View toolbar, click the button; or, press Crtl + T.9.Do one of the following:R?Ï f - *€¤€Vˆˆ‘€:†ÛÏ f >È H€ƒ‚ÿa.Wait until the capture buffer is empty and transmission stops automatically.ŠVÛÏ ð 4 8€®€ˆˆÈ†H€ƒ†"€ ‚ÿb.Stop the resource manually. From the Detail View toolbar, click on the button.6 f & * $€€œŒ‚€€‚ÿSEE ALSOƒFð © = J€Œ€ˆˆ‚ãólޝ€‰€‚ã}¿3´€‰€‚ÿCreate a transmit specificationTransmit Data from a Buffer N& ÷ 1ó£…€–÷ >  Load a Transmit SpecificationG © > ' €@€ ˆ‚€‚ÿLoad a Transmit Specification’h÷ Ð * $€Ð€ˆˆ‚€€‚ÿTo use a transmit specification, you must load the specification to a resource before transmitting. ?>  * $€*€œŒ‚€€‚ÿFROM SUMMARY VIEWÅzÐ Ô K d€ù€VˆˆÈ:‚H€ƒ‚ƒ†"€'‚ƒ†"€(‚ƒ‚ƒ€€‚ÿ1.Select a resource name in the Resource Browser or click on its open window.2.Click the button from the Module toolbar to make sure the resource is in transmit mode.3.From the Module toolbar, click the button.4.From the dialog box, select the name of the transmit specification to load. Transmit specifications have an extension of .TSP.5.Click the OK button.>  * $€(€œŒ‚€€‚ÿFROM DETAIL VIEWÁiÔ Ó X ~€Õ€VˆˆÈ:‚H€ƒ‚ƒ†"€'‚ƒãE¡I€‰€ãólޝ€‰€‚ƒ€€‚ÿ1.Make sure you are in the Detail View window for the resource you want to load.2.Click the button to set transmit mode.3.Open a transmit specification or create a transmit specification. The transmit specification must display in the Transmit Specification dialog box before it can be loaded to a resource. 4.Click the Load Module button.-  * $€€ˆˆÈ†H€‚ÿ1Ó 1 1Uÿÿÿÿÿÿÿÿ—ÿÿÿÿ1 U $ U " €€€ÿ= 1 ’ 1_ÿÿÿÿŒ„˜’ Ç ŸI Summary View5U Ç & €€&˜š€‚ÿSummary View©{’ p . *€÷€$Šš€€€‚‚‚ÿSummary View is Surveyor’s global monitoring tool for network data. You can view real-time data from any local resource or any resource you can connect to on the network. You can filter the data before viewing by using a capture filter. Each resource is viewed through its own window within Summary View. You can have as many resources open as you need in Summary View. The display of each resource in Summary View is comprised of six different windows; the window is selected by the tab at the bottom of the window. You can get a single monitoring view, see transmit or receive counters, view alarms set and alarms triggered for this resource, or get a description of the resource (counters supported, etc.). The single monitoring view appears on the first tab of the window, with the name of the view on the tab. There are six tabs available for different views within Summary View:ÙœÇ I = H€9€VˆˆÈ:‚H€ ƒ€€€€€€‚ÿ·“Monitor” – Monitoring view. Refer to the list below for the choices. Each resource can have its own view The selected view will show on the tab.]p Ù 3 6€º€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Rx – Receive counters. A list of MAC counters for capture and capture error counters.“`I l 3 6€À€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Tx – Transmit counters. A list of MAC counters for transmit and transmit error counters.€DÙ ì < H€ˆ€VˆˆÈ:‚H€ƒãïÊŠC€‰€€€‚ÿ·Alarms – Shows the alarm tables applied to this resource.Ž[l z 3 6€¶€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Alarm Log – Log of all real-time alarm events that have occurred for this resource.šgì  3 6€Î€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Description – Provides a brief description of the board, board address, and supported counters.Gz ¡@ : B€€$Šš‚H€€€€€€€‚ÿSelect your monitoring view for Summary View by setting Module à Monitor View Preferences in the Configuration menu. The view you select applies to what you see in the fir ¡@ U st tab and applies to all resources. All resources will show in the first tab using this view (for example, Protocol Distribution as a bar graph).h+ B = H€Y€$Šš‚H€ãU-î󀉀†"€ ‚ÿIn Summary View, you get one monitoring view of many different resources. Go to the Detail View to get many different views of a single resource or to perform detailed analysis functions on captured data. Double-click on the view for the resource or press the button to get to Detail View.C¡@ LC ( €7€$Šš‚H€‚ÿMultiple views of information are available within Summary View. Each view can display as a table or a chart, with the exception of Mac-Network Associations which only displays as a table. Remember that in Summary View you set one of these views which will apply to all resources.Q B C 6 <€6€VˆˆÈ:‚H€ƒãÑÓæ³€‰€‚ÿ·Utilization/Error X"LC õC 6 <€D€VˆˆÈ:‚H€ƒã.ðÙ=€‰€‚ÿ·Frame Size Distribution W!C LD 6 <€B€VˆˆÈ:‚H€ƒãý¨¨¸€‰€‚ÿ·Protocol Distribution JõC –D 6 <€(€VˆˆÈ:‚H€ƒãõÏ“N€‰€‚ÿ·Host Table X"LD îD 6 <€D€VˆˆÈ:‚H€ƒãÚìõ€‰€‚ÿ·Network Layer Host Table \&–D JE 6 <€L€VˆˆÈ:‚H€ƒã´ÑŠ€‰€‚ÿ·Application Layer Host Table KîD •E 6 <€*€VˆˆÈ:‚H€ƒã,Ci €‰€‚ÿ·Host Matrix TJE éE 6 <€<€VˆˆÈ:‚H€ƒã–î ;€‰€‚ÿ·Network Layer Matrix X"•E AF 6 <€D€VˆˆÈ:‚H€ƒãcj€‰€‚ÿ·Application Layer Matrix DéE …F 6 <€€VˆˆÈ:‚H€ƒã+ì:8€‰€‚ÿ·VLAN KAF ÐF 6 <€*€VˆˆÈ:‚H€ƒãÁ *ƒ€‰€‚ÿ·Address Map S…F #G 6 <€:€VˆˆÈ:‚H€ƒãe7€‰€‚ÿ·Packet Summary View k5ÐF ŽG 6 <€j€VˆˆÈ:‚H€ƒãL!ŒÒ€‰€‚ÿ·Duplicate Network Address View (Expert only)X"#G æG 6 <€D€VˆˆÈ:‚H€ƒã’Ú½€‰€‚ÿ·Expert View (Expert only)k5ŽG QH 6 <€j€VˆˆÈ:‚H€ƒãzáN€‰€‚ÿ·Application Response Time View (Expert only)NæG ŸH 6 <€0€VˆˆÈ:‚H€ƒã2'D_€‰€‚ÿ·MAC Statistics *QH ÉH ' €€$Šš‚H€‚ÿ2 ŸH ûH ' €€œŒ‚€‚ÿSEE ALSO_/ÉH ZI 0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module EûH ŸI 0 0€*€$Šš‚ãNV€‰€‚ÿModule Toolbar < ZI ÛI 1EÆ™ÛI J ç‹ Detail View4ŸI J & €€&˜š€‚ÿDetail Viewe8ÛI tL - (€q€$Šš€‚€€‚ÿDetail View is the tool for performing detailed analysis of network data. You can view real-time data from the resource for which you have opened Detail View. You can view and analyze data stored in the capture buffer. You can filter the data before viewing by applying a display filter. Detail View allows multiple monitoring views for a single resource module and also allows the Capture View to be opened for that same module. By contrast, Surveyor’s Summary View allows one monitoring view for multiple resource modules and the Capture View cannot be opened.¥rJ %€ 3 4€å€$Šš€€€‚€€‚ÿYou can have as many windows with data views as are available in Detail View. The initial data view you get of a resource is the view set in the Configuration menu for Summary View. Many of the table or chart views within Detail View can be customized. Within Detail View you can get monitoring views of the resource or view of the capture buffer contents.Files or buffers, such as a capture file or capture buffer, are considered resources just like physical devices that are available from the Resource Browser. If you open a file from Summary View, a Detail View window will open for that resource. Viewing static resources such as files or buffers will change the options available from the toolbars and menus and the data views will appear somewhat different. Surveyor is designed so that you’ll only be able to perform the functions that make setL %€ ŸI nse for that resource. $­tL I‚ w ¼€[€$Šš€ãvËÏ€‰€‚€†z€ÀC¯³!,JI(`Surveyor.HLP',`More_Information_on_Detail_View')‚ÿFor example, if you open the capture buffer, it automatically puts you into Capture View. Buttons for capture, transmit, and monitor are grayed on the Detail View toolbar, since these functions make no sense for a file. If you select another view of the information in the file, it will appear in a table with a gray background indicating its a view of a static resource. Click here for more information on Detail View.K%%€ ”ƒ & €K€$Šš€‚ÿThere multiple view of information available from Detail View. You can open any view by pressing its button on the Data Views toolbar. MAC statistic and utilization/error views show counter information. For these views, the displays depends on the mode of the resource, capture or transmit.]I‚ ñƒ ? N€>€VˆˆÈ:‚H€ƒã2'D_€‰€†"€*‚ÿ·MAC Statistics (Rx) ]”ƒ N„ ? N€>€VˆˆÈ:‚H€ƒã¤Ç)e€‰€†"€*‚ÿ·MAC Statistics (Tx) b#ñƒ °„ ? N€H€VˆˆÈ:‚H€ƒã.ðÙ=€‰€†"€+‚ÿ·Frame Size Distribution a"N„ … ? N€F€VˆˆÈ:‚H€ƒãý¨¨¸€‰€†"€,‚ÿ·Protocol Distribution j+°„ {… ? N€X€VˆˆÈ:‚H€ƒãÑÓæ³€‰€†"€-‚ÿ·Utilization/Error View (Capture) k,… æ… ? N€Z€VˆˆÈ:‚H€ƒãÑÓæ³€‰€†"€.‚ÿ·Utilization/Error View (Transmit) T{… :† ? N€,€VˆˆÈ:‚H€ƒãõÏ“N€‰€†"€/‚ÿ·Host Table b#æ… œ† ? N€H€VˆˆÈ:‚H€ƒãÚìõ€‰€†"€0‚ÿ·Network Layer Host Table f':† ‡ ? N€P€VˆˆÈ:‚H€ƒã´ÑŠ€‰€†"€1‚ÿ·Application Layer Host Table Uœ† W‡ ? N€.€VˆˆÈ:‚H€ƒã,Ci €‰€†"€2‚ÿ·Host Matrix ^‡ µ‡ ? N€@€VˆˆÈ:‚H€ƒã–î ;€‰€†"€3‚ÿ·Network Layer Matrix b#W‡ ˆ ? N€H€VˆˆÈ:‚H€ƒãcj€‰€†"€4‚ÿ·Application Layer Matrix Nµ‡ eˆ ? N€ €VˆˆÈ:‚H€ƒã+ì:8€‰€†"€5‚ÿ·VLAN Uˆ ºˆ ? N€.€VˆˆÈ:‚H€ƒãÁ *ƒ€‰€†"€6‚ÿ·Address Map v7eˆ 0‰ ? N€p€VˆˆÈ:‚H€ƒãL!ŒÒ€‰€†"€7‚ÿ·Duplicate Network Address View (Expert only)c$ºˆ “‰ ? N€J€VˆˆÈ:‚H€ƒã’Ú½€‰€†"€8‚ÿ·Expert View (Expert only)v70‰ Š ? N€p€VˆˆÈ:‚H€ƒãzáN€‰€†"€9‚ÿ·Application Response Time View (Expert only)*“‰ 3Š ' €€$Šš‚H€‚ÿ2 Š eŠ ' €€œŒ‚€‚ÿSEE ALSOT$3Š ¹Š 0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views V&eŠ ‹ 0 0€L€$Šš‚ã䜺c€‰€‚ÿMore Information on Detail View J¹Š Y‹ 0 0€4€$Šš‚ãNV€‰€‚ÿDetail View toolbar I‹ ¢‹ 0 0€2€$Šš‚ãNV€‰€‚ÿData Views toolbar EY‹ ç‹ 3 6€$€VˆˆÈ:„HãvËÏ€‰€‚ÿCapture ViewP¢‹ 7Œ 1, Œ„胚7Œ Œ ˆÅ More Information on Detail ViewH"ç‹ Œ & €D€&˜š€‚ÿMore Information on Detail View‹f7Œ % €Ì€$Šš€‚ÿThe sections below outline some of the things to be aware of when viewing resources in Detail View.FŒ P ' €>€œŒ‚€‚ÿUSING MONITOR + CAPTURE MODE"ú r ( €õ€$Šš‚€‚ÿIn Detail view for a resource, you can have both Monitor and Capture views of data. The use of these two modes together allows you to monitor traffic at the same time as you look at the contents of previously captured data. However, some of ways you can look at the capture or monitor data are the same. For example, you can view a host table for the monitor data and also view a host table for the contents of the capture buffer. Since the tables are formatted the same, which data are you looking at? ¼|P :Á @ N€ù€$Šš‚€€€€€€€€€‚ÿSurveyor provides some visual distinctions between capture and monitor views.r :Á ç‹ For table information of the capture buffer data, all data in the table is grayed. For monitor data, the column and row titles are gray, but the data in the table is white. The title bar for a monitor view will say “Monitor View” and the title bar for a capture view will say “Capture View.”!är [Å = H€Ë€$Šš‚€†"€:€€€€‚ÿIf you start a resource and then stop it, you can look at the capture buffer contents using the button to bring up Capture View. If you restart the resource (start a different capture operation), you will begin refilling the contents of the capture buffer and incrementing counters for monitor views. However, the previous views that you have of the capture buffer are still open windows within Detail View. In other words, the “view” and decode of previous information is still available, even though the capture buffer itself is refilling with new information. If you do not need this previous view of captured information, it is recommended that you close the Capture View window and all associated capture view windows. You can, of course, save this information to a file. Closing unused windows may avoid confusion when looking at similar monitor and capture views, and help you distinguish between what is happening real-time and what was saved from the previous capture operation.-:Á ˆÅ * $€€ˆˆÈ†H€‚ÿ< [Å ÄÅ 1™Æq›ÄÅ ùÅ K Packet View5ˆÅ ùÅ & €€&˜š€‚ÿCapture ViewŒAÄÅ …È K d€…€$Šš€€ã^”ÞI€‰€‚†"€:ãNV€‰€‚ÿCapture View is the tool for detailed analysis and editing of packets. You can view the data in the capture buffer or view previously captured information that has been saved to a file. You can filter the data before viewing by using a display filter. Capture View contains a Packet Editor for editing packets.Click the button on the Detail View toolbar to access Capture View. Use the green arrow buttons on the Capture View toolbar to move through the listed items. Capture View also opens automatically when you open a capture file (file with .CAP extension).åùÅ –Ê , &€Ë€$Šš€€€‚ÿThe initial Capture View display provides a protocol decode of all packets. Other views of captured information are available from the Capture View toolbar. Although similar to the Monitoring View toolbar buttons, the graphs and charts displayed by using the Capture View Toolbar Buttons display detail information about the packets decoded from the capture buffer only. Table data in these other views is grayed to indicate that it’s a capture view, not a view of real-time data.Ò™…È hÍ 9 @€3€$Šš€‚€€€€€€‚ÿThe initial Capture View window is divided into three parts or "panes." Capture View shows a synopsis of all captured packets, provides a breakdown of the elements of the packet by protocol, and shows the hex and ASCII values for all characters in the packet. The three panes of the window can be sized any way you like. Click and drag the bars separating the panes to resize them. Use the F11 function key to zoom in on any of the three panes. The summary pane, top, is a summary of all packets. You can change the summary pane of the packet window to display the fields you want by selecting Capture View Options à Display from the Configuration menu. ¥}–Ê  ( €û€$Šš€‚‚‚ÿClicking on a packet selects it and displays its detailed protocol breakdown (decode) and its hex values in the remaining two panes of the window.The detail pane, middle, shows the values of the protocol elements associated with each protocol. For example, for the Data Link Control the values for the source address, destination address, and packet length are shown. Single clicking on a value highlights the value in both the detail pane and the hex pane.The hex pane, bottom, shows the hex and ASCII values for all the bytes in the packet. Single clicking on a value highlights the value in both the detail pane and thhÍ  ˆÅ e hex pane.ƒ>hÍ œ E X€}€$Šš€€€€€€€€€€€‚‚ÿA unique color can be used to display packets of each different protocol layer. Set color coding or change color associations using the Protocol Color Coding tab from the Configuration à System Settings menu. This color coding is used in all three panes. You can also enable or disable Expert Analysis views from the Configuration ®Capture View Options menu. You can export packet decode information to another source. You can also print a range of frames in a capture file or in the capture buffer to a text file. Frames can be saved in a variety of formats. É£ e & €G€$Šš€‚ÿIf you have special decoding or display needs for non-standard protocols, see the topics below on assigning protocol parsers and assigning names to protocols. (Note: Support for non-standard protocols has changed from previous releases. The older method is still supported, but it strongly suggested that you convert to the new method. The newer method provides a general solution that supports any TCP or UDP port.)2 œ — ' €€œŒ‚€‚ÿSEE ALSOW$e î 3 6€H€$Šš‚ãþˆb°€‰€€‚ÿCapture View Display Options C— 1 0 0€&€$Šš‚ã^”ÞI€‰€‚ÿPacket EditorJî { 0 0€4€$Šš‚ãNV€‰€‚ÿCapture View toolbarJ1 Å 0 0€4€$Šš‚ãW©Ç€‰€‚ÿCapture View OptionsT${  0 0€H€$Šš‚ãhÖ÷‚€‰€‚ÿSetting Protocol Color Coding d4Å } 0 0€h€$Šš‚ãÊ߈€‰€‚ÿSetting Protocol Summary Information by Layer Q! Î 0 0€B€$Šš‚ãúbú6€‰€‚ÿAssigning Protocol Parsers S#} ! 0 0€F€$Šš‚ã~mF€‰€‚ÿAssigning Names to Protocols *Î K ' €€$Šš‚€‚ÿF! ‘ 1ÿÿÿÿÿÿÿÿœ‘ Î ± Add Packet Templates=K Î & €.€&˜š€‚ÿAdd Packet Templates&ê‘ ô < F€×€VˆˆÈ:‚H€ƒ†"€;€€‚ƒ‚ÿ1.Click on the button and open a capture file. Capture files supplied with Surveyor are in the ..\Surveyor\Examples\Capture directory. You can also use packets within the capture buffer that are displayed in Capture View.2.Find the packet you want to add as a transmit template. You must make this packet the first packet in the capture file or capture buffer. Either delete all packets that come before the packet you want, or filter out all other packets using a display filter.žiÎ ’ 5 8€Ó€VˆˆÈ:‚H€ƒ‚ƒ‚ƒ€€‚ÿ3.Select the first line (first packet) of the capture file.4.If desired, edit this line using the packet editor. The values you enter in this first packet define the new template.5.Save the new capture file (the template). Make sure you give a name you will recognize later. Place it in the ..\Surveyor\Template directory or one of its subdirectories.ßô ± @ N€¿€$Šš‚H€€€€€€€€€‚ÿTemplates display in the Template menu when using the Insert Packet option of the Edit menu. The exact placement of the new template on the menu depends on the directory location within the ..\Template directory.D’ õ 1Uÿÿÿÿÿÿÿÿõ 1 X@ Insert a New Packet<± 1 & €,€&˜š€‚ÿInsert a New Packetãªõ  9 @€U€$Šš€€€€€‚€€‚ÿIn the Capture View window, choose Insert Packet from the Edit menu.Choose blank for a blank packet or choose Template and select a template for the new packet..1 B ' €€œŒ‚€‚ÿTIPSd= ¦ ' €z€$Šš‚€‚ÿUse the packet editor to create the exact packet you want.}VB # ' €¬€$Šš‚€‚ÿIn most instances it is easier to start from a template rather than a blank packet.iB¦ Œ ' €„€$Šš‚€‚ÿAdd your own templates to make inserting a packet even easier.2 # ¾ ' €€œŒ‚€‚ÿSEE ALSOKŒ @ 0 0€6€$Šš‚ã|½zÙ€‰€‚ÿAdd Packet Temp¾ @ ± latesC¾ X@ 0 0€&€$Šš‚ã^”ÞI€‰€‚ÿPacket Editor> @ –@ 1¦ ©°ž–@ Ì@ AN Packet Editor6X@ Ì@ & € €&˜š€‚ÿPacket Editoré–@ éB 4 6€Ó€$Šš€‚€€€€‚‚ÿThe packet editor can be used to modify packet contents. The editor provides two views of packets, a decoded view and a hex view. Edits can be made within either view. The packet editor can be accessed from the summary pane in Capture View or from the Transmit Specification dialog box. To access the editor from Capture View, the Enable Packet Edit box must be checked in the Configuration à Capture View Options menu.The following buttons are available within the packet editor:p7Ì@ YE 9 @€o€tŠ!šã~‚!€ƒ€‚€€ƒ‚ÿAuto CRC Causes the 4-byte CRC error check value to be automatically calculated and written to the frame. With this option selected, creating frames with a bad CRC is not possible. If not selected, bad CRC packets can be generated (note that bad packets can only be sent using GAM or CMM2 modules). This option is not available when using the packet editor from the Transmit Specification dialog box.Compute CRC Inserts the correct CRC error check value for the frame. You can use this option to create frames with or without correct CRC error check values. +êéB „G A P€Õ€tŠ!šã~‚!€ƒ€‚€ƒ€‚€ƒ€‚ÿSet Size Sets the size of the packet. The current size of the packet is displayed for reference. Packet sizes from 8 to 5000 bytes are allowed. . This option is not available when using the packet editor from the Transmit Specification dialog box.Decode Takes the values entered in the hex view window of the packet editor, decodes the packet, and displays the resulting decode in the decode view window.Undo Undo the last editing action. Only one level of undo is supported.~FYE H 8 @€Œ€tŠ!šã~‚!€ƒ€‚€ƒ€‚ÿOK Save edits.Cancel Leave the editor without saving changes.@„G BH ' €2€œŒ‚€‚ÿEDITING IN DECODE VIEWèH XJ . *€Ñ€$Šš‚€€€‚ÿEditing in decode view allows you to edit packets without remembering offsets. Click on a field and a dialog box pops up which shows the current value for the field and asks for a new value. The dialog boxes for each field are slightly different. Most dialog boxes display and allow you enter values in hexadecimal or decimal. Some contain a use little-endian bit order check box if bit order swapping is required. Changes made in decode view are automatically reflected in hex view.=BH •J ' €,€œŒ‚€‚ÿEDITING IN HEX VIEWL$XJ áK ( €I€$Šš‚€‚ÿEdits are made in hex view by placing the cursor at a location and overwriting the current values. You can also paste (Ctrl + V) the contents of the paste buffer into a location. Values are always overwritten starting at the current cursor location in hex view so offsets remain correct. ß•J ôL 4 6€¿€$Šš‚€€€€€‚ÿPress the Decode button to display edits made in hex view in the decode view. Note that changes to the decode view are not automatic. This provides the option of creating error packets that can’t be decoded properly..áK "M ' €€œŒ‚€‚ÿTIPSõÁôL N 4 6€ƒ€$Šš‚€€€€€‚ÿTo insert a new packet before editing, select Insert New Packet from the Edit menu of Capture View. Insert a blank packet or a packet template to begin the process of inserting a packet.*"M AN ' €€$Šš‚€‚ÿLN N 1çÿÿÿÿÿÿÿÿŸN ÑN Ì‚ Add Packets in Capture ViewDAN ÑN & €<€&˜š€‚ÿAdd Packets in Capture View&íN  9 @€Û€$Šš€‚€€€€€€‚ÿYou must have the Packet Blaster plug-in to use templates and the packet editor.If you are inserting a packet into a capture file or capture buffer, you can use a template as the starting point for packet data. To select a template, select the ÑN  AN Insert New Packet à Template… option from the Edit menu. Nested menus appear to select a template. When you select a template, the packet editor comes up with the template values. Use the packet editor to create the exact packet you want. Þ²ÑN á , &€e€$Šš€€€‚ÿTemplates insert the required values for commonly known packet types. For example, if you select the template for IPX, the value 0x8137 is inserted in the Packet Type field.2  ‚ ' €€œŒ‚€‚ÿSEE ALSOKá ^‚ 0 0€6€$Šš‚ã|½zÙ€‰€‚ÿAdd Packet Templates D‚ ¢‚ 0 0€(€$Šš‚ã^”ÞI€‰€‚ÿPacket Editor *^‚ Ì‚ ' €€$Šš‚€‚ÿH¢‚ ƒ 1rÿÿÿÿÿÿÿÿ ƒ Tƒ •† Search the Capture File@Ì‚ Tƒ & €4€&˜š€‚ÿSearch the Capture FilevQƒ ʃ % €¢€$Šš€‚ÿYou can search a capture file displayed in the Capture View for a text string.¶iTƒ €… M h€Ù€VˆˆÈ:‚H€ƒ‚ƒ†"€ ‚ƒ†"€<‚ƒ†"€<‚ÿ1.Open a capture file or view the contents of the capture buffer.2.Select the mode you wish for viewing. Press one of the view buttons on the Capture View toolbar.3.Type a string in the field to the left of the button.4.Press the button to find the next instance of the string. The line containing the next instance of the string is highlighted.-ʃ ­… ' € €œŒ‚€‚ÿTIP¾–€… k† ( €-€$Šš‚€‚ÿNote that the view mode you select will effect the search. For instance, you won't find the string MAC when searching in Network Conversation View.*­… •† ' €€$Šš‚€‚ÿGk† ܆ 1Ôÿÿÿÿÿÿÿÿ¡Ü† ‡ ¾ˆ Printing Capture Views?•† ‡ & €2€&˜š€‚ÿPrinting Capture ViewsgB܆ ‚‡ % €„€$Šš€‚ÿYou can print the table or graph information for capture views.<‡ ¾ˆ 8 >€ €VˆˆÈ:‚H€ƒ‚ƒ‚ƒ†"€=‚ÿ1.Bring up the view that you want to print by pressing one of the view buttons in the Capture View toolbar.2.If the view supports both table and chart, make sure the view you want to print is displayed.3.Press the button from the Detail View toolbar.U$‚‡ ‰ 1 ÿÿÿÿÿÿÿÿ¢‰ `‰ G Setting Capture View Display OptionsM'¾ˆ `‰ & €N€&˜š€‚ÿSetting Capture View Display Options[5‰ »Š & €k€$Šš€‚ÿWhen using Capture View, you can control the display of summary data for packet decoding. You can view the time as absolute, as a delta, as elapsed, or any combination of the three. You can show/hide the size and status of packets. You can also show/hide the details of the protocol values for the packets.ªL`‰ e ^ Š€›€VˆˆÈ:‚H€ƒ†"€:‚ƒ€€€€€€€€‚ƒ‚ƒ€€€€‚ÿ1.Open the Capture View window by pressing the button or by opening a capture file.2.From the Configuration menu, select Capture View Options à Display; or, press F2.3.Click on the boxes for the options you want. Specific display fields include Absolute Time, Delta Time, Elapsed Time, Frame Size, Status, Network Address, and Byte Count/Throughput.4.Check the Display Detail Protocol Summary box to view detail about all the protocols used in the packet. Leaving the Display Detail Protocol Summary box unselected gives a synopsis of all protocols in the packet. Ϥ»Š 4Ž + $€I€VˆˆÈ:‚H€ƒ‚ÿ4.Set the protocols you want to display from the pull-down menu. For example, if you want to display only the Transport layer and below, select Transport Layer.0øe d 8 >€ñ€VˆˆÈ:„H€ƒ€€€€‚ÿ5.Select the Display Expert Symptoms check box if you wish to include expert symptom information in the Summary field. Packets that trigger an expert symptom and have expert symptom information will display in reverse video in Capture View.Ív4Ž =Á W |€í€VˆˆÈ:‚H€ƒ€€€€€€€€€€€€‚ƒ€€‚ÿ6.Set “time-zero” for capture in the Elapsed Time Set Mark Optd =Á ¾ˆ ion portion of the Display Options dialog box. The default option is Module Arm Time, which starts time zero at the time the module is started. Select Frame ID nnn’s Arrival Time and set the frame ID number in the box to start time zero when a particular frame arrives. 7.Click the OK button.*d gÁ ' €€$Šš‚H€‚ÿ2 =Á ™Á ' €€œŒ‚€‚ÿSEE ALSO[+gÁ ôÁ 0 0€V€$Šš‚ãÊ߈€‰€‚ÿSetting Protocol Summary Information S#™Á G 0 0€F€$Šš‚ãþˆb°€‰€‚ÿCapture View Display Options ?ôÁ †Â 1šÿÿÿÿÿÿÿÿ£†Â ½Â &Æ Set Delta Time7G ½Â & €"€&˜š€‚ÿSet Delta Timep%†Â -Ä K d€K€VˆˆÈ:‚H€ƒ‚ƒ€€€€‚ƒ‚ƒ€€‚ƒ€€‚ÿ1.Select a packet in the Capture View window.2.Choose Set Delta Time from the Edit menu. The Set Delta Time dialog box appears.3.Click the radio button for the unit of measurement you want for the time.4.Set the new delta time in the Delta Time field.5.Click the OK button.ݽ 2Å ( €»€$Šš‚H€‚ÿThe delta time is set between the selected packet and the previous packet in the sequence. For example, changing the delta time for Packet ID -00004 effects the delta time between Packet ID -00005 and Packet ID -00004..-Ä `Å ' €€œŒ‚€‚ÿTIPSœu2Å üÅ ' €ê€$Šš‚€‚ÿThe absolute and elapsed time are also changed for all subsequent packets when a change is made to the delta time.*`Å &Æ ' €€$Šš‚€‚ÿ@üÅ fÆ 1Úÿÿÿÿÿÿÿÿ¤fÆ žÆ GË Select the View8&Æ žÆ & €$€&˜š€‚ÿSelect the View?fÆ ÝÆ * $€*€œŒ‚€€‚ÿFROM SUMMARY VIEW©žÆ †Ç ( €€$Šš‚€‚ÿOne monitoring view is available in Summary View. The first tab in the Summary View for a resource displays the view selected.ÇÝÆ ŽÈ A P€€VˆˆÈ:‚H€ƒ€€€€‚ƒ‚ƒ€€‚ÿ1.From the Configuration menu, choose Module, Monitor View Preferences.2.Click the radio button in the Display tab for the view you want. Only one view is allowed.3.Click the OK button.>†Ç ÌÈ * $€(€œŒ‚€€‚ÿFROM DETAIL VIEWïŽÈ éÉ . *€ß€VˆˆÈ:‚H€ƒ‚ƒ‚‚ÿ1.Make sure you are in the Detail View window for the resource you want.2.Press one of view buttons on the Data Views toolbar.If you already have the desired view window open, click the window to make it the currently selected view.?ÌÈ (Ê * $€*€œŒ‚€€‚ÿFROM CAPTURE VIEWõ¶éÉ Ë ? L€q€VˆˆÈ:‚H€ƒ†"€:†"€;‚ƒ‚ÿ1.Click the button on the Detail View toolbar or click the button on the Module toolbar and open a capture file.2.Press one of the view buttons on the Capture View toolbar.*(Ê GË ' €€$Šš‚H€‚ÿCË ŠË 1Oÿÿÿÿÿÿÿÿ¥ŠË ÅË Æ View Captured Data;GË ÅË & €*€&˜š€‚ÿView Captured Data\6ŠË !Í & €m€$Šš€‚ÿYou can view the contents of the capture buffer or data that has previously been stored on disk as a capture file. You open capture files from Summary View; you open capture buffer contents from Detail View. In either case, Capture View appears so you can see complete protocol decodes of the captured data.L%ÅË mÍ ' €J€œŒ‚€‚ÿTO VIEW DATA IN THE CAPTURE BUFFERi1!Í ÖÎ 8 >€e€VˆˆÈ:‚H€ƒ‚ƒ†"€:‚ƒ‚ÿ1.You must have data in the capture buffer to view and the capture process must be stopped.2.From the Detail View toolbar, click the button.3.Data is always viewed in Capture View initially. To open other views of captured data, use the view buttons on the far right of the Capture View toolbar.H!mÍ Ï ' €B€œŒ‚€‚ÿTO VIEW DATA IN A CAPTURE FILE¤}ÖÎ ÂÏ ' €ú€$Šš‚€‚ÿA file is considered a resource, just like a device. A separate Detail View window will appear for any file that you open.—WÏ e @ N€±€VˆˆÈ:‚H€ƒ†"€;‚ƒ‚ƒ€€‚ƒÂÏ e GË ‚ÿ1.From the Summary View or Capture View toolbar, click the button.2.From the dialog box, select the name of a capture file to view. Capture files have an extension of .CAP.3.Click the Open button.4.Data is always viewed in Capture View initially. To open other views, use the buttons on the far right on the Capture View toolbar.>ÂÏ £ ' €.€œŒ‚€‚ÿTO REFRESH THE VIEW #îe Æ 5 8€Ý€&˜š‚€€€€€‚ÿIf you have changed the display filter, you can update the Capture View display by choosing Refresh... from the File menu. Data in the capture file or capture buffer is "re-filtered" using the contents of the Display Filter window.G£  1-ÿÿÿÿÿÿÿÿ¦  L H Print Frames to a File?Æ L & €2€&˜š€‚ÿPrint Frames to a FileB  Ž ' €7€&˜š€‚ÿYou can print a range of frames in a capture file or in the capture buffer to a file. Frames can be saved in a variety of formats. You are printing frames to a file from the capture buffer, you must stop Capture mode; if you are in Monitor mode only, this option is not available.^L ì A P€;€VˆˆÈ:‚H€ƒ€€€€‚ƒ€€‚ƒ‚ÿ1.Choose Print to File… from the File menu.2.Set the range of frames to print by entering start and stop frame numbers or select All to save all frames. Frames are numbered within the capture file or capture buffer.3.Select the radio button for the print format you want.¶uŽ ¢ A P€ë€VˆˆWõ~‚W€€ƒ‚€€ƒ‚€€ƒ‚ÿDetail Prints complete details for each frame, including the Detail Pane and Hex Pane breakdown.Summary Prints only the Summary Pane for the range of frames. All details of the protocols used are included in the Summary field.Short Summary Prints only the Summary Pane for the range of frames. Summaries of the protocols used are included in the Summary field. Æì ­ E X€€VˆˆÈ:‚H€ƒ€€‚ƒ€€€€€€‚ÿ4.Click the OK button.5.The Save As dialog box appears. Provide the name of the print file and click the OK button. Files are in text format, so files should be given a .txt extension.-¢ Ú ' € €œŒ‚€‚ÿTIPÛ ­ µ ; D€A€&˜š‚€€€€€€€‚ÿThe .txt file can be printed. Use this option to print a range of frames. If you want to print a single frame, use the Print option from the File menu.i6Ú  3 6€n€VˆˆÈ:‚H€ƒ†"€=‚ÿ3.Press the button from the Detail View toolbar.*µ H ' €€$Šš‚H€‚ÿM • 1í胄9§• Ú ¡J Capture View Display OptionsEH Ú & €>€&˜š€‚ÿCapture View Display OptionsÛ• Ü ' €·€$Šš€‚‚ÿWhen using Capture View, you can control the display of data for packet decoding. You can view the time as absolute, as a delta, as elapsed, or any combination of the three. You can show/hide most fields in the decode display. You can also show/hide protocol information about packets and set the starting point for elapsed time Use the top part of the dialog box to select the columns you want to display in Capture View. Not all columns can display on the screen without having to scroll; limiting the number of columns can make it easier to see the exact information you want. Specific display fields include Absolute Time, Delta Time, Elapsed Time, Frame Size, Status, Network Address, Cumulative Byte Count and Throughput.!ãÚ @ > J€Ç€$Šš€€‚€€‚€€‚€€‚ÿAbs Time - The absolute time of arrival for each packet taken from the system clock when the capture was performed.Delta Time - The time between each packet (interpacket gap).Elapsed Time - The time stamp of each packet measured from a relative starting point. The starting point may be either the module arm time or the arrival time of a specific packet. See below for information on setting the elapsed time starting point.Size - The frame size of the packet in bytes.Ü @ H JÜ VB 7 <€'€$Šš€€‚€€‚€€‚ÿStatus - The Status field indicates if the frame has errors. For good frames, the Status field is blank.Display Network Address - The destination and source IP address.Cumulative Byte/Throughput - The Cumulative Byte Count is a sum of all bytes received to this point in time in a capture file. The Throughput is calculated by dividing the cumulative bytes by the elapsed time. The elapsed time is the difference is always measured between the module arm time and the time stamp of the current packet in the capture file.šV @ ðE D V€­€$Šš€€€€€€€€€€€‚ÿUse the middle portion of the dialog box to set up the display of the Summary column. The Summary column will always display. However, this field can just give a very limited synopsis of protocol activity or provide complete details about the protocols used in the packet. Check the Display Detail Protocol Summary box to view detail about all the protocols used in the packet. Leaving the Display Detail Protocol Summary box unselected gives a synopsis of all protocols in the packet. If you want to display protocol summary details, set the protocols you want to display from the pull-down menu. For example, if you want to display only the Transport layer and below, select Transport Layer. If you are not displaying protocol summary details, the protocol layer you select in the pull-down menu will not affect the display of the Summary.§PVB —I W |€¡€$Šš€€€€€‚€€€€€€€€€€€€‚ÿSelect the Display Expert Symptoms check box if you wish to include expert symptom information in the Summary field. Packets that trigger an expert symptom and have expert symptom information will display in reverse video in Capture View.Use the bottom portion of the dialog box to set the point from which Surveyor will measure time when calculating and displaying the elapsed time stamp of each packet. Set “time-zero” for capture in the Elapsed Time Set Mark Option portion of the Display Options dialog box. The default option is Module Arm Time, which starts time zero at the time the module is started. Select Frame ID nnn’s Arrival Time and set the frame ID number in the box to start time zero when a particular frame arrives. Setting this field only effects the display of the Elapsed Time field in the protocol decode.(ðE ¿I % €€$Šš€‚ÿ2 —I ñI ' €€œŒ‚€‚ÿSEE ALSO[+¿I LJ 0 0€V€$Šš‚ãW©Ç€‰€‚ÿSetting Capture View Display Options *ñI vJ ' €€$Šš‚€‚ÿ+LJ ¡J ( €€&˜š‚€‚ÿ@vJ áJ 1ÏÿÿÿÿVŒ¨áJ K ¸N About Resources9¡J K ' €$€ ˆ‚€‚ÿAbout ResourcespGáJ ŠM ) €€ˆˆ‚€‚‚ÿSurveyor can gather statistical information and view network data from a variety of hardware sources. The information you receive from a resource depends on the hardware.Surveyor provides a single window, called the resource browser, through which you can access all local and remote resources. The resource browser works much the same as Microsoft Windows explorer, allowing you to see hosts and their associated resources in a hierarchical relationship. "Branches" can be expanded or collapsed via point and click, so you can quickly customize your view of available resources..K ¸N ) € €ˆˆ‚€‚‚ÿSurveyor automatically scans the network for available resources, or you can enter the IP address of any host you can reach through a TCP/IP connection. Surveyor remembers the name of the most recent connection made so you can quickly reconnect to the host.AŠM ùN 1Ëøˆq©ùN 7O Û„ Resource Browser>¸N 7O * $€(€ ˆ‚€€ ‚ÿResource BrowserþÕùN Aƒ ) €«€ˆˆ‚€‚‚ÿThe resource browser is a single window through which you can access all local and remote resources available in the network. The resource browser works much t7O Aƒ ¸N he same as Microsoft Windows Explorer, allowing you to see hosts and their associated resources in a hierarchical relationship. Remote systems containing resources are listed by IP address unless there is a Surveyor name table on the system. If an entry exists in the name table for the IP address of the resource, the symbolic name in the name table is used to represent the resource. Resources within remote systems are listed by module type and module number. The module number is assigned by the software from the base address of the module, which is set by jumpers during hardware installation. For NDIS modules, the modules are numbered by the order in which they are discovered within the local or remote host. It is possible to have two different modules with the same name if they are within different hosts. šq7O Û„ ) €ã€ˆˆ‚€‚‚ÿThe resource browser opens as a docking window when Surveyor is started and can be moved to its own window.Double-click on a resource to display a default view of the resource in Summary View. If a remote resource is protected, you are asked for a user name and password. Drag and drop resources onto alarms in the Alarm Browser to activate an alarm for a resource.KAƒ &… 1lVŒJª&… n… ©Š Remote vs. Local ResourcesHÛ„ n… * $€<€ ˆ‚€€ ‚ÿRemote vs. Local Resourcesî&… „‡ ( €Ý€ˆˆ‚€‚ÿLocal resources are those within the local PC running Surveyor. Remote resources are all other resources that can be reached through a TCP/IP connection. When running Surveyor from the PC, you have complete access and privileges to any resource in the PC. You can access remote resources and establish accounts for your local resources if you have the Remote plug-in software available from Shomiti. Both the local and the remote resource must have the plug-in for remote access to function.ñÈn… uŠ ) €‘€ˆˆ‚€‚‚ÿAccess to remote resources are controlled from the PC which contains the resource. For example, if your PC contains two CMM2 cards, accounts, privileges, and passwords for the CMM2 cards are established at your PC. Remote users must have access to a valid account to use the CMM2 in your PC.The remote resource can be located in any host which can be accessed via a TCP/IP connection. You'll need to know the IP address of the remote host to log in to the remote resource. If the remote resource can be auto-discovered by Surveyor, the IP address or the name associated with the IP address of the host will display in the resource browser. Typically, resources on the same LAN segment can be auto-discovered.4„‡ ©Š 0 0€ €ˆˆ‚€†"€>‚ÿDuŠ íŠ 1"qòƒ«íŠ .‹ JÁ Resource ProtectionA©Š .‹ * $€.€ ˆ‚€€ ‚ÿResource Protectiona2íŠ / ,€e€ˆˆ‚€€€‚‚ÿYou are in control of local resources within a PC. Use the functions on the Host menu to add and delete users for a resource, change passwords and protections, or view the users currently logged in. There is a guest account for users with no account. The guest user can be given all privileges to effectively disable resource protection.Note that there is no password protection for starting Surveyor on the local system. If you can start Surveyor from a system, you automatically have complete access to all local resources (called super-user privileges).ç¾.‹ vŽ ) €}€ˆˆ‚€‚‚ÿTo access a remote resource, you must have an account and password set up on the remote system containing the resource or use the guest account.Privileges for remote users can be set to:žT Á J b€©€VˆˆE¿~„E€€ƒ‚€€ƒ‚€€ƒ‚€€ƒ‚ÿMonitor Only Allows a remote user to use the local device to monitor network activity only.Capture/Monitor Allows a remote user to use the local device to monitor activity or capture network data.Full Allows a remote user to use the local device to monitor activity, capture network data, or transmit network vŽ Á ©Š data.Super User Allows a remote user the ability to transmit, capture, or monitor, plus set up, delete, and change accounts for the local PC. Be careful when granting super-user privileges to remote users. This gives remote users complete control of your local resource.*vŽ JÁ ' €€ˆˆ‚€‚ÿP Á šÁ 1C:q¬šÁ ãÁ  Surveyor Implementation ProfileI"JÁ ãÁ ' €D€ ˆ‚€‚ÿSurveyor Implementation Profile@ šÁ #Ä 5 8€€ˆˆ‚€‚€€€€‚ÿTwo types of buffers are essential to the execution of Surveyor's features:Real-Time Buffer - A real-time buffer provides the transient data storage area for on-the-fly frame analysis which, in conjunction with MAC statistics and error counters, produces real-time LAN analysis and monitoring information. Data captured from the network is copied to this area after filtering. The data is immediately available for evaluation, and optionally for streaming copy to disk, after which it is discarded from the buffer.t5ãÁ —Æ ? L€m€ˆˆ‚€†"€?‚€€€€‚‚ÿCapture/Transmit Buffer - A separate capture buffer provides a durable data store of LAN traffic filtered and captured in real-time, which is kept for later analysis or to be saved to disk. The same buffer is used as storage for packets to be transmitted when performing LAN component testing.Surveyor supports GAM, CMM2, and NDIS (10/100 Ethernet or Token Ring) LAN interfaces. Buffering is implemented with these interfaces as follows. Cumulative system resource demands can limit performance of any features which require system resources, as noted._#Ä 'É 1 0€¿€Vˆˆµ€O„´€!€ƒ‚ÿNDIS Both buffers are implemented in software, thus requiring system resources. To the extent that a system can keep up with traffic captured by an NDIS card, all LAN traffic will be copied to Surveyor and filtered, sliced if necessary, then routed to the capture buffer, real-time buffer, or both if desired. System resource demands increase with the complexity of analysis and monitoring configured, and very much by the number of NDIS interfaces Surveyor is controlling. All Surveyor real-time functions will be available, excluding any MAC error counters which are not implemented on the card. I—Æ pË 7 <€%€Vˆˆµ€O„´€!€ƒ€€!‚ÿGAMThis is a high speed network analyzer card with on-board capture/ transmit buffer and filtering for fiber-optic networks. This, along with other hardware features, guarantees full line-speed capture and transmit for Gigabit Ethernets. Due to this on-board implementation, there is no demand for system resources, regardless of the number of cards being controlled. However, because GAM does not include a real-time buffer, the real-time functionality it provides is limited to network statistics and MAC error counters. q@'É áÍ 1 0€€Vˆˆµ€O„´€!€ƒ‚ÿCMM2Version 2 of Century Media Module adds an on-board real-time buffer and data slicing to provide full real-time functionality. Simultaneous data copies to the capture and real-time buffers are an option. Real-time functions introduce some system resource dependency: the need to copy periodic real-time monitor, analysis, and/or protocol decode updates to Surveyor, and optionally to copy the real-time buffer to disk. Using real-time functions on multiple cards will increase resource demands, but much less than NDIS. All Surveyor features are supported on CMM2.êpË 1 0€Õ€Vˆˆµ€O„´€!€ƒ‚ÿVoyager Voyager is a multi-port RMON probe that gathers statistics. Data for all probe ports in the Voyager (version 1.1 and higher) device can be seen from Surveyor. Voyager can gather monitoring statistics at line rate and stores them in its local hardware. For Voyager, Surveyor merely looks at the statistics passed from the probe; there is no use of a real-time or a capture buffer. Only those Surveyor real-time functions that can make use of the RMON statistics are available. áÍ JÁ /áÍ ; , (€€Vˆˆµ€O„´€‚ÿ4 o 0 0€ €ˆˆ‚€†"€@‚ÿ2 ; ¡ ' €€œŒ‚€‚ÿSEE ALSOd'o  = J€N€ˆˆ‚ãø€‰€‚ãN-Wþ€‰€‚ÿModes Hardware Dependencies F¡ K 1®òƒ€­K Š ðM Hardware Dependencies? Š ' €0€ ˆ‚€‚ÿHardware Dependencies„]K  ' €º€ˆˆ‚€‚ÿThe following table lists functions supported by Surveyor that have hardware dependencies:©(Š · #Ò€PÑ —     €€˜„ÿ€€ ˜„‚l€‚ÿ€.€ ˜„‚l‚ÿ€:€ ˜„‚l‚ÿ€F€ ˜„‚l‚ÿÿÿReal-Time FunctionsNDISCMM2GAM½* t “#ö€TÑ —     €€ ˜„‚lÿ€€„„‚l€‚ÿ€2€„„‚lÿ€4€ „„‚l‚ÿ€>€ „„‚l‚ÿ€J€ „„‚l‚ÿÿÿReal-Time Buffer Size64K512KN/Añ\· e •#ú€¸Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€€„„‚lÿ€ € „„‚l‚ÿ€f€ „„‚l‚ÿ€®€ „„‚l‚ÿÿÿPerformance10Mbps: 1-3Mbps 100Mbps: 1-5Mbps10Mbps: 5-10Mbps100Mbps: 5-20MbpsN/Aó`t X “#ö€ÀÑ —     €€ „„‚lÿ€€ˆ„‚l€‚ÿ€,€ˆ„‚lÿ€.€ ˆ„‚l‚ÿ€V€ ˆ„‚l‚ÿ€`€ ˆ„‚l‚ÿÿÿNetwork StatisticsAll but error rateAllUtilization, error/sec, bytes/sec, packets/sec¼)e  “#ö€RÑ —     €€ ˆ„‚lÿ€€„„‚l€‚ÿ€2€„„‚lÿ€4€ „„‚l‚ÿ€>€ „„‚l‚ÿ€H€ „„‚l‚ÿÿÿPacket Decode SummaryYesYesN/A}X $ “#ö€úÑ —     €€ „„‚lÿ€€ˆ„‚l€‚ÿ€(€ˆ„‚lÿ€*€ ˆ„‚l‚ÿ€v€ ˆ„‚l‚ÿ€€€ ˆ„‚l‚ÿÿÿAlarm ThresholdsAll except errors not passed by NDISAllUtilization, errors, packets, bytes, and MAC error counters½* á “#ö€TÑ —     €€ ˆ„‚lÿ€€„„‚l€‚ÿ€6€„„‚lÿ€8€ „„‚l‚ÿ€@€ „„‚l‚ÿ€J€ „„‚l‚ÿÿÿSync View, Full-DuplexNoYesYesµ"$ – “#ö€DÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€$€„„‚lÿ€&€ „„‚l‚ÿ€0€ „„‚l‚ÿ€:€ „„‚l‚ÿÿÿPacket SlicingYesYesN/A­á C “#ö€4Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€€„„‚lÿ€€ „„‚l‚ÿ€ € „„‚l‚ÿ€*€ „„‚l‚ÿÿÿFilterYesYesN/A©&– ì ƒ#Ö€LÑ —     €€ „„‚lÿ€€ ˜„‚l€‚ÿ€*€ ˜„‚l‚ÿ€6€ ˜„‚l‚ÿ€B€ ˜„‚l‚ÿÿÿCapture FunctionsNDISCMM2GAMÊ7C ¶ “#ö€nÑ —     €€ ˜„‚lÿ€€„„‚l€‚ÿ€.€„„‚lÿ€0€ „„‚l‚ÿ€D€ „„‚l‚ÿ€`€ „„‚l‚ÿÿÿCapture Buffer Size64K-16M*16MB or 32MB128MBHuì þ Ó#vêÑ —     €€ „„‚lÿ€€˜„‚l€‚ÿ€€˜„‚lÿ€ € „„‚l‚ÿ€h€ „„‚lÿ€j€ „‚l‚ÿ€€ „„‚l‚ÿ€¬€ „„‚lÿ€®€ „‚l‚ÿ€Ô€ „„‚l‚ÿÿÿPerformance10Mbps: 5-10Mbps 100Mbps: 5-15MbpsFull Line Rate at10 /100 MbpsFull Line Rate at1000 Mbpsµ"¶ ³ “#ö€DÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€$€„„‚lÿ€&€ „„‚l‚ÿ€0€ „„‚l‚ÿ€:€ „„‚l‚ÿÿÿ7-Layer DecodeYesYesYes¼)þ o “#ö€RÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€4€„„‚lÿ€6€ „„‚l‚ÿ€>€ „„‚l‚ÿ€H€ „„‚l‚ÿÿÿSync View, Full-DuplexNoYesYes­³  “#ö€4Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€€„„‚lÿ€€ „„‚l‚ÿ€ € „„‚l‚ÿ€*€ „„‚l‚ÿÿÿFilterYesYesYes¹&o Õ “#ö€LÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€.€„„‚lÿ€0€ „„‚l‚ÿ€8€ „„‚l‚ÿ€B€ „„‚l‚ÿÿÿError Frame CaptureNoYesYes¹& Ž “#ö€LÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€,€„„‚lÿ€.€ „„‚l‚ÿ€8€ „„‚l‚ÿ€B€ „„‚l‚ÿÿÿPost Capture ViewsYesYesYesÉ6Õ c@ “#ö€lÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€.€„„‚lÿ€0€ „„‚l‚ÿŽ c@  €X€ „„‚l‚ÿ€b€ „„‚l‚ÿÿÿFrame Error Counterdepends on adapterYesYesµ"Ž A “#ö€DÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€$€„„‚lÿ€&€ „„‚l‚ÿ€0€ „„‚l‚ÿ€:€ „„‚l‚ÿÿÿPacket SlicingYesYesYesª'c@ ÂA ƒ#Ö€NÑ —     €€ „„‚lÿ€€ ˜„‚l€‚ÿ€,€ ˜„‚l‚ÿ€8€ ˜„‚l‚ÿ€D€ ˜„‚l‚ÿÿÿTransmit FunctionsNDISCMM2GAMÄ1A †B “#ö€bÑ —     €€ ˜„‚lÿ€€„„‚l€‚ÿ€&€„„‚lÿ€(€ „„‚l‚ÿ€<€ „„‚l‚ÿ€T€ „„‚l‚ÿÿÿTransmit Buffer64K-16M*16MB, 32MB128MBErÂA ËC Ó#väÑ —     €€ „„‚lÿ€€˜„‚l€‚ÿ€€˜„‚lÿ€ € „„‚l‚ÿ€h€ „„‚lÿ€j€ „‚l‚ÿ€Š€ „„‚l‚ÿ€¬€ „„‚lÿ€®€ „‚l‚ÿ€Î€ „„‚l‚ÿÿÿPerformance10Mbps: 5-10Mbps 100Mbps: 5-15MbpsFull Line Rate10 and 100 MbpsFull Line Rate1000 Mbps½*†B ˆD “#ö€TÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€4€„„‚lÿ€6€ „„‚l‚ÿ€@€ „„‚l‚ÿ€J€ „„‚l‚ÿÿÿIntelligent Frame EditYesYesYesìXËC tE ”#ø€°Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€.€„„‚lÿ€0€ „„‚l‚ÿ€f€ „„‚l‚ÿ€Š€ „„‚l‚ÿÿÿTransmit Frame Size64-1518,valid sizes only8 - 15,000 Bytes16 - 15,000 BytesÖCˆD JF “#ö€†Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€f€„„‚lÿ€h€ ˜„‚l‚ÿ€r€ ˜„‚l‚ÿ€|€ ˜„‚l‚ÿÿÿTransmit Captured Files & User-Generated FramesYesYesYes»(tE G “#ö€PÑ —     €€ ˜„‚lÿ€€„„‚l€‚ÿ€2€„„‚lÿ€4€ „„‚l‚ÿ€<€ „„‚l‚ÿ€F€ „„‚l‚ÿÿÿTransmit Error FramesNoYesYesÇ4JF ÌG “#ö€hÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€J€„„‚lÿ€L€ ˜„‚l‚ÿ€T€ ˜„‚l‚ÿ€^€ ˜„‚l‚ÿÿÿSimultaneous Transmit and ReceiveNoYesYes“ G _H s#¶€@Ñ —     €€ ˜„‚l€‚ÿ€€ ˜„‚l‚ÿ€*€ ˜„‚l‚ÿ€6€ ˜„‚l‚ÿÿÿConnectivityNDISCMM2GAM¸%ÌG I “#ö€JÑ —     €€ ˜„‚lÿ€€„„‚l€‚ÿ€2€„„‚lÿ€4€ „„‚l‚ÿ€:€ „„‚l‚ÿ€B€ „„‚l‚ÿÿÿMax Interfaces/System41515†_H 5J ˜#þ€ Ñ —     €€ „„‚lÿ€€„„‚l€‚ÿ€€„„‚lÿ€€ „„‚l‚ÿ€@€ „„‚l‚‚ÿ€€ „„‚l‚ÿÿÿMedia10/100 Enet, 4/16 TR10/100 EthernetRJ45 or MII for FiberGigabit EthernetSwappable G-BIC, Multi-mode or Single modeÏ+I K ¤#VÑ —     €€ „„‚lÿ€€˜„‚l€‚ÿ€2€˜„‚lÿ€4€„„‚lƒ‚ÿ€B€„„‚lÿ€D€ „„‚l‚ÿ€L€ „„‚l‚ÿÿÿOn-Board Transceivers NoNoYesÏ<5J ÓK “#ö€xÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€€„„‚lÿ€ € „„‚l‚ÿ€0€ „„‚l‚ÿ€T€ „„‚l‚ÿÿÿPortabilityLaptopShomiti ExplorerShomiti Explorer¸%K ‹L “#ö€JÑ —     €€ „„‚lÿ€€„„‚l€‚ÿ€*€„„‚lÿ€,€ „„‚l‚ÿ€6€ „„‚l‚ÿ€@€ „„‚l‚ÿÿÿRemote ManagementYesYesYeswNÓK M ) "€œ€ˆˆ‚€‚‚‚ÿ* Limited by available PC system memory. Smaller when running Windows NT.2 ‹L 4M ' €€œŒ‚€‚ÿSEE ALSO< M pM 0 0€€ˆˆ‚ãø€‰€‚ÿModes V&4M ÆM 0 0€L€„„‚ã‚ÔŒò€‰€‚ÿSurveyor Implementation Profile *pM ðM ' €€ˆˆ‚€‚ÿ6ÆM &N 1^J:®&N UN ªÃ Modes/ðM UN ' €€ ˆ‚€‚ÿModes®†&N O ( € €„„‚€‚ÿModes are applied to resources. Each resource can be in a different mode. There are four modes available with Surveyor, as follows:_ UN n R r€€Vˆˆi›~„i€€ƒ‚€€ƒ‚€€ƒ‚€€ƒ‚€€ƒ‚ÿMonitor Provides real-time views and decodes of packets received by a device.Capture Allows packets received by a device to be stored in a buffer for analysis.CapO n ðM ture + Monitor Provides both real-time monitoring views and the ability to store packets for later analysis.TransmitAllows the transmission of packets from a device. You must have the Packet Blaster plug-in from Shomiti to use Transmit mode.Capture + Transmit Allows simultaneous capture and transmit from the same module (CMM2 modules only).ÛO rƒ ) €·€„„‚€‚‚ÿBoth the monitor and capture functions look at the same bit stream being received by a device. The difference between these modes is how the bit stream is stored and viewed. Because each class of device has different capabilities for storing and viewing the bit stream, you must understand the capabilities of the device you are using to completely understand what is possible in each mode. If you have the Packet Blaster plug-in, you can use any device in transmit mode.á§n S† : B€O€Vˆˆ!ã~„!€€ƒ‚€€ƒ‚ÿCMM2 The current version of the Century Media Module fully supports all modes and all counters in Surveyor and supports the all monitor and capture functions at full line rate. The default mode for CMM2 is Capture + Monitor. In Capture + Transmit mode the buffer is split in two, half used for capture and half used for transmit.GAM GAMs support MAC counters in Surveyor and supports all capture functions at full line rate. Special views are supported for viewing the capture buffer when the device is stopped. The default mode for GAMs is Capture + Monitor. In Capture + Transmit mode the buffer is split in two, half is used for capture and half is used for transmit.–drƒ éˆ 2 2€É€Vˆˆ!ã~„!€€ƒ‚ÿNDIS NDIS adapters can be used to capture, transmit, or monitor, but have severe performance constraints. The effective rates at which an NDIS module can capture and monitor is limited because these functions are performed in software rather than hardware. An NDIS adapter is often used in Monitor only mode to improve performance, since NDIS adapters cannot capture at full line rate. When using an NDIS adapter, check the Information tab to see information about what counters are supported. Each manufacturer supports a different set of counters. The default mode for NDIS adapters is Capture + Monitor. a/S† J‹ 2 2€_€Vˆˆ!ã~„!€€ƒ‚ÿExplorer 10/100The Explorer 10/100 is a protocol analysis tool that contains its own processor and two CMM2 modules. The Explorer 10/100 fully supports all modes and all counters in Surveyor. The CMM2 modules are synchronized so you can analyze a full-duplex network segment from a single view. When viewing an Explorer resource in the Resource Browser, you will see three "devices": one for the first CMM2 card, one for the second CMM2 card, and one for the two cards synchronized as a set. The default mode for modules in Explorer is Capture + Monitor.a/éˆ « 2 2€_€Vˆˆ!ã~„!€€ƒ‚ÿExplorer Gigabit The Explorer Gigabit is a protocol analysis tool that contains its own processor and two GAM modules. The Explorer Gigabit fully supports all modes and all counters in Surveyor. The GAM modules are synchronized so you can analyze a full-duplex network segment from a single view. When viewing an Explorer resource in the Resource Browser, you will see three "devices": one for the first GAM card, one for the second GAM card, and one for the two cards synchronized as a set. The default mode for modules in Explorer is Capture + Monitor.KJ‹ Á 4 6€/€Vˆˆ!ã~„!€€ƒ‚ƒ‚ÿVoyager The Voyager is a multi-port RMON/RMON2 probe. Surveyor can display the RMON statistics collected by Voyager (version 1.1 and higher). Icons appear under the Voyager resource in the Resource Browser to select the port or port-pair to monitor. Monitor port-pairs when connected to full-duplex links. Monitor statistics display as for any other resource. The only mode for Voyager is Monitor.Note: Voyager can mirror data from its probe ports to Explorer. You can control the Voyager ports that are mirrored from Surveyor through the E« Á ðM xplorer device. A special Multi Port Tap icon appears under the Explorer resource in the Resource Browser to control which ports of Voyager are mirrored to Explorer. See the chapter "Customizing Surveyor" for more information on port selection.3« 5 2 2€€Vˆˆ!ã~„!€€ƒ‚ÿ12-Tap Taps are fault-tolerant wiring devices that provide connections for Explorers or Century Media Modules . The tap shows as a "resource" to the Surveyor software, but is only used to select a LAN segment for monitoring and LAN analysis functions. *Á _ ' €€„„‚€‚ÿ2 5 ‘ ' €€œŒ‚€‚ÿSEE ALSOL_ Ý 0 0€8€ˆˆ‚ãN-Wþ€‰€‚ÿHardware Dependencies V&‘ 3à 0 0€L€„„‚ã‚ÔŒò€‰€‚ÿSurveyor Implementation Profile MÝ €Ã 0 0€:€ˆˆ‚ãT¡‚€‰€‚ÿSynchronized Resources *3à ªÃ ' €€„„‚€‚ÿG€Ã ñà 1Ø€«‡¯ñà 5Ä ÜÊ Synchronized ResourcesDªÃ 5Ä * $€4€ ˆ‚€€ ‚ÿSynchronized Resourcesc,ñà ˜Æ 7 <€[€ˆˆ‚€€€†"€A‚ÿSynchronized resources are multiple hardware devices that have been connected so that they use the same clock timer. Synchronized devices display in the resource browser as a unique resource. For example, the two CMM2 or two GAM boards in a full-duplex Explorer are synchronized. The resource browser shows three resources available within the Explorer; the first module, the second module, and the synchronized configuration of both modules together. Synchronized resources are recognized by the synchronized resource icon in the resource browser. ±ˆ5Ä IÉ ) €€ˆˆ‚€‚‚ÿSynchronizing resources allows single actions to start a resource pair. All statistics and all data about stations and conversations will appear as one resource to Surveyor, so you can perform all capture, transmit, and monitoring functions on a full-duplex network segment. Synchronized resources can also monitor two half-duplex segments. You cannot transmit from synchronized resources.Two CMM2 or GAM cards within the same PC can be synchronized. This requires a special cable between the two cards to synchronize their clocks. Call customer support for information on how to synchronize and use two CMM2 cards or two GAM cards within a PC.“k˜Æ ÜÊ ( €×€ˆˆ‚€‚ÿSynchronized CMM2 modules within an Explorer are must be used with a Century Tap or a Century 12-Tap to provide a connection to full-duplex network segment(s). The 12-Tap provides a convenient, software-controlled means to switch between segments. Contact customer support for more information on Explorer, Century Tap, Fiber Tap, and Century 12-Tap products.AIÉ Ë 1üq"‰°Ë WË "Í Default Accounts:ÜÊ WË ' €&€ ˆ‚€‚ÿDefault Accounts;Ë ’Ì ( €'€ˆˆ‚€‚ÿSurveyor provides two default accounts with passwords for accessing remote resources. The account names and passwords are case sensitive. You can use the default accounts to access any remote resource until the accounts and passwords are changed. The default accounts are:QWË "Í ? N€¢€ˆˆˆ!‰ñ€ƒ€ƒƒ‚€ƒƒƒƒ‚ƒƒƒ‚ÿAccount NamePasswordPrivilegesguestpublicfullsumanagersuper-userM’Ì oÍ 1L «‡ÿÿÿÿ±oÍ ¾Í åHints and Tips for ResourcesO""Í ¾Í - *€D€ ˆ‚€€"€‚ÿHints and Tips for Resources ¥loÍ cÎ 9 B€Ø€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To connect to a remote host, choose Connect... from the Remote menu and enter the host IP address.W¾Í óÎ 9 B€®€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To set up or change accounts, choose Access Privileges... from the Host menu.¥lcÎ ˜Ï 9 B€Ø€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To see remote users logged on to your local resources, choose Current Users... from the Host menu.‰\óÎ -- *€¸€VˆˆÈ:‚H€ ƒ€‚ÿ·When using CMM2s, be sure you set the module port and s˜Ï -"Í peed before using the resource.Þ˜Ï ?4 6€½€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Use the Refresh button in dialog boxes to update the list of user accounts currently established. Remote users with super-user privileges may have created a new account since the dialog box was initially displayed.W-Ï9 B€®€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To prevent others from using a local resource, use Lock from the Module menu.Þ°?­. *€a€VˆˆÈ:‚H€ ƒ€‚ÿ·Setting the mode to transmit disables monitor and capture unless your are using an CMM2 in full-duplex mode. Setting the mode to monitor and/or capture disables transmit.ð¼Ï4 6€y€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Monitor mode can be set in addition to capture if the resource supports monitoring functions. If the resource does not support monitoring functions, the Monitor button is disabled.j=­- *€z€VˆˆÈ:‚H€ ƒ€‚ÿ·Use CMM2s or GAMs for full-duplex capture and transmit. Ò: B€¥€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·For options to be displayed under the Host menu, you must select the local host name in the Resource Browser. Selecting a resource within the local host makes the options in the Host menu unavailable.9ÿL: B€ÿ€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·Use the Description… option from the Host menu to find out information about the host. Information includes host type, IP address, and the Surveyor software version. The host name must be highlighted in the Resource Browser to get a description.YÙ4 6€³€VˆˆÈ:‚H€ ƒ€€€‚ÿ·If you suspect that a remote resource is not responding, go to Summary View and look at the Resource Browser. If the host for the remote resource is not there, the connection has been lost with the remote host and the resource is not available. Red Xs appearing over a host in the Resource Browser indicate that the host is disconnected.ߥL¸: B€K€VˆˆÈ:‚H€ ƒ€€€€€‚ÿ·To see which capture filter or transmit specification is associated with a particular resource, choose Active TSP and Capture Filter from the Module menu. -Ùå* $€€VˆˆÈ:„H€‚ÿ[*¸@ 1Ä€ù²@ ” ' Create User Name, Password, and PrivilegesT-å” ' €Z€ ˆ‚€‚ÿCreate User Name, Password, and PrivilegesÊ¢@ ^ ( €E€„„‚€‚ÿSet up accounts that control access to the resources in your local PC. Accounts can also be set up for any remote host to which you have super-user privileges.Éz” ' O l€õ€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ€€‚ƒ‚ƒ‚ƒ€€‚‚ÿ1.Select the local or remote host by clicking on the host name in the resource browser.2.From the Host menu, choose Access Privileges…. 3.From the Access Privileges dialog box, click the New User button.4.Enter the new user name and new user password twice in the fields provided.5.Click the radio button for the new user privileges.6.Click the OK button.B^ i 1Z° ³i ¤ ÍDelete an Account;' ¤ ' €(€ ˆ‚€‚ÿDelete an Account¿—i c ( €/€„„‚€‚ÿDeletes accounts previously established for your local PC. Accounts can also be deleted for any remote host to which you have super-user privileges.@ö¤ £J b€í€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ€€‚ƒ€€‚ÿ1.Select the local or remote host by clicking on the host name in the resource browser.2.From the Host menu, choose Access Privileges…. 3.From the Access Privileges dialog box, click the Delete user button.4.Click the OK button.*c Í' €€„„‚€‚ÿI£1ÖùŽ´X BChange Access PrivilegesBÍX' €6€ ˆ‚€‚ÿChange Access PrivilegesÈ ,@( €A€„„‚€‚ÿChange the user privileges to an established account in your local PC. Privileges can be changed for any remote host to which yX,@Íou have super-user privileges.ÝŽX BO l€€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ‚ƒ€€‚ƒ‚ƒ€€‚‚ÿ1.Select the local or remote host by clicking on the host name in the resource browser.2.From the Host menu, choose Access Privileges…. 3.From the Access Privileges dialog box, click on the user name whose privileges you want to change.4.Click the Modify user button.5.From the Modify User dialog box, click the radio button for the new user privileges.6.Click the OK button.V%,@_B1^ ‚‚µ_B®BÛCShow Host Users and Access PrivilegesO( B®B' €P€ ˆ‚€‚ÿShow Host Users and Access Privileges`9_BC' €r€„„‚€‚ÿDisplays all remote users logged in to your local PC. Í“®BÛC: B€'€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ÿ1.Select the local host by clicking on the host name or IP address in the resource browser. 2.From the Host menu, choose Current Users…. @CD1°Ž~„¶DTDÓFChange Password9ÛCTD' €$€ ˆ‚€‚ÿChange PasswordÆžDE( €=€„„‚€‚ÿChange the user password for an established account. You can also change passwords for any account on a remote host to which you have super-user privilegesITD©FF Z€“€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ‚ƒ‚ƒ€€‚ÿ1.Select the local or remote host by clicking on the host name in the resource browser. If selecting a remote host, you must be logged in.2.From the Host menu, choose Access Privileges…. 3.From the Access Privileges dialog box, enter the new password.4.Enter the password again to confirm.5.Click the OK button.*EÓF' €€„„‚€‚ÿ> ©FG1#‚‚÷…·GHG:ILock a Module7ÓFHG' € € ˆ‚€‚ÿLock a Module­…GõG( € €„„‚€‚ÿPrevents remote users from accessing a module. You can also lock a module on a remote host to which you have super-user privilegesÉHG¾H: B€€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ÿ1.Select the local or remote resource by clicking on the resource name in the resource browser.2.From the Module menu, choose Lock. |UõG:I' €ª€„„‚€‚ÿIf you lock a remote resource, the lock is lost if the network connection is lost.@¾HzI1i~„¸‡¸zI³IëKUnlock a Module9:I³I' €$€ ˆ‚€‚ÿUnlock a ModuleDzI÷J( €9€„„‚€‚ÿAllows access to a previously locked local resource so it can be used again by remote users. You can also unlock a module on a remote host to which you have super-user privileges. Remote users must still have an account and proper privileges to access a module once it is unlocked.ʳIÁK: B€!€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ÿ1.Select the local or remote resource by clicking on the resource name in the resource browser.2.From the Module menu, choose Unlock. *÷JëK' €€„„‚€‚ÿMÁK8L1ß÷…¹8LzL8Connect to a Remote ResourceBëKzL' €6€ ˆ‚€‚ÿConnect to a Remote HostŒe8LM' €Ê€„„‚€‚ÿMakes a connection to a remote host for the purpose of accessing remote resources within the host.ÄzLON j€‰€VˆˆÈ:„H€ƒ€€€€€€‚ƒ€€€€‚ƒ‚ÿ1.From the Remote menu, choose Connect…. Or, choose Reconnect… if you are reconnecting with the last host you connected to.2.From the Connect New Host dialog box, enter the host IP address. Use the Name Table... button to look up the host name. If you are reconnecting, the host IP address will already be entered in the Host: field.3.From the Connect New Host dialog box, enter your account name and your password on the remote host.MMeO1 2€8€VˆˆÈ:„H€ƒ€€‚ÿ4.Click the OK button.-O’O' € €œŒ‚€‚ÿTIPšZeO8@ N€µ€„„‚€€€€€€€€€‚ÿSurveyor "remembers" hosts that you have conn’O8ëKected to from the Connect… option of the Remote menu. If you log in to a host and quit Surveyor, you'll automatically get the Connect New Host dialog box when you restart the program. Click OK to log in to the last host you connected to, or press Cancel to abort the auto-discovery process.N’O†1´¸‡º†ÍPƒDisconnect from a Remote HostG 8Í' €@€ ˆ‚€‚ÿDisconnect from a Remote Host…^†R‚' €¼€„„‚€‚ÿDisconnects from a remote host. All remote resources in the host are no longer accessible. Ò˜Í$ƒ: B€1€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ÿ1.Select the remote host by clicking on the remote host name or IP address in the resource browser.2.From the Remote menu, choose Disconnect. ,R‚Pƒ( €€„„‚€‚‚ÿ?$ƒƒ1ä练ǃzŠStart a Module8Pƒǃ' €"€ ˆ‚€‚ÿStart a Moduleß·ƒ¦„( €o€ˆˆ‚€‚ÿStarting a module begins the process of capturing, monitoring, or transmitting data. If using a Capture Filter or a Transmit Specification, load them prior to starting the module.;ǃá„' €(€œŒ‚€‚ÿFROM SUMMARY VIEWï}¦„Іr ²€€VˆˆÈ:„H€ƒ‚ƒ†"€†"€B†"€'€€€€€€€€€€‚ƒ†"€‚ÿ1.Select a module. Click on a resource in the resource browser or select the window for resource in Summary View.2.Set the mode. From the Module toolbar, use the mode buttons (capture) (monitor) (transmit); or, from the Module menu, choose Mode and select Capture and/or Monitor, or Transmit.3.From the Module toolbar, click the button; or, press Ctrl + T.:á„ ‡' €&€œŒ‚€‚ÿFROM DETAIL VIEW{ І…ˆp ®€€VˆˆÈ:„H€ƒ†"€†"€B†"€'€€€€€€€€€€‚ƒ†"€‚ÿ1.Set the mode. From Detail View toolbar, use the mode buttons (capture) (monitor) (transmit); or, from the Module menu, choose Mode and select Capture and/or Monitor, or Transmit.2.From the Module toolbar, click the button; or, press Ctrl + T.. ‡³ˆ' €€œŒ‚€‚ÿTIPSY0…ˆ Š) €a€ˆˆ‚€‚‚ÿSetting the mode to transmit disables monitor and capture. Setting the mode to monitor and/or capture disables transmit.Monitor mode can be set in addition to capture if the resource supports monitoring functions. If the resource does not support monitoring functions, the monitor button is disabled.2 ³ˆ>Š' €€œŒ‚€‚ÿSEE ALSO< ŠzŠ0 0€€ˆˆ‚ãø€‰€‚ÿModes > >ЏŠ1†n¼¸ŠïŠDStop a Module7zŠïŠ' € € ˆ‚€‚ÿStop a ModulekD¸ŠZ‹' €ˆ€ˆˆ‚€‚ÿStopping a module stops the transmit or monitor/receive process. ;‹' €(€œŒ‚€‚ÿFROM SUMMARY VIEW÷ÀZ‹ŒŒ7 <€ƒ€VˆˆÈ:„H€ƒ‚ƒ†"€ ‚ÿ1.Select a module. Double-click on a resource in the resource browser or select the window for resource in Summary View.2.From the Module toolbar, click the button; or, press Ctrl + P.:•‹ÆŒ' €&€œŒ‚€‚ÿFROM DETAIL VIEW~JŒŒD4 8€–€VˆˆÈ:„H€ƒ†"€ ‚ÿ1.From Detail View toolbar, click the button; or, press Atl + M + P.= ÆŒ1Oç%‚½·9ÄSet the Mode6D·' €€ ˆ‚€‚ÿSet the Mode@÷Ž( €1€ˆˆ‚€‚ÿThere are four modes for using a device, capture, monitor, capture/monitor, and transmit. Only the modes allowed for the device you have selected will be available from the toolbars or menus. If you are in Detail View, you can only toggle the mode between capture and transmit.;·2' €(€œŒ‚€‚ÿFROM SUMMARY VIEW¦?÷ŽäÀg œ€…€VˆˆÈ:„H€ƒ‚ƒ†"€†"€B†"€'€€€€€€€€€€‚ÿ1.Select a resource. Double-click on a resource in the resource browser or select the window for the 2äÀDresource in Summary View.2.From the Module toolbar, use the mode buttons (capture) (monitor) (transmit); or, from the Module menu, choose Mode and select either Capture and/or Monitor, or Transmit.:2Á' €&€œŒ‚€‚ÿFROM DETAIL VIEW&ÁäÀDÂe ˜€‰€VˆˆÈ:„H€ƒ†"€†"€B†"€'€€€€€€€€€€‚ÿ1.From Detail View toolbar, use the mode buttons (capture) (monitor) (transmit); or, from the Module menu, choose Mode and select either Capture and/or Monitor, or Transmit..ÁrÂ' €€œŒ‚€‚ÿTIPSY0DÂËÃ) €a€ˆˆ‚€‚‚ÿSetting the mode to transmit disables monitor and capture. Setting the mode to monitor and/or capture disables transmit.Monitor mode can be set in addition to capture if the resource supports monitoring functions. If the resource does not support monitoring functions, the monitor button is disabled.2 rÂýÃ' €€œŒ‚€‚ÿSEE ALSO< ËÃ9Ä0 0€€ˆˆ‚ãø€‰€‚ÿModes IýÂÄ19n‹„¾‚ÄÄÄÌÇSet the Module InterfaceB9ÄÄÄ' €6€ ˆ‚€‚ÿSet the Module Interface°ˆ‚ÄtÅ( €€ˆˆ‚€‚ÿThere are two ports for a CMM2, RJ45 and MII. Both RJ45 and MII ports can be used at 10 or 100 Mbps and the transceiver is built in. d(ÄÄØÆ< F€Q€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ‚ÿ1.The interface can be set from Summary View or Detail View. In Summary View make sure the resource you want is the currently selected resource by clicking the resource name in Resource Browser. 2.From the Module menu, choose Interface.3.Set the module interface to one of two values:“btÅkÇ1 2€Ä€Vˆˆ±ã~†±H€ƒ‚ƒ‚ÿRJ45Set the module interface to the RJ45 port. MIISet the module interface to the MII port. a9ØÆÌÇ( €r€ˆˆ‚€‚‚ÿSetting the interface does not apply to NDIS modules.= kÇ È1g%‚» ¿ ÈEÈ{ÍSet MII Mode<ÌÇEÈ' €*€ ˆ‚€‚ÿSet Interface Mode) ÈnÉ( €€ˆˆ‚€‚ÿThere are two speeds for using a Century Media Module, 10 Mbps and 100Mbps. For synchronized CMM2 modules, there is also the ability to set the Interface mode to full-duplex. Only synchronized CMM2 modules can be auto-selected or forced to full duplex.m1EÈÛÊ< F€c€VˆˆÈ:„H€ƒ‚ƒ€€€€‚ƒ‚ÿ1.The Interface mode can be set from Summary View or Detail View. In Summary View make sure the resource you want is the currently selected resource by clicking the resource name in Resource Browser. 2.From the Module menu, choose Interface Mode.3.Set the Interface mode to one of five values:Ó›nÉ®Ì8 >€7€VˆˆùS~†ùH€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿAuto NegotiateSet the Interface mode from the network. The module will auto-select the speed and half or full duplex from the network. 10Mbps Half DuplexSet the Interface mode to 10 Mbps, half duplex.100Mbps Half DuplexSet the Interface mode to 100 Mbps, half duplex.10Mbps Full DuplexSet the Interface mode to 10 Mbps, full duplex.100Mbps Full DuplexSet the Interface mode to 100 Mbps, full duplex.ÍÛÊ{Í0 .€;€ˆˆ‚€‚‚‚‚‚‚‚‚‚ÿSetting the Interface mode does not apply to NDIS modules. Full duplex options do not apply to GAM cards, or CMM2 cards that are not synchronized.1®Ì¬Í1UÿÿÿÿÿÿÿÿÀÿÿÿÿ¬ÍÐÍ${ÍÐÍ" €€€ÿ@¬ÍÎ1 ÿÿÿÿ‰ÁÎIÎ}Alarms Overview9ÐÍIÎ' €$€ ˆ‚€‚ÿAlarms OverviewàÎp; D€Á€ˆˆ‚€€€€€€€‚‚ÿSurveyor’s alarms facility enables you to create alarms to automatically monitor network resources. Access to Surveyor’s alarms facility is through the Alarm Browser docking window located in Surveyor’s main window. The Alarm Browser window features a hierarchical directory comprising folder, file and application icons that can be manipulated using point-and-click mouse IÎpÐÍcommands. Alarms are created using an Alarms Editor. The Alarms Editor window contains an alarms table. Each alarm within the alarms table contains default threshold values, notification settings, a sampling interval value, and an Enable/Disable click box. After editing and enabling a desired set of alarms, you assign a unique name to the alarm group.ÐIÎu5 8€¡€ˆˆ‚€€€‚€€‚ÿAlarm groups are applied to network resources by dragging the resource’s icon from the Resource Browser window to the alarm group. The network resource icon appears in the Alarm Browser directory under the alarm group upon which it was dropped. Starting the resource will automatically activate the use of the alarm group for that resource. You must have Monitor mode set for a resource to have alarms trigger and have alarm actions occur.Multiple resources can be dragged and dropped onto a single alarm group. Resources can be applied to multiple MAC Layer and Network Layer alarm groups. To stop an alarm group from monitoring a network resource, use the mouse to select the resource and press the Delete key.Þ¶pS( €m€ˆˆ‚€‚ÿActions resulting from alarms are varied and extremely flexible because they are assigned to each individual alarm. When an alarm threshold is exceeded, an audible beep sounds on the host, and an alarm message appears in the Message window. Individual alarms can also be configured to log alarms to a log file, contact individuals by e-mail, dial pager numbers, restart the resource, auto save data, or stop the resource and save data.*u}' €€ ˆˆ‚€‚ÿ> S»1¹ ‰ »òzAlarm Browser7}ò' € € ˆ‚€‚ÿAlarm BrowserX#»J 5 8€G€ˆˆ‚€‚€€€€‚ÿThe Alarm Browser enables you to create/modify and use alarm groups to monitor local and remote network resources. The Alarm Browser window, through which you access and use all of the alarm browser components, appears in the Surveyor startup window. Surveyor’s alarm browser appears and operates much like the graphical user interface used by Microsoft Windows 95 Explorer. Alarm browser’s hierarchical directory structure features folder, file, and application icons that you manipulate using point-and-click mouse commands. Additionally, the alarm browser interface provides convenient check boxes that enable you to quickly expand or collapse portions of the Alarm Browser directory. This is useful if you create numerous alarm groups or if you assign alarm groups to many network resources.Æ—ò / ,€/€ˆˆ‚€‚€€‚ÿThe Alarm Browser contains five folders, Expert Alarms, Application Response Time Alarms, Ethernet MAC Layer Alarms, Token Ring Alarms , and Network Layer Alarms. Expert Alarms and Application Response Time Alarms are only available if you have the Expert plug-in. Each folder contains an alarms editor. These editors are used to select, modify, and create alarm groups.Multiple resources can be dragged and dropped onto a single alarm group. When an alarm is triggered for a resource, the resource flashes in the Alarm Browser window. To stop an alarm group from monitoring a network resource, use the mouse to select the resource and press the Delete key.8J H 0 0€€v ˜ŒÑ€Á€t„Ѐ#€$‚ÿNote¼ - (€€6ˆ˜Á€Á€„À€#‚ÿThe Ethernet MAC Layer alarms are the only alarms supported for GAM resources. You can only drag and drop GAM resources to MAC Layer Alarms.2 H 6' €€œŒ‚€‚ÿSEE ALSODz0 0€(€ˆˆ‚ãœoA€‰€‚ÿAlarm Example > 6¸1¡‰ˆøïÂKAlarm Editors7zï' € € ˆ‚€‚ÿAlarm Editors¾–¸­( €-€ˆˆ‚€‚ÿThere are five Alarm Editors. The Expert Alarm Editor and Application Response Time Alarm Editor are only available if you have the Expert plug-in.,ôïåA8 >€é€VˆˆA‚Ã}„A€ƒ€€€‚ÿExpert Alarm EditorAllow­åAzs you to modify and enable any of the 35 alarm types contained in Surveyor’s Expert alarm table. Alarms test for discrete conditions at different protocol layers, such as NFS retransmissions at the application layer, overload utilization percentages at the MAC layer, or TCP/IP SYN packets at the transport layer. The help system contains a description of each expert symptom, which corresponds to the types of conditions you can test for using the expert alarm editor.U­:DF Z€€VˆˆA‚Ã}„A€ƒ€€€‚€ƒ€€€‚ÿApplication Response Time EditorAllows you to modify and enable any of 8 alarm types contained in Surveyor’s Application Response Time alarm table. Alarms test for application response times related to application protocols such as SMTP, HTTP, or NFS.Ethernet MAC Layer Alarm Editor Allows you to modify and enable any of 21 alarm types contained in Surveyor’s Ethernet MAC Layer alarm table. Alarms test for conditions related to Ethernet conditions such as utilization rate, packet size, errors, and frame types.=÷åAwFF Z€ï€VˆˆA‚Ã}„A€ƒ€€€‚€ƒ€€€‚ÿToken Ring Alarm Editor Allows you to modify and enable any of 29 alarm types contained in Surveyor’s Token Ring alarm table. Alarms test for conditions related to Token Ring conditions such as utilization rate, packet size, errors, and frame types.Network Layer Alarm Editor Allows you to modify and enable any of the 65 alarm types contained in Surveyor’s Network Layer alarm table. Alarms test for conditions related to Network Layer conditions such as IP/IPX/ARP packet or octet counts.ì:D”G1 0€Û€ˆˆ‚€†"€C‚ÿClick on the appropriate icon to display the alarm table you want. Each alarm can be used with the default values provided by Surveyor, or you can modify them with the alarms editor to precisely meet your resource monitoring needs.7wFËG' € €œŒ‚€‚ÿALARM GROUPS …P”GPI5 8€¡€ˆˆ‚€‚€€€€‚ÿYou can create an unlimited number alarm groups. When you create an alarm group, the alarm table editor asks you to name the new alarm group. Surveyor will save the alarm group file in the appropriate folder. All the “enabled” rows in the table comprise an alarm group. Alarm groups are named and then associated with resources.AËG‘I' €4€œŒ‚€‚ÿALARMS AND ALARM EVENTS¹ŠPIJK/ ,€€ˆˆ‚€‚€€‚ÿThe entire table of alarms you can set is shown in each alarm editor. Each line in the table is called an alarm or alarm row. You can enable as many alarms as you want in the table. If a threshold is exceeded for any enabled alarm row within an alarm table, an alarm event occurs. The event is reported according to the value configured in the Action field for the alarm row in the table.2 ‘I|K' €€œŒ‚€‚ÿSEE ALSOFJKÂK0 0€,€ˆˆ‚ãŒ#选€‚ÿExpert Overview ; |KýK1· nÄýK 6ƒºƒ1o ˆ> źƒñƒ/Alarm Actions7|ƒñƒ' € € ˆ‚€‚ÿAlarm Actions\.ºƒM…. *€]€ˆˆ‚€€€‚ÿEach line in an alarm table has a unique set of actions associated with it that will occur if the alarm is triggered. You always get at least two actions when an alarm is triggered – an audible alarm and a message in the Message window. You can have one of seven actions associated with the alarm:ئñƒ%†2 2€M€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Message records the message in the Message window in the Surveyor main window and sounds the audible alarm. No other actions occur if this setting is selected.ÑŸM…ö†2 2€?€Vˆˆ‘€:‚€ ƒ€€‚ÿ·E-Mail sends the message to pre-configured e-mail addresses. Your e-mail application does not need to be running for alarms to generate e-mail messages.l;%†b‡1 2€v€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Pager sends alarms to pre-configured pager numbers. i8ö†ˇ1 2€p€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Log records alarms in a pre-configured log file. i8b‡4ˆ1 2€p€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Stop&Save stops the module when the alarm occurs.^ˇÈ1 2€¼€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Restart resets all counters and begins capture from the point where the alarm occurred.‚Q4ˆE‰1 2€¢€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Auto Save saves data in the capture buffer at the time the event occurred.†WÈË‹/ ,€¯€ˆˆ‚€€€‚‚ÿWhen sending E-mail or making a call to a pager, multiple addresses/numbers can be configured from the Configuration menu. Setting the addresses/numbers for alarm actions is a global setting. All alarms reported by Surveyor will go to the same set of E-mail addresses/Pager numbers. For example, you cannot send some alarms to one set of e-mail addresses and some alarms to another set of e-mail addresses.When storing the alarm in a log file, only one log file can be configured. However, you can change the name of the log file at any time and future alarms will be written to the new file.èE‰ã0 .€Ñ€ˆˆ‚€‚‚€€‚ÿIf the alarm causes the resource to stop, Surveyor saves the capture buffer data to a file. The name of the file is based on the current date and time.If the alarm restarts the resource, all counters are set to zero and the resource begins capture. This allows you to collect data and count it after a particular event has occurred.Note: If the threshold is set very low and the alarm action is configured for Stop&Save, Surveyor may create capture files that are completely empty.uNË‹XŽ' €œ€ˆˆ‚€‚ÿNote: You must set an appropriate delay time when making a call to a pager.2 ㊎' €€œŒ‚€‚ÿSEE ALSO¥[XŽ/J d€¶€ˆˆ‚ã3ôü€‰€‚ãÄç`T€‰€‚ãõ¹Œ@€‰€‚ÿSet Alarm E-mail Addresses Set Alarm Log File Name Set Alarm Pager Numbers CŠŽr1In4€Ær®ÓÁAlarm List and Log</®' €*€ ˆ‚€‚ÿAlarm List and LogOr;Á2 2€¡€ˆˆ‚€†"€D‚‚ÿFrom Detail View, click on the®;Á/ button to open a window with alarm list and log. From Summary View, click on the Alarms tab.Alarm view is a table showing all alarm groups assigned to this resource. It lists alarm groups by name and identifies the type of alarm group, Expert, Application Response Time, MAC, Token Ring, or Network.2 ®mÁ' €€œŒ‚€‚ÿSEE ALSOf);ÁÓÁ= J€R€ˆˆ‚ãôlÞ¦€‰€‚ã˜ö;˜€‰€‚ÿAlarms Overview Alarm Browser > mÁÂ1Á> Ð…ÇÂHÂØÊExpert Alarms7ÓÁHÂ' € € ˆ‚€‚ÿExpert AlarmsyPÂÁÃ) €¡€ˆˆ‚€‚‚ÿDuring transmit or receive, expert symptoms are logged as they occur. You can test for certain thresholds for these conditions by setting alarms using the Expert Alarms Editor. Click on the expert alarm name below for more information on the associated expert symptom.Expert Alarms are only available if you have the Expert plug-in.W-HÂÄ* $€Z€œŒ„Ñ€ƒ‚ÿAPPLICATION, TRANSPORT LAYERNETWORK LAYER DÁÃ8ÆÜ †‰€ˆˆ„ÑãÓÞ°€‰€ƒãÇPç½€‰€‚ã!Ïég€‰€ƒãÑIr(€‰€‚ãDg$Ë€‰€ƒã‘Ïr怉€‚ãì[Ì`€‰€ƒãéói0€‰€‚ã =ûš€‰€ƒã>\ž{€‰€‚ãžÎ×’€‰€ƒã:äU€‰€‚ãó¸¬ü€‰€ƒãã €‰€‚ÿICMP All Errors Duplicate Network Address ICMP Destination Unreachable Unstable MSTICMP Redirect SAP Broadcasts Excessive BOOTPOSPF Broadcasts Excessive ARPRIP Broadcasts NFS Retransmissions Total Router Broadcasts TCP/IP SYN Attack ISL Illegal VLAN ID ©ÄUÇt ¶€S€ˆˆ„ÑãÚ ú€‰€ƒãNÔßñ€‰€‚ã"›b€‰€ƒãýѹþ€‰€‚ã“ÝDr€‰€ƒã<-`«€‰€‚ÿTCP/IP RST Packets ISL BPDU/CDP Packets TCP/IP Retransmissions IP Time to Live Expiring TCP/IP Zero Window Illegal Network Source Address b88Æ·Ç* $€p€œŒ„Ñ€ƒ‚ÿDATA LINK LAYER, ETHERNETDATA LINK LAYER, TOKEN RINGFƒUÇýÉà T€ˆˆ„Ñã`ÓRo€‰€ƒã`ÓRo€‰€‚ã÷üÑa€‰€ƒã÷üÑa€‰€‚ãcêqH€‰€ƒãcêqH€‰€‚ãºKŒû€‰€ƒãºKŒû€‰€‚ãJZ€‰€ƒãJZ€‰€ƒ‚ãØ¥.€‰€ƒãØ¥.€‰€‚ÿOverload Utilization Percentage Overload Utilization PercentageOverload Frame Rate Overload Frame Rate Illegal MAC Source Address Illegal MAC Source Address Total MAC Stations Total MAC Stations Total MAC StationsNew MAC Stations New MAC Stations New MAC StationsExcessive Broadcasts Excessive Broadcasts Excessive Broadcasts±d·Ç®ÊM j€È€ˆˆ„Ñã½?j$€‰€ƒã½?j$€‰€‚ãAIŠ€‰€ƒ‚ÿExcessive Multicasts Excessive Multicasts Excessive MulticastsExcessive Collisions *ýÉØÊ' €€ˆˆ‚€‚ÿJ®Ê"Ë1F 4€{ È"ËeË[Hints and Tips for AlarmsCØÊeË' €8€ ˆ‚€‚ÿHints and Tips for Alarms„L"ËéÍ8 >€™€VˆˆÈ:„H€ƒ‚ƒ‚ƒ‚ƒ€€‚ÿ1.Assign alarms to resources by dragging and dropping resource icons into alarm icons.2.You can drag-and-drop multiple resources onto a single alarm group. You can also drag-and-drop one resource to many alarm groups.3.Remember that alarm groups are assigned to resources, not individual alarms within an alarm group. If you only want a single alarm, create an alarm group with only one alarm enabled.4.Click, hold, and drag a column border to resize columns in the alarm table. Increasing the size of the Variable column gives you a view of the complete name of the variable.reËgX ~€5€VˆˆÈ:„H€ƒ€€‚ƒ€€€€€€€€€€€€‚ÿ6.To set more than one alarm of the same type, click on the type you want to duplicate and press the Insert key. A new alarm row appears below the current row. Fill out the settings in the new row.7.To set one alarm that has multiple actions, click on the alarm type you want to duplicate and press the Insert key. A new alarm row appears below the current row. Change the Actions field of the new row to the additional action you want. éÍgØÊFor example, you could have one alarm of type Packets with the action set to E-mail and one alarm of type Packets with the alarm type set to Pager. Note that if the alarm rows are identical except for the action, you will get two messages in the message window for the alarm, since a message is always posted when any alarm is triggered.ÊxéÍ1R r€ñ€VˆˆÈ:„H€ƒ€€€€€€€€‚ƒ€€€€‚ÿ8.You can copy values in one alarm row to another. Click on the Alarm Type in the alarm row you want to copy. The row highlights; press Crtl + C to copy. Click on the Alarm Type in the alarm row where you want to place the copied values and press Crtl + V.9.Create custom alarms and their associated actions by double-clicking on any ‘Create New Alarm’ icon.*g[' €€ˆˆ‚€‚ÿ?1š1¥Ð…± ÉšÒFAlarm Examples8[Ò' €"€ ˆ‚€‚ÿAlarm Examplest%šFO l€K€ˆˆ‚€‚ãkǹª€‰€‚ãg'µ€‰€‚ãœoA€‰€‚ÿThree examples are provided for alarms and alarm groupings. Each provides a picture of an alarm table and a description of what will occur when specific alarm rows are enabled in an alarm table.Alarm Example, Utilization Alarm Example, Packet Size Alarm Example, MAC Errors KÒ‘1©{  Ê‘ÕMAlarm Example, UtilizationDFÕ' €:€ ˆ‚€‚ÿAlarm Example, Utilizationx?‘M9 @€€ˆˆ‚€†"€E‚€€‚‚ÿThis simple example shows an alarm group consisting of one MAC Layer alarm for Utilization. This alarm samples network traffic at five-second intervals. When the absolute, rising value of 50 (percent utilization) is exceeded, Surveyor issues an audible alarm and displays a message in Surveyor’s message window.JÕ—1|±  Ë—Ú% Alarm Example, MAC ErrorsCMÚ' €8€ ˆ‚€‚ÿAlarm Example, MAC Errors!Ü—û E X€»€ˆˆ‚€†"€F‚€€‚€€€€‚ÿThis example shows an alarm group consisting of five MAC Layer alarms: Errors, Undersize Packets, Oversize Packets, CRC/Alignment, and Fragments. Each of these alarm counters are checked at five-second intervals. When an alarm threshold for any of these five alarms is exceeded, Surveyor issues an audible alarm and displays a message in Surveyor’s message window. Assume that overall error rate is of particular interest in this example. The Severity setting instructs Surveyor to include a “Warning!” statement with all alarm messages when the error rate is greater than 250. The Actions setting instructs Surveyor to send an e-mail message whenever the rising value (threshold) for the overall error rate exceeds 250.*Ú% ' €€ˆˆ‚€‚ÿKû p 1ý ¬…!Ìp ´ € Alarm Example, Packet SizeD% ´ ' €:€ ˆ‚€‚ÿAlarm Example, Packet SizeÌ“p € 9 @€)€ˆˆ‚€†"€G‚€€‚‚ÿThis example shows an alarm group consisting of three MAC Layer alarms: Oversize Packets, 512-1028 Byte Packets, and 1024-1518 Byte Packets.. Each of these alarm counters are checked at five-second intervals. When an alarm threshold for any of these three alarms is exceeded, Surveyor issues an audible alarm, displays a message in Surveyor’s message window, and records the alarm in a log file.M´ Í 1(‹„t€ ÍÍ ©@Apply an Alarm to a ResourceF€ ' €>€ ˆ‚€‚ÿApply an Alarm to a Resourceã»Í ö( €w€ˆˆ‚€‚ÿTo apply an alarm to a resource, you must have already created an alarm group. The resource must display in the Resource Browser, and the alarm group must display in the Alarm Browser.ݯÓ. *€_€VˆˆÈ:„H€ƒ‚ƒ‚ÿ1.Click and hold on the resource from the Resource Browser.2.Drag and drop the resource over the name of Alarm Group. The resource should appear beneath the Alarm Group..ö @' €€œŒ‚€‚ÿTIPSÓ @€ œtÓ©@( €è€ˆˆ‚€‚‚ÿYou can drag and drop many resources to one alarm group.You can drag and drop one resource to many alarm groups.@ @é@1» !Îé@"A €Create an Alarm9©@"A' €$€ ˆ‚€‚ÿCreate an Alarm‡Yé@©B. *€³€ˆˆ‚€€€‚ÿEach row of an alarm table sets a unique threshold that can be triggered by events and generate an alarm. This procedure describes the process of configuring one row in the alarm table. From an alarm table, choose the alarm you want. Pick the Alarm Type (protocol/counter) you want to test for and completely specify that line in the table.Ã"A¸DL f€‡€VˆˆÈ:„H€ƒ€€€€€€‚ƒ€€€€‚ÿ1.Set the Sample Type to Absolute or Delta. Absolute values will only trigger once until the counters reach there maximum capacity and are reset to zero. Then the absolute value may trigger again. Delta values mean that if a difference between samples increases (rising) or decreases (falling) more than the specified threshold, an alarm event is triggered.2.Set the Rising and/or Falling values. At least one value must be specified. É—©BE2 2€/€VˆˆÈ:„H€ƒ€€‚ÿ3.Set the Severity to Normal, Warning, Critical, Major, or Minor. Setting the Alarm Type only effects the type of display in the Message window. V%¸D×E1 2€J€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Normal alarms appear in black.X'E/F1 2€N€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Warning alarms appear in purple.V%×E…F1 2€J€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Critical alarms appear in red.T#/FÙF1 2€F€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Major alarms appear in blue.V%…F/G1 2€J€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Minor alarms appear in maroon.ôÂÙF#H2 2€…€VˆˆÈ:„H€ƒ€€‚ÿ4.Set the Actions to take if an alarm event occurs. You always get a message in the message window and an audible alarm. Settings other than Default cause additional actions to take place.Ó¡/GöH2 2€C€Vˆˆ‘€:‚€ ƒ€€‚ÿ·E-mail will send the message to pre-configured e-mail addresses. Your e-mail application does not need to running for alarms to generated e-mail messages.p?#HfI1 2€~€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Pager will send alarms to pre-configured pager numbers. m<öHÓI1 2€x€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Log will record alarms in a pre-configured log file. Û©fI®J2 2€S€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Stop&Save will stop the module when the alarm occurs. A dialog box appears so you can name the capture file in which to save data currently in the capture buffer.’aÓI@K1 2€Â€Vˆˆ‘€:‚€ ƒ€€‚ÿ·Restart will reset all counters and begin capture from the point where the alarm occurred.É®JL: B€€VˆˆÈ:„H€ƒ€€‚ƒ€€‚ÿ5.Set the Interval for set how often the counters are sampled.6.Click the Enabled box to include this alarm in the alarm group..@K1L' €€œŒ‚€‚ÿTIPSèÀLM( €€ˆˆ‚€‚ÿRemember that alarm groups are assigned to resources, not individual alarms within an alarm group. If you only want a single alarm, create a table (alarm group) with only one alarm enabled.xN1L‘M* $€œ€VˆˆÈ:„H€‚ÿClick, hold, and drag a column border to resize columns in the alarm table.õ®M†OG \€]€ˆˆ‚€€€‚€€€€€€€€‚ÿTo set more than one alarm of the same type, click on the type you want to duplicate and press the Insert key. A new alarm row appears below the current row. You can copy the values in one alarm row to another alarm row. Click on the Alarm Type in an alarm row you want to copy. The row highlights; press Crtl + C to copy. Click on the Alarm Type in the alarm row where you want the copied values and press Crtl + V.2 ‘M¸O' €€œŒ‚€‚ÿSEE ALSOI†O €0 0€2€ˆˆ‚ãlšTÍ€‰€‚ÿCreate Alarm Group ¸O €©@B¸OO€1,t€ X!ÏO€Š€…ƒInsert Alarm Rows; €Š€' €(€ ˆ‚€‚ÿInsert Alarm RowsׯO€a( €_€ˆˆ‚€‚ÿYou can set more than one alarm of the same type. You must insert a new row in the table and specify its settings. You must be within an Alarm Editor to use this procedure.¬tŠ€ ƒ8 >€é€VˆˆÈ:„H€ƒ‚ƒ€€‚ƒ‚ƒ‚ÿ1.Click on the type you want to duplicate by clicking on the type in the Alarm Type column. 2.Press the Insert key. 3.A new alarm row appears below the current row. The Alarm Type field will be blank. The new row is the same Alarm Type as the one above it.4.Completely specify the values for the new row. Be sure to select the Enable box to activate the alarm.2 a?ƒ' €€œŒ‚€‚ÿSEE ALSOF ƒ…ƒ0 0€,€ˆˆ‚ãòÛ¬‡€‰€‚ÿCreate an Alarm @?ƒŃ1¯!w!ÐŃþƒ|…Copy Alarm Rows9…ƒþƒ' €$€ ˆ‚€‚ÿCopy Alarm Rows[4ŃY„' €h€ˆˆ‚€‚ÿYou can copy values in one alarm row to another. #Ùþƒ|…J b€³€VˆˆÈ:„H€ƒ€€‚ƒ€€‚ƒ€€‚ƒ€€‚ÿ1.Click on the Alarm Type in an alarm row you want to copy. 2.The row highlights; press Crtl + C to copy. 3.Click on the Alarm Type in the alarm row where you want the copied values.4.Press Crtl + V.FY„Â…1u X! !ÑÂ…†ECreate an Alarm Group?|…†' €0€ ˆ‚€‚ÿCreate an Alarm Group™rÂ…š†' €ä€ˆˆ‚€‚ÿYou can create an alarm group for Expert, Application Response Time, MAC, Token Ring, or Network Layer alarms. œe†6ˆ7 <€Í€VˆˆÈ:„H€ƒ†"€H‚ƒ‚ÿ1.Form the Alarm Browser, click on the appropriate icon to select an Alarm Editor. Five different editors are available, each within a folder identifying the alarm group type.2.From the Alarm Editor, create the alarm you want. Pick the protocol/counter/variable in the left column you want to test for and completely specify that line in the table.㚆NŠ5 8€Ç€Vˆˆ‘€:„€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿa.Set the Sample Type to Absolute or Delta.b.Set the Rising and/or Falling values. At least one value must be specified.c.Set the Alarm Type to Warning, Serious or Informational (this step is optional).d.Set the Actions to take if an alarm event occurs. You always get a message in the message window and an audible alarm. Settings other than Message cause additional actions to take place.e.Set the the Interval for how often to check for and then report an alarm event.nB6ˆ¼Š, (€„€Vˆˆ‘€:„€ƒ‚ÿf.Click the Enabled box to include this alarm in the alarm setÉNŠ…‹< F€€VˆˆÈ:„H€ƒ‚ƒ€€‚ƒ€€‚ÿ3.Repeat step 2 for all alarms you want in this alarm group.4.In the Name: field, name the new alarm group.5.Click the OK button..¼Š³‹' €€œŒ‚€‚ÿTIPSc4…‹/ ,€i€ˆˆ‚€‚€€‚ÿOnce the alarm group is created, drag and drop a resource from the Resource Browser to assign the alarm group to that resource.To set more than one alarm of the same type, click on the protocol/counter type you want to duplicate and press the Insert key. A new alarm row appears below the current row. xN³‹Ž* $€œ€VˆˆÈ:„H€‚ÿClick, hold, and drag a column border to resize columns in the alarm table.?ÿÍŽ@ N€ÿ€ˆˆ‚€€€€€€€€€‚ÿYou can copy values in one alarm row to another. Click on the Alarm Type in an alarm row you want to copy. The row highlights; press Crtl + C to copy. Click on the Alarm Type in the alarm row where you want the copied values and press Crtl + V.2 ŽÿŽ' €€œŒ‚€‚ÿSEE ALSOFÍŽE0 0€,€ˆˆ‚ãòÛ¬‡€‰€‚ÿCreate an Alarm KÿŽ1-w!3‚!ÒÔ€ÄSet Alarm E-mail AddressesDEÔ' €:€ ˆ‚€‚ÿSet Alarm E-mail Addresses¸ƒ˜Á5 8€€„„‚€€€Ô˜ÁE€€‚‚ÿSets the addresses of users that will receive an e-mail message when an alarm event occurs. An e-mail message is generated for all alarms with the Actions field set to “E-mail” in Surveyor. Your e-mail application does not have to be running to configure e-mail addresses or for alarms to generate e-mail messages.The alarm E-mail feature works only with Microsoft Mail Exchange.ºÔ®Ã\ †€u€VˆˆÈ:„H€ƒ€€€€€€€€‚ƒ€€‚ƒ€€‚ƒ€€‚ÿ1.From the Configuration menu, choose Alarms. Choose E-Mail Settings from the Alarms menu.2.From the E-Mail Settings dialog box, press the Add Recipients button. 3.Pressing the Add Recipients button brings up the mail facility of Windows 95. Use the dialog box to select/specify E-mail addresses. Press the Help button for Windows 95 help for this dialog box.4.Click the OK button to exit the Windows 95 mail facility.¦u˜ÁTÄ1 2€ê€VˆˆÈ:„H€ƒ€€‚ÿ5.Recipients display in the E-Mail Settings dialog box. Click the OK button to return to Surveyor Summary View.,®Ã€Ä( €€ˆˆ‚€‚‚ÿHTÄÈÄ1Í !@„!ÓÈÄ Å¥ÇSet Alarm Pager NumbersA€Ä Å' €4€ ˆ‚€‚ÿSet Alarm Pager Numbersæ²ÈÄïÅ4 6€e€„„‚€€€€€‚ÿSets the pager number that will receive a page when an alarm event occurs. A page is generated for all alarms configured with the Actions field set to “Pager” in Surveyor.Œ> Å{ÇN j€}€VˆˆÈ:„H€ƒ€€€€€€€€‚ƒ‚ƒ€€‚ÿ1.From the Configuration menu, choose Alarms. Choose Pager Settings from the Alarms menu.2.From the Pager Settings dialog box, fill out the fields in the dialog box to specify a complete pager number. You must set an appropriate delay time for the type of pager you are calling.3.Click the OK button.*ïÅ¥Ç' €€ˆˆ‚€‚ÿH{ÇíÇ13‚!ÿÿÿÿÔíÇ.ÈÊSet Alarm Log File NameA¥Ç.È' €4€ ˆ‚€‚ÿSet Alarm Log File NameœuíÇÊÈ' €ê€„„‚€‚ÿSets the log file name which store messages when alarm events occur. The alarm log is saved as an ASCII text file.(Ú.ÈòÉN j€µ€VˆˆÈ:„H€ƒ€€€€€€€€‚ƒ‚ƒ€€‚ÿ1.From the Configuration menu, choose Alarms. Choose Log File Settings from the Alarms menu.2.From the Log File Settings dialog box, enter the complete path name of the log file.3.Click the OK button.*ÊÈÊ' €€ˆˆ‚€‚ÿHòÉdÊ1¼  ÿÿÿÿÕdÊ¥Ê0ÌClear Alarm Log DisplayAÊ¥Ê' €4€ ˆ‚€‚ÿClear Alarm Log Display£|dÊHË' €ø€ˆˆ‚€‚ÿYou can clear the display of alarms in the Message window. Clearing the display does not delete alarms from the log file.¾Ž¥ÊÌ0 .€€VˆˆÈ:„H€ƒ‚ƒ‚ƒ‚ÿ1.Select (single-click) any message or alarm in the Message window.2.Click the Right Mouse Button.3.Select the Clear Alarm Log option.*HË0Ì' €€ˆˆ‚€‚ÿ6ÌfÌ1ÃÿÿÿÿÿÿÿÿÖfÌbÏ×CIndex2 0̘Ì' €€ ˆ‚€‚ÿGlossaryʘfÌbÏ2 2„c€ˆˆ‚〉€‚‚€‚ÿDefined StreamDetail View Device Display Filter Window DRAM Drop Events Counter Duplicate Network Address EELSE StatementELSE IF StatementExpert ViewExpert Alarms Expert Diagnosis Expert Symptoms Explorer F *Âí ö ºU€ˆˆ‚âÌ€‰€‚âûÁ3€‰€‚âAd)€‰€‚âyj¥€‰€‚â¹6 €‰€‚â∉€‚â`‰õ€‰€‚⮲ր‰€‚€‚‚â"SÚ€‰€‚âGÍ€‰€‚â! ¼€‰€‚€‚‚âbú_1€‰€‚â´€‰€‚€‚‚âìó-选€‚â08õ…€‰€‚ÿFast EthernetFilter ElementFragments CounterFrameFrame Copy Counter Frame RateFrequency Counter Frozen Window GGigabit Analysis Module (GAM) GoToGood FramesHHex PaneHost IIF Action StatementInternal Error Counter #Í õ ¸G€ˆˆ‚€‚‚â¶&b€‰€‚â×<Ñ2€‰€‚â4ØZ €‰€‚â*Ûmဉ€%€‚â¾äo €‰€‚âø°+ñ€‰€‚âΑP{€‰€%€‚â‡åy¼€‰€%€‚â s†€‰€‚âz´ê|€‰€‚âK8ü€‰€‚âŸ}¿—€‰€‚âþ­Ä€‰€‚â†ÿ,^€‰€‚â»õð€‰€‚ÿJ K L MJabbers CounterLine Error CounterLink Speed Local Host Log Files Lost Frame CounterMessage Window Mode of Operation ModuleModule SpeedModule StatusModule TypeMonitorMonitor ModeMonitor and Capture Mode $&í )þ ÊM€ˆˆ‚âÅK`߀‰€‚€‚‚â@1#à€‰€‚âú$€‰€‚â¦)瀉€‚ââÕR€‰€‚âÝ€‰€‚‚€‚âŒÊe€‰€‚âö®«@€‰€‚⸠ô€‰€‚âÛJƒ€‰€‚âyd÷€‰€‚âáëbh€‰€‚âÉ=™€‰€‚â2+Ì€‰€‚â½p™€‰€‚âT–]7€‰€‚ÿMulti-QoS NName TableNDIS NetworkNetwork Adapter NIS O POversize CounterOverview Table PacketPacket Detail Pane Packets Dropped Counter Packet Editor Packet GapPacket SizePacket Summary Packet Summary Pane  B@÷ ¼-€ˆˆ‚â§ÓÍ€‰€‚⛀‰€%€‚âŸö%°€‰€‚â4i•V€‰€‚€‚‚âUèÅò€‰€‚âÿ€‚âZ*Æé€‰€%€‚ââÒúa€‰€‚â~⊀‰€‚âõ›´Ê€‰€‚âõ›´Ê€‰€‚€‚‚âò€‰€‚â Õ.:€‰€‚âzP±€‰€‚â„;Ï€‰€‚ÿPacket TypePause Post Trigger Buffer PositionProtocol Q RReal-Time Buffer Remote Host Resource Resource BrowserRoot StatementRemote Server Protocol (RSP) RSP S)B@0ÌSA StreamStart Sequence NumberState >)bBâ ’}€ˆˆ‚âjÀïÉ€‰€‚â«!€‰€‚â_Tþ¨€‰€‚âÚè‘€‰€‚‚€‚â2±5€‰€%€‚âôJ €‰€‚â ¦Å,€‰€‚â`)Øí€‰€‚â)gª)€‰€‚â*°?«€‰€‚â`Ñ8€‰€‚â,–Tz€‰€‚âEÛ°€‰€‚âKÚu€‚ÿStop Sequence NumberSummary PaneSummary View Synchronized Resource TThroughput Token Error Counter Total Tx Collision CounterTraffic RateTrafficTransmit SpecificationTransmit ModeTx Attempt CounterTx Defer CounterTx Excessive Collision CounteruÏB@×C¦ Ÿ€ˆˆ‚â'cµ€‰€‚â”0É€‰€‚€‚‚âŒmVØ€‰€‚âÒ.€‰€%€‚â¬Â¹„€‰€‚â‹Ï€‰€‚âh+N€‰€‚‚€‚âX€‰€‚âîâT}€‰€‚ÿTx Excessive Defer CounterTx Late Collision Counter U VUndersize CounterView Very Long Event CounterVoyager Voice over IP (VoIP) W X Y ZWKP Zero Window ?bBD1Çÿÿÿÿÿÿÿÿ×ÿÿÿÿDžD.CAP extension8×CND' €"€˜ˆ‚€‚ÿ.CAP extensionP)DžD' €R€ˆˆ‚€‚ÿFile extension for all capture files. ?NDÝD1ÉÿÿÿÿÿÿÿÿØÿÿÿÿÝDgE.CFD extension8žDE' €"€˜ˆ‚€‚ÿ.CFD extensionR+ÝDgE' €V€ˆˆ‚€‚ÿFile extension for all capture filters. ?E¦E1ÆÿÿÿÿÿÿÿÿÙÿÿÿÿ¦E-F.DFD extension8gEÞE' €"€˜ˆ‚€‚ÿ.DFD extensionO(¦E-F' €P€ˆˆ‚€‚ÿFile extension for all view filters. ?ÞElF1ÄÿÿÿÿÿÿÿÿÚÿÿÿÿlFñF.NAM extension8-F¤F' €"€˜ˆ‚€‚ÿ.NAM extensionM&lFñF' €L€ˆˆ‚€‚ÿFile extension for all name tables.?¤F0G1ÐÿÿÿÿÿÿÿÿÛÿÿÿÿ0GÁG.TSP extension8ñFhG' €"€˜ˆ‚€‚ÿ.TSP extensionY20GÁG' €d€ˆˆ‚€‚ÿFile extension for all transmit specifications.: hGûG1êÿÿÿÿÿÿÿÿÜÿÿÿÿûG«HStatement1 ÁG,H' €€˜ˆ‚€‚ÿActionsXûG«H' €°€ˆˆ‚€‚ÿEvents that occur as the result of testing conditions within statements in a filter. A,HìH11ÿÿÿÿÿÿÿÿÝÿÿÿÿìHÜIActivated Stream:«H&I' €&€˜ˆ‚€‚ÿActivated Stream¶ŽìHÜI( €€ˆˆ‚€‚ÿA defined packet or set of packets that is included in a transmit specification. Activated streams are loaded to a module for transmission.8&IJ1ìÿÿÿÿÿÿÿÿÞÿÿÿÿJÈJAddress1 ÜIEJ' €€˜ˆ‚€‚ÿAddressƒ\JÈJ' €¸€ˆˆ‚€‚ÿA character or group of characters that identifies some other data source or destination.6EJþJ1øÿÿÿÿÿÿÿÿßÿÿÿÿþJÀKAlarm/ÈJ-K' €€˜ˆ‚€‚ÿAlarm“lþJÀK' €Ø€ˆˆ‚€‚ÿA message posted to Surveyor indicating a certain condition has occurred or a threshold has been reached.> -KþK1ÎÿÿÿÿÿÿÿÿàÿÿÿÿþKŽLAlarm Browser7ÀK5L' € €˜ˆ‚€‚ÿAlarm BrowserY2þKŽL' €d€ˆˆ‚€‚ÿA window used to list, select, and set alarms. F5LÔL1UÿÿÿÿÿÿÿÿáÿÿÿÿÔLãMAlarm Generation Type?ŽLM' €0€˜ˆ‚€‚ÿAlarm Generation TypeШÔLãM( €Q€ˆˆ‚€‚ÿIs this a rising, falling or "rising or falling" type of alarm. Used at the time of comparing the sampled value against a corresponding rising or falling threshold.HM+N1,ÿÿÿÿÿÿÿÿâÿÿÿÿ+NOAlarm Notification Type8ãMcN' €"€˜ˆ‚€‚ÿAlarm Severity¬„+NO( € €ˆˆ‚€‚ÿType of notification to be posted to the Message window upon alarm trigger. Valid types are informational, warning, and serious.?cNNO1ãÿÿÿÿÿÿÿÿãÿÿÿÿNO €Alarm Interval8O†O' €"€˜ˆ‚€‚ÿAlarm IntervallENO €' €Š€ˆˆ‚€‚ÿThe interval, in seconds, over which data is sampled and compared.†O €O: †OF€1ÓÿÿÿÿÿÿÿÿäÿÿÿÿF€߀Alarm Log3 €y€' €€˜ˆ‚€‚ÿAlarm Logf?F€߀' €~€ˆˆ‚€‚ÿA list of all alarms triggered by incoming data to Surveyor.Hy€'1Uÿÿÿÿÿÿÿÿåÿÿÿÿ'4‚Alarm Falling ThresholdA߀h' €4€˜ˆ‚€‚ÿAlarm Falling Threshold̤'4‚( €I€ˆˆ‚€‚ÿFalling threshold value to be compared to counter data. If the counter value or its delta value over time falls below the threshold, an alarm event is triggered.Gh{‚1Uÿÿÿÿÿÿÿÿæÿÿÿÿ{‚‰ƒAlarm Rising Threshold@4‚»‚' €2€˜ˆ‚€‚ÿAlarm Rising ThresholdΦ{‚‰ƒ( €M€ˆˆ‚€‚ÿRising threshold value to be compared to counter data. . If the counter value or its delta value over time raises above the threshold, an alarm event is triggered.B»‚˃1Pÿÿÿÿÿÿÿÿçÿÿÿÿ˃Ù„Alarm Sample Type;‰ƒ„' €(€˜ˆ‚€‚ÿAlarm Sample Typeӫ˃Ù„( €W€ˆˆ‚€‚ÿThe type of the alarm, Delta or Absolute. Delta alarm types measure increases or decreases over time; absolute alarm types measure only the absolute value of a counter.> „…1ÿÿÿÿÿÿÿÿèÿÿÿÿ…Ù…Alarm Setting8Ù„O…' €"€˜ˆ‚€‚ÿ Alarm SettingŠc…Ù…' €Æ€ˆˆ‚€‚ÿA set of conditions that when satisfied will cause Surveyor to record an entry in the alarm log.< O…†1Ðÿÿÿÿÿÿÿÿéÿÿÿÿ†©†Alarm Value5Ù…J†' €€˜ˆ‚€‚ÿAlarm Value_8†©†' €p€ˆˆ‚€‚ÿThe Alarm variable value from the last sample period.PJ†ù†1Çÿÿÿÿÿÿÿÿêÿÿÿÿù†pˆCRC and Alignment Error CounterI"©†B‡' €D€˜ˆ‚€‚ÿCRC and Alignment Error Counter.ù†pˆ( € €ˆˆ‚€‚ÿA counter that shows the total number of packets received that had a length between 64 and 1518 octets, inclusive, but had either a bad FCS with an integral number of octets (FCS/CRC Error) or a bad FCS with a non-integral number of octets (Alignment Error).= B‡­ˆ1ûÿÿÿÿÿÿÿÿëÿÿÿÿ­ˆk‰Base Address6pˆãˆ' €€˜ˆ‚€‚ÿBase Addressˆa­ˆk‰' €Â€ˆˆ‚€‚ÿThe address of the Century Media Module or other resource within the PC system's low memory.6㈡‰1êÿÿÿÿÿÿÿÿìÿÿÿÿ¡‰UŠBurst/k‰Љ' €€˜ˆ‚€‚ÿBurst…^¡‰UŠ' €¼€ˆˆ‚€‚ÿFor transmission from Surveyor, a flood of frames sent at the maximum speed of the network.: ЉŠ18ÿÿÿÿÿÿÿÿíÿÿÿÿŠ‹burst gap3 UŠŠ' €€˜ˆ‚€‚ÿBurst GapË£Š‹( €G€ˆˆ‚€‚ÿFor transmission from Surveyor, a pause between a set of packets sent at the maximum network speed and another set of packets sent at the maximum network speed.8ŠÅ‹1÷ÿÿÿÿÿÿÿÿîÿÿÿÿÅ‹„ŒCapture1 ‹ö‹' €€˜ˆ‚€‚ÿCaptureŽgÅ‹„Œ' €Î€ˆˆ‚€‚ÿThe processing of receiving frames from the network and storing them in the Surveyor capture buffer.?ö‹ÃŒ1jÿÿÿÿÿÿÿÿïÿÿÿÿÃŒîCapture Buffer8„ŒûŒ' €"€˜ˆ‚€‚ÿCapture BufferóËÃŒî( €—€ˆˆ‚€‚ÿThe DRAM memory in Century Media Module (or in an NDIS host) that stores packets captured from the network. The CMM2 buffer size can be 32Mb or 64Mb depending on the Century Media Module model in use.@ûŒ.Ž1Òÿÿÿÿÿÿÿÿðÿÿÿÿ.ŽÀŽCaptured Frames9îgŽ' €$€˜ˆ‚€‚ÿCaptured FramesY2.ŽÀŽ' €d€ˆˆ‚€‚ÿFrames stored within Surveyor's capture buffer.= gŽýŽ1ÀÿÿÿÿÿÿÿÿñÿÿÿÿýŽkÀCapture File6ÀŽ3' €€˜ˆ‚€‚ÿCapture File,ýŽkÀ( € €ˆˆ‚€‚ÿFile used to store frames captured from the network. A capture file must be given a name with an extension of .CAP. Captured frames are not automatically stored in3kÀÀŽ a file - the contents of the capture buffer must be saved using the Save or Save As options.?3ªÀ1“ÿÿÿÿÿÿÿÿòÿÿÿÿªÀþÁCapture Filter8kÀâÀ' €"€˜ˆ‚€‚ÿCapture FilterôªÀþÁ( €é€ˆˆ‚€‚ÿA set of conditions that determine the frames to be captured and how the captured frames are counted. The capture filter consists of programming-like statements that set variables and specify conditions and actions for the capture of frames.= âÀ;Â1øÿÿÿÿÿÿÿÿóÿÿÿÿ;ÂöÂCapture View6þÁqÂ' €€˜ˆ‚€‚ÿCapture View…^;ÂöÂ' €¼€ˆˆ‚€‚ÿA window for viewing and decoding network packets saved to a file or in the capture buffer.= qÂ3Ã1ôÿÿÿÿÿÿÿÿôÿÿÿÿ3ÃêÃCapture Mode7öÂjÃ' € €˜ˆ‚€‚ÿ Capture Mode€Y3ÃêÃ' €²€ˆˆ‚€‚ÿThe mode in which Surveyor receives network data and stores it in the Capture Buffer. NjÃ8Ä1:ÿÿÿÿÿÿÿÿõÿÿÿÿ8Ä$ÆGigabit Analysis Module (GAM)G êÃÄ' €@€˜ˆ‚€‚ÿGigabit Analysis Module (GAM)¥}8Ä$Æ( €û€ˆˆ‚€‚ÿThe Gigabit Analysis Module (GAM) is a hardware analyzer card that installs in a PC or in an Explorer hardware device. GAM provides data capture and transmit for fiber optic networks at one gigabit per second. The GAM card is for use with 1000BASE-SX or 1000BASE-LX networks only. The network interface for GAM is a removable single mode or multi-mode G-BIC interface connector.NÄrÆ1OÿÿÿÿÿÿÿÿöÿÿÿÿrÆsÇCentury Media Module 2 (CMM2)G $ƹÆ' €@€˜ˆ‚€‚ÿCentury Media Module 2 (CMM2)º’rÆsÇ( €%€ˆˆ‚€‚ÿA hardware device available from Shomiti that allows the capture of network data at full line rate and supports real time monitoring functions.?¹Æ²Ç1©ÿÿÿÿÿÿÿÿ÷ÿÿÿÿ²ÇÉCentury 12-Tap8sÇêÇ' €"€˜ˆ‚€‚ÿCentury 12-Tap2 ²ÇÉ( €€ˆˆ‚€‚ÿA fault-tolerant wiring device, available from Shomiti, that can be inserted into twelve, full-duplex or half-duplex, 10 or 100 Mbps Ethernet links. Century 12-Tap provides the ability to view up to twelve full-duplex segments from a single Surveyor installation.3êÇOÉ1ÑÿÿÿÿÿÿÿÿøÿÿÿÿOÉíÉDA,É{É' € €˜ˆ‚€‚ÿDArKOÉíÉ' €–€ˆˆ‚€‚ÿDestination address. MAC level station address of where a frame is sent.C{É0Ê1Kÿÿÿÿÿÿÿÿùÿÿÿÿ0Ê8ËDeactivated Stream<íÉlÊ' €*€˜ˆ‚€‚ÿDeactivated Stream̤0Ê8Ë( €I€ˆˆ‚€‚ÿA defined packet or set of packets defined in a transmit specification but not currently active. Deactivated streams are NOT loaded to a module for transmission.?lÊwË1*ÿÿÿÿÿÿÿÿúÿÿÿÿwËbÌDefined Stream88˯Ë' €"€˜ˆ‚€‚ÿDefined Stream³‹wËbÌ( €€ˆˆ‚€‚ÿIn transmission mode, a sequence of bytes you specify for transmission on the network. Multiple streams can be defined for transmission.< ¯ËžÌ1ÿÿÿÿÿÿÿÿûÿÿÿÿžÌwÍDetail View5bÌÓÌ' €€˜ˆ‚€‚ÿDetail View¤}žÌwÍ' €ú€ˆˆ‚€‚ÿThe primary monitoring view for a single network resource. Multiple views of each resource can display in the Detail View.7ÓÌ®Í1Éÿÿÿÿÿÿÿÿüÿÿÿÿ®Í@ÎDevice0 wÍÞÍ' €€˜ˆ‚€‚ÿDeviceb;®Í@Î' €v€ˆˆ‚€‚ÿA single hardware device that provides data to Surveyor.FÞ͆Î1Õÿÿÿÿÿÿÿÿýÿÿÿÿ†ÎÏDisplay Filter Window?@ÎÅÎ' €0€˜ˆ‚€‚ÿDisplay Filter WindowP)†ÎÏ' €R€ˆˆ‚€‚ÿA window for defining display filters.5ÅÎJÏ1ªÿÿÿÿÿÿÿÿþÿÿÿÿJÏ¿ÏDRAM.ÏxÏ' €€˜ˆ‚€‚ÿDRAMG JÏ¿Ï' €@€ˆˆ‚€‚ÿDirect Random Access Memory. ?xÏ 1Nÿÿÿÿÿÿÿÿÿÿÿÿÿ ELSE statement¿Ï ¿Ï8¿ÏD' €"€˜ˆ‚€‚ÿELSE Statementׯ ( €_€ˆˆ‚€‚ÿThe last statement for a level in a capture filter. If no combination of conditions in other statements for this level are met, the actions in the ELSE statement are taken.BD]1_ÿÿÿÿÿÿÿÿÿÿÿÿ]zELSE IF statement;˜' €(€˜ˆ‚€‚ÿELSE IF Statementâº]z( €u€ˆˆ‚€‚ÿStatement in a capture or display filter. Always comes between an IF statement and an ELSE statement. Provides for the specification of additional conditions and actions for a state. > ˜¸1Šÿÿÿÿÿÿÿÿÿÿÿÿ¸Expert Alarms7zï' € €˜ˆ‚€‚ÿExpert Alarmsí¸( €Û€ˆˆ‚€‚ÿMessages posted to Surveyor indicating a certain condition has occurred or a threshold has been reached. Expert alarms are based on a set of counters related to Expert Symptoms or to other conditions that can signal a network problem.AïE1ÿÿÿÿÿÿÿÿÿÿÿÿEExpert Diagnosis:' €&€˜ˆ‚€‚ÿExpert DiagnosisˆaE' €Â€ˆˆ‚€‚ÿDiscussion of probable causes and possible solutions for Expert Symptoms detected by Surveyor.?F1CÿÿÿÿÿÿÿÿÿÿÿÿFJExpert Symptom8~' €"€˜ˆ‚€‚ÿExpert SymptomÌžFJ. *€=€ˆˆ‚€€&€‚ÿA network condition that may indicate a network problem. Expert symptoms are detected by Surveyor’s expert logic and logged in the Expert Analysis table.9~ƒ1ªÿÿÿÿÿÿÿÿÿÿÿÿƒôExplorer3 J¶' €€˜ˆ‚€‚ÿ Explorer>ƒô( €-€ˆˆ‚€‚ÿA Shomiti network monitoring, analyzing, or and troubleshooting system available for 10/100/1000 Mbps Ethernet segments. Explorer provides full line-rate capture and transmission for all full or half-duplex Ethernet connections. Explorer can by accessed remotely by Surveyor.> ¶21ÿÿÿÿÿÿÿÿÿÿÿÿ2ôFast Ethernet7ôi' € €˜ˆ‚€‚ÿFast Ethernet‹d2ô' €È€ˆˆ‚€‚ÿIEEE 802.3 compliant MII (Media Independent Interface) network. Capable of speeds up to 100 Mbps.?i3 1nÿÿÿÿÿÿÿÿÿÿÿÿ3 b Filter Element8ôk ' €"€˜ˆ‚€‚ÿFilter Element÷Â3 b 5 8€…€ˆˆ‚€‚€&€€&€‚ÿA value or template for setting conditions in a capture filter. Filter elements are assigned a name which corresponds to an offset and length within a packet. The filter element usually has a specific hex value assigned to it as well. Filter elements are selected when building a filter combination in an IF or ELSE IF statement. Surveyor provides filter element templates which can be used “as is” or you can define your own filter elements.6k ˜ 1!ÿÿÿÿÿÿÿÿÿÿÿÿ˜ ƒ Frame/b Ç ' €€˜ˆ‚€‚ÿFrame¼”˜ ƒ ( €)€ˆˆ‚€‚ÿSequence of contiguous bits bracketed by and including beginning and ending flag sequences. A recognizable sequence of bits within a data stream.; Ç ¾ 1Ûÿÿÿÿÿÿÿÿÿÿÿÿ¾ ^ Frame Rate4 ƒ ò ' €€˜ˆ‚€‚ÿFrame RatelE¾ ^ ' €Š€ˆˆ‚€‚ÿThe speed at which frames are received/transmitted on the network.5ò “ 1¦ÿÿÿÿÿÿÿÿ ÿÿÿÿ“ GoTo.^ Á ' €€˜ˆ‚€‚ÿGoToC“ ( €7€ˆˆ‚€‚ÿIn the Filter window, "GoTo" shows jumps to levels within the capture filter. Selecting a level other than the current level in the action portion of a statement dialog box creates a GoTo phrase in the Filter window. The object of the GoTo phrase is always a state in the filter.< Á @1äÿÿÿÿÿÿÿÿ ÿÿÿÿ@ @Good Frames5u' €€˜ˆ‚€‚ÿGood FramessL@ @' €˜€ˆˆ‚€‚ÿFrames that pass all alignment and CRC checks are counted as good frames.u @9uE@1ÿÿÿÿÿÿÿÿ ÿÿÿÿE@AHex Pane2 @w@' €€˜ˆ‚€‚ÿHex Pane¢{E@A' €ö€ˆˆ‚€‚ÿPortion of the Capture View window that displays the hex values of a packet stored in a capture file or capture buffer.5w@NA11ÿÿÿÿÿÿÿÿ ÿÿÿÿNAJBHost.A|A' €€˜ˆ‚€‚ÿHostΦNAJB( €M€ˆˆ‚€‚ÿA computer upon which a particular program or resource is located. In the context of Surveyor, the host is the computer upon which the Surveyor program is running.; |A…B1 ÿÿÿÿÿÿÿÿ ÿÿÿÿ…BSCLink Speed4 JB¹B' €€˜ˆ‚€‚ÿLink Speedšs…BSC' €æ€ˆˆ‚€‚ÿThe maximum rate at which a device can transmit/receive data on the network, typically described in bits/second.; ¹BŽC1ÚÿÿÿÿÿÿÿÿÿÿÿÿŽC-ELocal Host4 SCÂC' €€˜ˆ‚€‚ÿLocal HostkCŽC-E( €‡€ˆˆ‚€‚ÿA networked computer that is running the program or resource being described. In the context of Surveyor, a local host is the computer that is (1) running the Surveyor program under discussion and (2) located on a network where at least one other computer (remote host) is also running a copy of the Surveyor program. 7ÂCdE1bÿÿÿÿÿÿÿÿÿÿÿÿdEFModule0 -E”E' €€˜ˆ‚€‚ÿModuleûÓdEF( €§€ˆˆ‚€‚ÿA hardware device attached to the network that can be used by Surveyor software to perform LAN analysis and monitoring functions. Surveyor can use network interface cards and Century Media Modules as modules.?”EÎF1ðÿÿÿÿÿÿÿÿÿÿÿÿÎFGMessage Window8FG' €"€˜ˆ‚€‚ÿMessage WindowyRÎFG' €¤€ˆˆ‚€‚ÿA window that displays all alarm, log, and error messages received by Surveyor.BGÁG1ºÿÿÿÿÿÿÿÿÿÿÿÿÁG9IMode of Operation<GýG' €*€˜ˆ‚€‚ÿ Mode of Operation<ÁG9I( €)€ˆˆ‚€‚ÿDefines the current relationship between Surveyor and a resource. Surveyor can transmit data from a resource (transmit), receive data from a resource (capture), view data from a resource (monitor), or view and receive data from a resource simultaneously (monitor + capture)= ýGvI1 ÿÿÿÿÿÿÿÿÿÿÿÿvICJModule Speed69I¬I' €€˜ˆ‚€‚ÿModule Speed—pvICJ' €à€ˆˆ‚€‚ÿThe rate at which Surveyor will capture/transmit packets on the network. The speed is either 10 or 100 Mbps. > ¬IJ1+ÿÿÿÿÿÿÿÿÿÿÿÿJnKModule Status7CJ¸J' € €˜ˆ‚€‚ÿModule Status¶ŽJnK( €€ˆˆ‚€‚ÿIndicates whether or not the module is actively capturing/transmitting frames. Started indicates that the module is capturing/transmitting.< ¸JªK1èÿÿÿÿÿÿÿÿÿÿÿÿªKVLModule Type5nKßK' €€˜ˆ‚€‚ÿModule TypewPªKVL' € €ˆˆ‚€‚ÿIndicates the analyzer card model. Currently, two models exist, GAM and CMM2.8ßKŽL1¾ÿÿÿÿÿÿÿÿÿÿÿÿŽLMMonitor2 VLÀL' €€˜ˆ‚€‚ÿ MonitorT-ŽLM' €Z€ˆˆ‚€‚ÿView activity on the network in real time.= ÀLQM1áÿÿÿÿÿÿÿÿÿÿÿÿQMõMMonitor Mode7MˆM' € €˜ˆ‚€‚ÿ Monitor ModemFQMõM' €Œ€ˆˆ‚€‚ÿAllows Surveyor to view in real time the data coming to a resource.IˆM>N1þÿÿÿÿÿÿÿÿÿÿÿÿ>NóNMonitor and Capture ModeCõMN' €8€˜ˆ‚€‚ÿ Monitor and Capture ModerK>NóN' €–€ˆˆ‚€‚ÿAllows Surveyor to view and receive data from a resource simultaneously.; N.O1(ÿÿÿÿÿÿÿÿÿÿÿÿ.O'€Name Table4 óNbO' €€˜ˆ‚€‚ÿName Table¹‘.O'€( €#€ˆˆ‚€‚ÿTable containing name and address associations for stations on the network. The address can be in the format of the bO'€óNMAC, IP, or IPX protocol.8bO_€1´ÿÿÿÿÿÿÿÿÿÿÿÿ_€Û€Network1 '€€' €€˜ˆ‚€‚ÿNetworkK$_€Û€' €H€ˆˆ‚€‚ÿAn interconnected group of nodes.= €1žÿÿÿÿÿÿÿÿÿÿÿÿy‚IF statement6Û€N' €€˜ˆ‚€‚ÿIF Statement+y‚* "€€ˆˆ‚€‚‚‚ÿFirst statement for a level in a filter. Specifies conditions and actions. Use the IF statement dialog box to:(1) create a condition filter comprised of filter elements and operators (2) specify the actions to take if the condition filter is satisfied.7N°‚1‚ÿÿÿÿÿÿÿÿÿÿÿÿ°‚ûƒPacket0 y‚à‚' €€˜ˆ‚€‚ÿPacketó°‚ûƒ( €ç€ˆˆ‚€‚ÿA sequence of digits including data and control signals that is switched as a composite whole. Data, control signals, and error control information are arranged in a specific format. For Surveyor, packet and frame are used interchangeably.Cà‚>„1}ÿÿÿÿÿÿÿÿÿÿÿÿ>„x…Packet Detail Pane<ûƒz„' €*€˜ˆ‚€‚ÿPacket Detail PaneþÖ>„x…( €­€ˆˆ‚€‚ÿA portion of the Capture View window that displays the detailed breakdown of a packet that is stored in a capture file or capture buffer. Packets are broken down by protocol and field value within the protocol.Dz„¼…1¤ÿÿÿÿÿÿÿÿÿÿÿÿ¼…‡Drop Events Counter=x…ù…' €,€˜ˆ‚€‚ÿDrop Events Counter#û¼…‡( €÷€ˆˆ‚€‚ÿA counter that shows the total number of events in which packets were dropped by the probe due to lack of resources. Note that this number is not necessarily the number of packets dropped; it is just the number of times this condition was detected.> ù…Z‡1éÿÿÿÿÿÿÿÿÿÿÿÿZ‡ˆPacket Editor7‡‘‡' € €˜ˆ‚€‚ÿPacket EditortMZ‡ˆ' €š€ˆˆ‚€‚ÿA dialog box available from Capture View for changing or creating packets.; ‘‡@ˆ1ðÿÿÿÿÿÿÿÿÿÿÿÿ@ˆõˆPacket Gap4 ˆtˆ' €€˜ˆ‚€‚ÿPacket GapZ@ˆõˆ' €´€ˆˆ‚€‚ÿTime interval between packets. A packet gap can be specified when transmitting packets.< tˆ1‰1ÿÿÿÿÿÿÿÿ ÿÿÿÿ1‰ú‰Packet Size5õˆf‰' €€˜ˆ‚€‚ÿPacket Size”m1‰ú‰' €Ú€ˆˆ‚€‚ÿThe size of a packet sent during transmission mode. Any packet size up to 15,000 bytes can be transmitted.?f‰9Š1Áÿÿÿÿÿÿÿÿ!ÿÿÿÿ9Š»ŠPacket Summary8ú‰qŠ' €"€˜ˆ‚€‚ÿPacket SummaryJ#9Š»Š' €F€ˆˆ‚€‚ÿReal time packet decode summary.DqŠÿŠ1ÿÿÿÿÿÿÿÿ"ÿÿÿÿÿŠ΋Packet Summary Pane=»Š<‹' €,€˜ˆ‚€‚ÿPacket Summary Pane’kÿŠ΋' €Ö€ˆˆ‚€‚ÿIn Capture View, the top portion of the window that provides a summary view of all the captured packets.< <‹ Œ1]ÿÿÿÿÿÿÿÿ#ÿÿÿÿ Œ+Packet Type5΋?Œ' €€˜ˆ‚€‚ÿPacket TypeìÄ Œ+( €‰€ˆˆ‚€‚ÿThe type of packet sent in transmission mode. Packet types are IP, IPX, ARP, and AARP, or any other type specified by the user. It can also be the packet length field for 802.2 and SNAP frames.6?Œa1Òÿÿÿÿÿÿÿÿ$ÿÿÿÿaýPause1 +’' €€˜ˆ‚€‚ÿ PausekDaý' €ˆ€ˆˆ‚€‚ÿStop the continuous update of the data when viewing any resource.F’CŽ1«ÿÿÿÿÿÿÿÿ%ÿÿÿÿCލPost Trigger PositionFý‰Ž' €>€˜ˆ‚€‚ÿPost Trigger Buffer Position÷Cލ( €ï€ˆˆ‚€‚ÿPercentage of the capture buffer used to store frames after the module is triggered. For example, if the post trigger buffer position is set to 50% for a module with 4MB of memory, frames will be captured until 2MB of the module memory is full.9‰Žá1Xÿÿÿÿÿÿÿÿ&ÿÿÿÿá±ÀProtocol2 ¨À' €€˜áÀ¨ˆ‚€‚ÿProtocol’ká±À' €Ö€ˆˆ‚€‚ÿSet of rules, format, and timing governing the operation of functional units of a communications system.AÀòÀ1ƒÿÿÿÿÿÿÿÿ'ÿÿÿÿòÀ4ÂReal-Time Buffer:±À,Á' €&€˜ˆ‚€‚ÿReal-Time BufferàòÀ4Â( €Á€ˆˆ‚€‚ÿBuffer used in Century Media Modules V2 to store data received from the network. This circular buffer is continuously updated and overwritten as information is received. The Real-Time buffer supports monitoring functions.9,ÁmÂ1Iÿÿÿÿÿÿÿÿ(ÿÿÿÿmÂ}ÃResource3 4 Â' €€˜ˆ‚€‚ÿ ResourceݵmÂ}Ã( €k€ˆˆ‚€‚ÿAny source that provides data to Surveyor. This can be a Century Media Module, an Ethernet Adapter, multiple devices synchronized to provide a single data stream, or a data file.A Â¾Ã1$ÿÿÿÿÿÿÿÿ)ÿÿÿÿ¾Ã¡ÄResource Browser:}ÃøÃ' €&€˜ˆ‚€‚ÿResource Browser©¾Ã¡Ä( €€ˆˆ‚€‚ÿThe resource browser is a single window through which you can access all local and remote resources available in the network. < øÃÝÄ1­ÿÿÿÿÿÿÿÿ*ÿÿÿÿÝÄNÆRemote Host5¡ÄÅ' €€˜ˆ‚€‚ÿRemote Host<ÝÄNÆ( €)€ˆˆ‚€‚ÿA remote, networked computer that is running the particular program or resource that is being described. In the context of Surveyor discussions, a remote host is a networked computer, other than the local Surveyor host, that is also running a copy of the Surveyor program.MÅ›Æ1ìÿÿÿÿÿÿÿÿ+ÿÿÿÿ›Æ:ÈRemote Server Protocol (RSP)G NÆâÆ' €@€˜ˆ‚€‚ÿ Remote Server Protocol (RSP)X0›Æ:È( €a€ˆˆ‚€‚ÿRemote Server Protocol is the Shomiti proprietary protocol based on TCP/IP to transfer data or commands for Surveyor between the local station and the remote host. You can encrypt packets passed back and forth between the local station and the remote host when using RSP to transfer data and commands.?âÆyÈ1úÿÿÿÿÿÿÿÿ,ÿÿÿÿyÈ4ÉROOT Statement8:ȱÈ' €"€˜ˆ‚€‚ÿRoot Statementƒ\yÈ4É' €¸€ˆˆ‚€‚ÿThe first statement in all capture filters. Specifies global variables and global values.B±ÈvÉ1ÿÿÿÿÿÿÿÿ-ÿÿÿÿvÉQÊCollision Counter>4É´É' €.€˜ˆ‚€‚ÿCollision IndicationvvÉQÊ' €ì€ˆˆ‚€‚ÿThis counter is the sum of alignment errors and fragment errors, both of which are typically caused by a collision.@´É‘Ê1@ÿÿÿÿÿÿÿÿ.ÿÿÿÿ‘Ê‘ËJabbers Counter9QÊÊÊ' €$€˜ˆ‚€‚ÿJabbers CounterÇŸ‘Ê‘Ë( €?€ˆˆ‚€‚ÿA counter that shows the total number of packets that were received that were longer than 1518 octets and had either an FCS/CRC error or an Alignment Error.AÊÊÒË1-ÿÿÿÿÿÿÿÿ/ÿÿÿÿÒ˾ÌOversize Counter:‘Ë Ì' €&€˜ˆ‚€‚ÿOversize Counter²ŠÒ˾Ì( €€ˆˆ‚€‚ÿA counter showing the total number of packets received that were longer than the 1518 octets and were otherwise well formed (good FCS).B ÌÍ13ÿÿÿÿÿÿÿÿ0ÿÿÿÿÍñÍFragments Counter;¾Ì;Í' €(€˜ˆ‚€‚ÿFragments Counter¶ŽÍñÍ( €€ˆˆ‚€‚ÿA counter showing the total number of packets received that were less than 64 octets and had either an FCS/CRC error or an Alignment Error.3;Í$Î1Óÿÿÿÿÿÿÿÿ1ÿÿÿÿ$ÎÄÎSA,ñÍPÎ' € €˜ˆ‚€‚ÿSAtM$ÎÄÎ' €š€ˆˆ‚€‚ÿSource address. MAC level station address of where a frame is coming from.BPÎÏ11ÿÿÿÿÿÿÿÿ2ÿÿÿÿÏ Undersize Counter;ÄÎAÏ' €(€˜ˆ‚€‚ÿUndersize Counter´ŒÏ ( €€ˆˆ‚€‚ÿA counter showing the total number of packets received that were less than 64 octets in length and were otherwise well-formed (good FCS).AÏ ÄÎ7AÏC1ßÿÿÿÿÿÿÿÿ3ÿÿÿÿCåStream0 s' €€˜ˆ‚€‚ÿStreamrKCå' €–€ˆˆ‚€‚ÿA continuous sequence of data elements transmitted in a defined format. Fs+1cÿÿÿÿÿÿÿÿ4ÿÿÿÿ+HStart Sequence Number?åj' €0€˜ˆ‚€‚ÿStart Sequence NumberÞ¶+H( €m€ˆˆ‚€‚ÿA number assigned in the transmit specification that indicates where the transmission sequence starts. The number can be used at the receiving end to note the start of a sequence.6j~1Øÿÿÿÿÿÿÿÿ5ÿÿÿÿ~ State/H­' €€˜ˆ‚€‚ÿStatesL~ ' €˜€ˆˆ‚€‚ÿA symbolic label used as an address for a set of statements in a filter. E­e1^ÿÿÿÿÿÿÿÿ6ÿÿÿÿe~Stop Sequence Number> £' €.€˜ˆ‚€‚ÿStop Sequence NumberÛ³e~( €g€ˆˆ‚€‚ÿA number assigned in the transmit specification that indicates where the transmission sequence stops. The number can be used at the receiving end to note the end of a sequence.= £»1ÿÿÿÿÿÿÿÿ7ÿÿÿÿ»~Summary Pane6~ñ' €€˜ˆ‚€‚ÿSummary Panef»~' €Ì€ˆˆ‚€‚ÿIn Capture View, the top portion of the window that provides a summary of all the captured packets.= ñ»1 ÿÿÿÿÿÿÿÿ8ÿÿÿÿ»‰Summary View6~ñ' €€˜ˆ‚€‚ÿSummary View˜q»‰' €â€ˆˆ‚€‚ÿThe primary monitoring view for all network devices. One view of every device can display in the Summary View.FñÏ1ÿÿÿÿÿÿÿÿ9ÿÿÿÿÏSynchronized Resource?‰' €0€˜ˆ‚€‚ÿSynchronized ResourceZÏ' €´€ˆˆ‚€‚ÿMultiple hardware devices logically joined to provide a single data source to Surveyor.CÒ1ÿÿÿÿÿÿÿÿ:ÿÿÿÿÒ Total Tx CollisionD' €:€˜ˆ‚€‚ÿTotal Tx Collision CounterŠcÒ ' €Æ€ˆˆ‚€‚ÿA counter showing the total number of collisions that have occurred when attempting to transmit.= Ý1ÿÿÿÿÿÿÿÿ;ÿÿÿÿÝ£ Traffic Rate6  ' €€˜ˆ‚€‚ÿTraffic RateiÝ£ ' €Ò€ˆˆ‚€‚ÿWhen transmitting from Surveyor, a percentage of the maximum capacity of the network to carry packets.8 Û 1¾ÿÿÿÿÿÿÿÿ<ÿÿÿÿÛ a Traffic1 £  ' €€˜ˆ‚€‚ÿTrafficU.Û a ' €\€ˆˆ‚€‚ÿTransmitted and received frames or packets.G ¨ 1öÿÿÿÿÿÿÿÿ=ÿÿÿÿ¨ W Transmit Specification@a è ' €2€˜ˆ‚€‚ÿTransmit SpecificationoH¨ W ' €€ˆˆ‚€‚ÿA definition of packets to be transmitted on the network by Surveyor.> è • 1'ÿÿÿÿÿÿÿÿ>ÿÿÿÿ• ~ Transmit Mode7W Ì ' € €˜ˆ‚€‚ÿTransmit Mode²Š• ~ ( €€ˆˆ‚€‚ÿOne of the modes for using Surveyor. In transmit mode, data streams loaded are transmitted on the network when the resource is started.; Ì ¹ 1ãÿÿÿÿÿÿÿÿ?ÿÿÿÿ¹ a Tx Attempt<~ õ ' €*€˜ˆ‚€‚ÿTx Attempt CounterlE¹ a ' €Š€ˆˆ‚€‚ÿA counter of the number of transmission attempts that have failed.9õ š 1Hÿÿÿÿÿÿÿÿ@ÿÿÿÿš ©Tx Defer:a Ô ' €&€˜ˆ‚€‚ÿTx Defer CounterÕ­š ©( €[€ˆˆ‚€‚ÿA counter that shows the number of times the transmitter had transmit data available and was ready to transmit but had to defer transmission due to sensing other traffic.GÔ ð1ÿÿÿÿÿÿÿÿAÿÿÿÿðÅTx Excessive CollisionH!©8' €B€˜ˆ‚€‚ÿTx Excessive Collision CounterfðÅ' €Ì€ˆˆ‚€‚ÿA counter that shows the number of times packets collided 16 times without successful transmission.C8@1*ÿÿÿÿÿÿÿÿBÿÿÿÿ@ê@Tx ExcessiÅ@Åve DeferDÅX@' €:€˜ˆ‚€‚ÿTx Excessive Defer Counter’k@ê@' €Ö€ˆˆ‚€‚ÿA counter that shows the number of times the transmitter had to defer for greater than 3,036 byte times.BX@,A1$ÿÿÿÿÿÿÿÿCÿÿÿÿ,ABTx Late CollisionCê@oA' €8€˜ˆ‚€‚ÿTx Late Collision CounterŸx,AB' €ð€ˆˆ‚€‚ÿA counter that shows the number of collisions that occur greater than 512 bit times after a transmission has started.5oACB1ÌÿÿÿÿÿÿÿÿDÿÿÿÿCBÚBView/BrB' €€˜ˆ‚€‚ÿ ViewhACBÚB' €‚€ˆˆ‚€‚ÿAny one of many displays of network data provided by Surveyor.@rBC1…ÿÿÿÿÿÿÿÿEÿÿÿÿC_DVery Long EventAÚB[C' €4€˜ˆ‚€‚ÿVery Long Event CounterÜC_D( €¹€ˆˆ‚€‚ÿA counter that shows the number of times the transmitter is active for greater than a maximum event length. The maximum event length is 4ms to 7ms for 10Mbps network speeds and .4 to .75ms for 100Mbps network speeds. 4[C“D1¥ÿÿÿÿÿÿÿÿFÿÿÿÿ“DENIS-_DÀD' € €˜ˆ‚€‚ÿNISD“DE' €:€ˆˆ‚€‚ÿName Information Service. 5ÀD9E1´ÿÿÿÿÿÿÿÿGÿÿÿÿ9E¸ENDIS.EgE' €€˜ˆ‚€‚ÿNDISQ*9E¸E' €T€ˆˆ‚€‚ÿNetwork Driver Interface Specification.@gEøE1æÿÿÿÿÿÿÿÿHÿÿÿÿøEžFNetwork Adapter9¸E1F' €$€˜ˆ‚€‚ÿNetwork AdaptermFøEžF' €Œ€ˆˆ‚€‚ÿHardware board for connecting a station or node to an Ethernet LAN.: 1FØF1ÒÿÿÿÿÿÿÿÿIÿÿÿÿØFpGLog Files3 žF G' €€˜ˆ‚€‚ÿLog Filese>ØFpG' €|€ˆˆ‚€‚ÿFiles containing snapshots of Surveyor counter information.; G«G1'ÿÿÿÿÿÿÿÿJÿÿÿÿ«G—HLost Frame4 pGßG' €€˜ˆ‚€‚ÿLost Frame¸«G—H( €!€ˆˆ‚€‚ÿA counter that records events where a reporting Ring Station generates a frame to a specific address and does not receive the returned frame.; ßGÒH1ÿÿÿÿÿÿÿÿKÿÿÿÿÒH²IFrame Copy4 —HI' €€˜ˆ‚€‚ÿFrame Copy¬ÒH²I- *€þ€ˆˆ‚€€&€‚ÿA counter that records when a reporting Ring Station copies a frame containing the Ring Station’s own (duplicate) address.: IìI1ÿÿÿÿÿÿÿÿLÿÿÿÿìIÑJFrequency3 ²IJ' €€˜ˆ‚€‚ÿFrequency²ŠìIÑJ( €€ˆˆ‚€‚ÿA counter that records events where the reporting Ring Station attempts to receive a frame containing an improper ring-clock frequency.; J K1IÿÿÿÿÿÿÿÿMÿÿÿÿ KLLine Error4 ÑJ@K' €€˜ˆ‚€‚ÿLine ErrorÚ¬ KL. *€Y€ˆˆ‚€€&€‚ÿA counter that records events where the reporting Ring Station’s checksum process detects an error in a received data frame or token that the Ring Station transmitted.< @KVL1*ÿÿÿÿÿÿÿÿNÿÿÿÿVLDMBurst Error5L‹L' €€˜ˆ‚€‚ÿBurst Error¹‘VLDM( €#€ˆˆ‚€‚ÿA counter that records events where the reporting Ring Station encounters signal transition or signal error on the Token Ring physical medium 9‹L}M1ÿÿÿÿÿÿÿÿOÿÿÿÿ}MÔNAC Error2 DM¯M' €€˜ˆ‚€‚ÿAC Error%÷}MÔN. *€ï€ˆˆ‚€€&€‚ÿA counter that records events where the reporting Ring Station’s nearest active upstream neighbor could not set the address recognized bits or frame copied bits in the newly transmitted frame after copying the bits on the last frame received.@¯MO19ÿÿÿÿÿÿÿÿPÿÿÿÿO€Abort Delimiter9ÔNMO' €$€˜ˆ‚€‚ÿAbort DelimiterÀ˜O€( €1€ˆˆ‚€‚ÿA counter that records events where a reporting Ring Station encounters recoverable internal errors, forcing it to transmit an Abort DelimMO€ÔNiter frame.< MOU€1úÿÿÿÿÿÿÿÿQÿÿÿÿU€Token Error5€Š€' €€˜ˆ‚€‚ÿToken Error‰bU€' €Ä€ˆˆ‚€‚ÿA counter that records events where the Token Ring Active Monitor does not detect a ring token.?Š€R1ÿÿÿÿÿÿÿÿRÿÿÿÿR‚Internal Error8Š' €"€˜ˆ‚€‚ÿInternal Error‘jR‚' €Ô€ˆˆ‚€‚ÿA counter that records events where the reporting Ring Station encounters a recoverable internal error.; ŠV‚1ÁÿÿÿÿÿÿÿÿSÿÿÿÿV‚Ü‚CRC Errors3 ‚‰‚' €€˜ˆ‚€‚ÿCRC ErrorS,V‚Ü‚' €X€ˆˆ‚€‚ÿA Cyclical Redundancy Check (CRC) error. 8‰‚ƒ1MÿÿÿÿÿÿÿÿTÿÿÿÿƒ)…Voyager1 Ü‚Eƒ' €€˜ˆ‚€‚ÿVoyager伃)…( €y€ˆˆ‚€‚ÿA network troubleshooting and monitoring system available from Shomiti. Portable and rack mountable, Voyager is designed for field service and network operations personnel. Voyager can by accessed locally or remotely by Surveyor software and provides tools to diagnose, troubleshoot and monitor any full or half-duplex 10/100 Ethernet network. Voyager is fully RMON compliant and has ports to support auto-switching between network segments.4Eƒ]…1ÑÿÿÿÿÿÿÿÿUÿÿÿÿ]…ú…WKP-)…Š…' € €˜ˆ‚€‚ÿWKPpI]…ú…' €’€ˆˆ‚€‚ÿAbbreviation for well known port, a known port address on the network.?Š…9†1ÿÿÿÿÿÿÿÿÿVÿÿÿÿ9†ù†Analysis Table8ú…q†' €"€˜ˆ‚€‚ÿAnalysis Tableˆ[9†ù†- *€¶€ˆˆ‚€€&€‚ÿTable in Surveyor’s Expert system that lists all expert symptoms discovered over time.?q†8‡1 ÿÿÿÿÿÿÿÿWÿÿÿÿ8‡ˆOverview Table8ù†p‡' €"€˜ˆ‚€‚ÿOverview Table“f8‡ˆ- *€Ì€ˆˆ‚€€&€‚ÿTable in Surveyor’s Expert system that lists all counters for expert events discovered over time.Jp‡Mˆ1 ÿÿÿÿÿÿÿÿXÿÿÿÿMˆ‰Duplicate Network AddressCˆˆ' €8€˜ˆ‚€‚ÿDuplicate Network AddressXMˆ‰' €°€ˆˆ‚€‚ÿAn IP or IPX address that is discovered in packets that contain the same MAC address.JˆY‰1©ÿÿÿÿÿÿÿÿYÿÿÿÿY‰¸ŠApplication Response TimeC‰œ‰' €8€˜ˆ‚€‚ÿApplication Response TimeôY‰¸Š( €é€ˆˆ‚€‚ÿThe time required to establish a session with an application protocol, measured in milliseconds. Surveyor tracks average time, the shortest time, and the longest time required for connections to a protocol over the monitored network segment.> œ‰öŠ1úÿÿÿÿÿÿÿÿZÿÿÿÿöв‹Frozen Window7¸Š-‹' € €˜ˆ‚€‚ÿFrozen Window…^öв‹' €¼€ˆˆ‚€‚ÿCondition where the TCP/IP window size remains the same for all packets over a time period.< -‹î‹1òÿÿÿÿÿÿÿÿ[ÿÿÿÿŒZero Window5²‹#Œ' €€˜ˆ‚€‚ÿZero WindowZŒ' €´€ˆˆ‚€‚ÿCondition where the TCP/IP window size remains zero for all packets over a time period < #ŒàŒ1ìÿÿÿÿÿÿÿÿ\ÿÿÿÿàŒExpert View5¤Œ' €€˜ˆ‚€‚ÿExpert View{TàŒ' €¨€ˆˆ‚€‚ÿSurveyor data view showing expert symptoms and expert counters for a time period.EÕ1jÿÿÿÿÿÿÿÿ]ÿÿÿÿÕúŽVoice over IP (VoIP)>Ž' €.€˜ˆ‚€‚ÿVoice over IP (VoIP)ç½ÕúŽ* "€{€ˆˆ‚€‚‚‚ÿIndustry term for the carrying of voice traffic over the Internet Protocol. This term is sometimes used more broadly to indicate VoIP/Multi-Media communications via the H.323 protocol.: Ž41&ÿÿÿÿÿÿÿÿ^ÿÿÿÿ4,ÀMulti-QoS3 úŽg' €€˜ˆ‚€‚ÿMulti-QoS¹4,À* "€€ˆˆ‚€‚‚‚ÿPlug-in module available with Surveyor that decodes the H.323 protocol and provides information in tables aboug,ÀúŽt conversation and channels.HgtÀ15ÿÿÿÿÿÿÿÿ_ÿÿÿÿtÀaÁCumulative Byte CounterA,ÀµÀ' €4€˜ˆ‚€‚ÿCumulative Byte Counter¬‚tÀaÁ* "€€ˆˆ‚€‚‚‚ÿThis counter is a sum of all bytes received to this point in time in a capture file. It displays as a column in Capture View.; µÀœÁ1¯ÿÿÿÿÿÿÿÿ`ÿÿÿÿœÁÃThroughput4 aÁÐÁ' €€˜ˆ‚€‚ÿThroughput@œÁÃ) €/€ˆˆ‚€‚‚ÿThe throughput is calculated by dividing the cumulative bytes by the elapsed time. The Throughput displays as a column in Capture View. The elapsed time is the difference between the time stamp of the first packet and the time stamp of the current packet in the capture file.HÐÁXÃ1 ÿÿÿÿÿÿÿÿaÿÿÿÿXÃ0ÄPackets Dropped CounterAÙÃ' €4€˜ˆ‚€‚ÿPackets Dropped Counter—pXÃ0Ä' €à€ˆˆ‚€‚ÿA counter showing the number of packets missed by Surveyor. For CMM2 or GAM cards, this value should be zero.E™ÃuÄ1 ÿÿÿÿÿÿÿÿbÿÿÿÿuÄÐÅOther Glossary Items>0ijÄ' €.€˜ˆ‚€‚ÿOther Glossary ItemsãuÄÐÅ: B€Ç€ˆˆ‚€‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚‚ÿOther potential Glossary Items are listed here. Each may become a glossary entry….TOSTime to Liveutilization percentageBPDUCDPretransmissionsfragment assemblyredirectSYN PacketsRST PacketsVLANMSTSAPRIP OSPF1³ÄÆ1UÿÿÿÿÿÿÿÿcÿÿÿÿÆ%Æ$ÐÅ%Æ" €€€ÿ@ÆeÆ1lÿÿÿÿ;(deÆžÆá Expert Overview9%ÆžÆ' €$€ ˆ‚€‚ÿExpert Overview=eÆÛÇ( €+€ˆˆ‚€‚ÿAutomatic diagnostic analysis, expert data views, application response time, and expert alarms are referred to collectively as Surveyor's Expert Features. Expert Features are available in Surveyor menus and toolbars if you have installed the Surveyor Expert Plug-in Module.6žÆÈ' €€œŒ‚€‚ÿEXPERT VIEWSIÛÇZÉ. *€7€ˆ˜‚€€'€‚ÿThe expert views can present expert information on capture files, a capture buffer, or in real-time monitoring mode. (Note: real-time display of expert views is not supported for GAM devices.) The following Expert views are available from the Data Views or Capture View toolbar:JȤÉ6 <€*€VˆˆÈ:‚H€ ƒ€†"€8‚ÿ·Expert View ]'ZÉÊ6 <€P€VˆˆÈ:‚H€ ƒ€†"€9‚ÿ·Application Response Time View ]'¤É^Ê6 <€P€VˆˆÈ:‚H€ ƒ€†"€7‚ÿ·Duplicate Network Address View  qÊþÌ/ ,€ã€ˆˆ‚€€&€‚‚ÿWhen you click on Expert View, two types of expert tables are available – Expert Overview and Expert Analysis. Expert Overview is a statistics table presenting counters for each of the Expert Symptoms. Expert Analysis lists each specific symptom. The Application Response Time view depicts performance information for specific applications. For each supported application the Application Response Time View will present the Application, Minimum Response Time (Min Time), Maximum Response Time (Max Time), Average Response Times (Avg Time), and the Number of Connections (Connections) processed to derive these times. ¯‡^Ê­Í( €€ˆˆ‚€‚ÿThe Duplicate Network Address view depicts each duplicate network (IP/IPX) address detected and its associated MAC layer bindings. G þÌôÍ' €@€œŒ‚€‚ÿEXPERT SYMPTOMS AND DIAGNOSIS@­Í@) €/€ˆˆ‚€‚‚ÿExpert logic internal to Surveyor reports significant symptoms of potential network problems as well as helpful diagnostic information related to the symptom. These events are determined by Surveyor's expert logic. No configuration is required to use the expert logic. When Surveyor finds an event that could indicate a network problem, the event is logged in the Expert Analysis table, and the appropriate counters are incremented in the Expert Overview Table. Frame ID (CaptureôÍ@%Æ View only), source address, destination address, VLAN ID, and the timestamp are provided for each entry in the Expert Analysis Table. Each table entry also shows a summary that provides more information about the symptom. The Expert Analysis Table contains the last 2,001 symptoms detected for the module.fôÍÍ' €Ì€ˆˆ‚€‚ÿThe following is a list of the general categories of symptoms discovered by Shomiti's expert logic:k>@8- *€|€VˆˆÈ:‚H€ ƒ€‚ÿ·Application Layer: NFS Retransmission, All ICMP Errors ”gÍÌ- *€Î€VˆˆÈ:‚H€ ƒ€‚ÿ·Transport Layer: TCP/IP Retransmission, TCP/IP Zero Window, TCP/IP Frozen Window, TCP/IP Long Ackžq8j- *€â€VˆˆÈ:‚H€ ƒ€‚ÿ·Network Layer: Duplicate IP or IPX Address, IP TTL Expiring, IP Illegal Source Address, ISL Illegal VLAN IDrEÌÜ- *€Š€VˆˆÈ:‚H€ ƒ€‚ÿ·MAC Layer (Ethernet and Token Ring): Illegal MAC Source Addressº’j–( €%€ˆˆ‚€‚ÿFrom Expert Analysis Table you can double-click on any symptom to display an Expert Diagnosis. Contents of the Expert Diagnosis window include:|OÜ- *€ž€VˆˆÈ:‚H€ ƒ€‚ÿ·Information on the selected Expert Symptom from the Expert Analysis tableB–T- *€*€VˆˆÈ:‚H€ ƒ€‚ÿ·Possible CausesFš- *€2€VˆˆÈ:‚H€ ƒ€‚ÿ·Recommended Actions7TÑ' € €œŒ‚€‚ÿEXPERT ALARMSîÅš¿) €‹€ˆˆ‚€‚‚ÿExpert Alarms allows you to set thresholds related to Expert Symptoms. Alarms can be configured to perform an action such as a page or e-mail, as with all other Surveyor alarms. Alarms test for thresholds at different protocol layers, such as the number of NFS retransmissions at the application layer or a specific overload utilization percentage at the MAC layer. Some network problems are not single events, but are indicated by certain thresholds or counters being exceeded. To catch these type of problems, use Expert Alarms. Many event counters are available from the Expert Alarm Table that can be used to flag network conditions that are not single events, such as excessive multicast broadcasts.2 Ññ' €€œŒ‚€‚ÿSEE ALSOð‹¿á e ˜€€ˆˆ‚ãzáN€‰€‚ãL!ŒÒ€‰€‚ãåå=ˆ€‰€‚ã’Ú½€‰€‚ã]w'€‰€‚ÿApplication Response Time View Duplicate Network Address View Expert Alarms Expert View Expert Overview Table Fñ' 1%FFƒ'_*e' f •Expert Overview Table?á f ' €0€ ˆ‚€‚ÿExpert Overview TableЧ' 6 ) €O€ˆˆ‚€‚‚ÿThe following table provides a summary of expert features by symptom/counter/application name. The meaning of the columns in the table are described below as well.©^f ß K#f€¼Éÿ €€ˆˆ€‚ÿ €"€ˆˆ€€‚ÿÿÿExpert SymptomLogged as an Expert Event and appears in the Analysis Tab of Expert View.σ6 ® L#f€Éÿ €€ˆˆ€‚ÿ €Z€ˆˆ€€‚ÿÿÿCounter in the Overview Tab of Expert ViewHas a counter associated with it that displays in the Overview Tab of Expert View.’Gß @ K#f€ŽÉÿ  €€ˆˆ€€‚ÿ€ €ˆˆ€‚ÿÿÿExpert AlarmHas an alarm you can set in the Expert Alarm editor.´l® ô H#`€ØÉÿ €€ˆˆ€‚ÿ€D€ˆˆ€‚ÿÿÿApplication Response Time AlarmHas an alarm you can set in the Application Response Time Alarm editor.Z@ u' €´€ˆˆ‚€‚ÿX = present, z = does not exist as a unique counter, but is counted in other categories?ô ´¯#,!äX X F … a €€ŒŒÿ €€ ŒŒ‚€‚ÿ€J€ ŒŒ‚‚ÿ€l€ ŒŒ‚‚ÿ€œ€ ŒŒ‚‚ÿ€º€ ŒŒ‚‚ÿ€ü€ ŒŒ‚‚ÿÿÿCounter, Symptom, or ApplicationExpert SymptomCounter in Expert ViewExpert AlarmApplication Response Time AlarmExpert Thresholdÿ<u¿@Ã#VxäX X F … a €€ ŒŒ‚ÿ€€´¿@á ŒŒ‚€‚ÿ€:€ŒŒ‚ÿ€<€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿ$€H€ ŒŒ‚€(€‚ÿ€t€ ŒŒ‚‚ÿÿÿApplication Response TimeX (by application)é,´¨A½#JXäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€<€ŒŒ‚ÿ€>€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€N€ ŒŒ‚‚ÿ€R€ ŒŒ‚‚ÿÿÿBroadcast/Multicast StormsXXXÞ!¿@†B½#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€*€ŒŒ‚ÿ€,€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿDNS Response TimeXQ¨AžCÇ#^¢äX X F … a €€ ŒŒ‚ÿ,€€ŒŒ‚€€(€‚ÿ€„€ŒŒ‚ÿ€†€ ŒŒ‚‚ÿ€Œ€ ŒŒ‚‚ÿ€’€ ŒŒ‚‚ÿ€˜€ ŒŒ‚€(‚ÿ€ž€ ŒŒ‚‚ÿÿÿDuplicate Network Address(also displays as a separate view)XXXÝ †B{D½#J@äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€"€ŒŒ‚ÿ€$€ ŒŒ‚‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿÿÿExcessive ARPXXXXß"žCZE½#JDäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€&€ŒŒ‚ÿ€(€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿExcessive BOOTPXXXXá${D;F½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿExcessive BroadcastsXá$ZEG½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿExcessive CollisionsXá$;FýG½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿExcessive MulticastsXÞ!GÛH½#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€*€ŒŒ‚ÿ€,€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿFTP Response TimeXá$ýG¼I½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿGopher Response TimeXØÛH”J½#J6äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€€ŒŒ‚ÿ€€ ŒŒ‚‚ÿ€"€ ŒŒ‚‚ÿ€(€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿÿÿHSRP CoupXzzÙ¼ImK½#J8äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€€ŒŒ‚ÿ€ € ŒŒ‚‚ÿ€$€ ŒŒ‚‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿÿÿHSRP ErrorsXXÚ”JGL½#J:äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€€ŒŒ‚ÿ€ € ŒŒ‚‚ÿ€&€ ŒŒ‚‚ÿ€,€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿÿÿHSRP ResignXzzß"mK&M½#JDäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿÿÿHTTP Response TimeXÝ GLN½#J@äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€&€ŒŒ‚ÿ€(€ ŒŒ‚‚ÿ€,€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿÿÿICMP All ErrorsXXá$&MäN½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿICMP Bad IP HeaderXzzò5NÖO½#JjäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€N€ŒŒ‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€b€ ŒŒ‚‚ÿ€f€ ŒŒ‚‚ÿÿÿICMP Destination Host Access DeniedXzzì/äN΀½#J^äX X F ÖO΀á … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€B€ŒŒ‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€Z€ ŒŒ‚‚ÿÿÿICMP Destination Host UnknownXzzõ8ÖOý#JpäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€T€ŒŒ‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€b€ ŒŒ‚‚ÿ€h€ ŒŒ‚‚ÿ€l€ ŒŒ‚‚ÿÿÿICMP Destination Network Access DeniedXzzï2΀²‚½#JdäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€H€ŒŒ‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€`€ ŒŒ‚‚ÿÿÿICMP Destination Network UnknownXzzë.ý#J\äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€@€ŒŒ‚ÿ€B€ ŒŒ‚‚ÿ€H€ ŒŒ‚‚ÿ€N€ ŒŒ‚‚ÿ€T€ ŒŒ‚‚ÿ€X€ ŒŒ‚‚ÿÿÿICMP Destination UnreachableXXXõ8²‚’„½#JpäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€T€ŒŒ‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€b€ ŒŒ‚‚ÿ€h€ ŒŒ‚‚ÿ€l€ ŒŒ‚‚ÿÿÿICMP Fragment Reassembly Time ExceededXzzò5ƒ„…½#JjäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€N€ŒŒ‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€b€ ŒŒ‚‚ÿ€f€ ŒŒ‚‚ÿÿÿICMP Fragmentation Needed [D/F set]Xzzá$’„e†½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿICMP Host RedirectXzzé,„…N‡½#JXäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€<€ŒŒ‚ÿ€>€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€T€ ŒŒ‚‚ÿÿÿICMP Host Redirect for TOSXzzä'e†2ˆ½#JNäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€2€ŒŒ‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿÿÿICMP Host UnreachableXzzì/N‡‰½#J^äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€B€ŒŒ‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€Z€ ŒŒ‚‚ÿÿÿICMP Host Unreachable for TOSXzzä'2ˆŠ½#JNäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€2€ŒŒ‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿÿÿICMP Network RedirectXzzì/‰îн#J^äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€B€ŒŒ‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€Z€ ŒŒ‚‚ÿÿÿICMP Network Redirect for TOSXzzï2ŠÝ‹½#JdäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€H€ŒŒ‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿ€`€ ŒŒ‚‚ÿÿÿICMP Network Unreachable for TOSXzzå(îŠÂŒ½#JPäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€4€ŒŒ‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€H€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿÿÿICMP Parameter ProblemXzzä'Ý‹¦½#JNäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€2€ŒŒ‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿÿÿICMP Port UnreachableXzzè+ÂŒŽŽ½#JVäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€:€ŒŒ‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€H€ ŒŒ‚‚ÿ€N€ ŒŒ‚‚ÿ€R€ ŒŒ‚‚ÿÿÿICMP Protocol UnreachableXzzܦj½#J>äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€"€ŒŒ‚ÿ€$€ ŒŒ‚‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿÿÿICMP RedirectXXXî1ŽŽdÀ½#JbäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€F€ŒŒ‚ÿ€H€ ŒŒ‚‚ÿ€N€ ŒŒ‚‚ÿ€T€ ŒŒ‚jdÀá ‚ÿ€Z€ ŒŒ‚‚ÿ€^€ ŒŒ‚‚ÿÿÿICMP Required IP Option MissingXzzá$jEÁ½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿICMP Source QuenchXzzç*dÀ,½#JTäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€8€ŒŒ‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿÿÿICMP Source Route FailedXzzá$EÁ ý#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿICMP Time ExceededXzzé,,Âöý#JXäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€<€ŒŒ‚ÿ€>€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€T€ ŒŒ‚‚ÿÿÿICMP Time to Live ExceededXzz G ÃÅÄ#XŽäX X F … a €€ ŒŒ‚ÿ,€€ŒŒ‚€€(€‚ÿ€r€ŒŒ‚ÿ€t€ ŒŒ‚‚ÿ€z€ ŒŒ‚‚ÿ€€€ ŒŒ‚‚ÿ€†€ ŒŒ‚‚ÿ€Š€ ŒŒ‚‚ÿÿÿIllegal MAC Source Address(Ethernet or Token Ring)XXXí0öÃîŽ#J`äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€D€ŒŒ‚ÿ€F€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿ€R€ ŒŒ‚‚ÿ€X€ ŒŒ‚‚ÿ€\€ ŒŒ‚‚ÿÿÿIllegal Network Source AddressXXXà#ÅÎÆ½#JFäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿÿÿIP Checksum ErrorsXXç*îŵǽ#JTäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€8€ŒŒ‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿÿÿIP Time to Live ExpiringXXXâ%ÎÆ—Ƚ#JJäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿÿÿISL BPDU/CDP PacketsXXâ%µÇyɽ#JJäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€.€ŒŒ‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿÿÿISL Illegal VLAN IDXXXß"—ÈXʽ#JDäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€(€ŒŒ‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿNetwork OverloadXXXÝ yÉ5˽#J@äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€(€ŒŒ‚ÿ€*€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿÿÿNew MAC StationsXÞ!XÊ̽#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€*€ŒŒ‚ÿ€,€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿNFS Response TimeXâ%5Ëõ̽#JJäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€.€ŒŒ‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿÿÿNFS RetransmissionsXXXß"ÌÔͽ#JDäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿÿÿNNTP Response TimeXå(õ̹ν#JPäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€4€ŒŒ‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿÿÿNon Responsive StationXXXÝ Ô͖Ͻ#J@äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€&€ŒŒ‚ÿ€(€ ŒŒ‚‚ÿ€,€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿÿÿOSPF BroadcastsXXà#¹Î‚½#JFäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€.€ŒŒ‚ÿ–Ï‚á €0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿÿÿOverload Frame RateXì/–Ïn½#J^äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€F€ŒŒ‚ÿ€H€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿ€P€ ŒŒ‚‚ÿ€V€ ŒŒ‚‚ÿ€Z€ ŒŒ‚‚ÿÿÿOverload Utilization PercentageXÞ!‚L½#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€&€ŒŒ‚ÿ€(€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿÿÿPhysical ErrorsXXXÞ!n*½#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€*€ŒŒ‚ÿ€,€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿÿÿPOP Response TimeXÜL½#J>äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€$€ŒŒ‚ÿ€&€ ŒŒ‚‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿÿÿRIP BroadcastsXXÜ*â½#J>äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€$€ŒŒ‚ÿ€&€ ŒŒ‚‚ÿ€*€ ŒŒ‚‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿÿÿSAP BroadcastsXXß"Á½#JDäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿÿÿSMTP Response TimeXá$⢽#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€.€ŒŒ‚ÿ€0€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿTCP Checksum ErrorsXXã&Á…½#JLäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿÿÿTCP/IP Frozen WindowXXXÞ!¢c½#JBäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€&€ŒŒ‚ÿ€(€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿÿÿTCP/IP Long AckXXXå(…H ½#JPäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€4€ŒŒ‚ÿ€6€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿ€H€ ŒŒ‚‚ÿ€L€ ŒŒ‚‚ÿÿÿTCP/IP RetransmissionsXXXà#c( ½#JFäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿÿÿTCP/IP RST PacketsXXá$H  ½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€*€ŒŒ‚ÿ€,€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿÿÿTCP/IP SYN AttackXXXXá$( ê ½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿTCP/IP Zero WindowXXXá$ Ë ½#JHäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€0€ŒŒ‚ÿ€2€ ŒŒ‚‚ÿ€6€ ŒŒ‚‚ÿ€:€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€D€ ŒŒ‚‚ÿÿÿTELNET Response TimeXà#ê « ½#JFäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€,€ŒŒ‚ÿ€.€ ŒŒ‚‚ÿ€2€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿ€>€ ŒŒ‚‚ÿ€B€ ŒŒ‚‚ÿÿÿTotal MAC StationsXXä'Ë ½#JNäX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€6€ŒŒ‚ÿ€8€ ŒŒ‚‚ÿ€<€ ŒŒ‚‚ÿ€@€ ŒŒ‚‚ÿ€F€ ŒŒ‚‚ÿ€J€ ŒŒ‚‚ÿÿÿTotal Router BroadcastsXÜ« k½#J>äX X F … a €€ ŒŒ‚ÿ€€ŒŒ‚€‚ÿ€ €ŒŒ‚ÿ€"€ ŒŒ‚‚ÿ€(€ ŒŒ‚‚ÿ€.€ ŒŒ‚‚ÿ€4€ ŒŒ‚‚ÿ€8€ ŒŒ‚‚ÿÿÿUnstable MSTXXXX*•' €€ˆˆ‚€‚ÿJkß1ë;(r*fß.@èCApplication Response TimeC•.@' €8€ ˆ‚ß.@•€‚ÿApplication Response Time1 ß_@' €€œŒ‚€‚ÿCOUNTERòÊ.@QA( €•€ˆˆ‚€‚ÿThe response time for various applications is measured in milliseconds (ms). A threshold can be set in the Application Response Time Alarms for all supported applications. Supported applications are:6 _@‡A- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·DNS6 QA½A- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·FTP9 ‡AöA- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·Gopher7 ½A-B- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·HTTP6 öAcB- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·NFS7 -BšB- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·NNTP6 cBÐB- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·POP7 šBC- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·SMTP9 ÐB@C- *€€VˆˆÈ:‚H€ ƒ€‚ÿ·TELNET2 CrC' €€œŒ‚€‚ÿSEE ALSOv9@CèC= J€r€ˆˆ‚ãÝ«†€‰€‚ãzáN€‰€‚ÿAlarm Editors Application Response Time View JrC2D1_*·‡*g2DuD^LBroadcast/Multicast StormCèCuD' €8€ ˆ‚€‚ÿBroadcast/Multicast Storm1 2D¦D' €€œŒ‚€‚ÿCOUNTER„>uD*GF Z€}€ˆˆ‚€€€€€€€€€€€‚ÿThe Broadcast/Multicast Storms counter increments when a change in the number of total Broadcast/Multicast packets per second exceeds a threshold. Broadcast/Multicast Storms can be used to monitor extreme peaks in the number of broadcast and/or multicast messages. The default threshold is a delta of 400 broadcast/multicast events per second; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all instances where the threshold is reached displays in the Overview tab of Expert View. 8¦DbG' €"€œŒ‚€‚ÿEXPERT SYMPTOMà*GjH( €Á€ˆˆ‚€‚ÿBroadcast/Multicast Storm events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the rate of change for broadcast and multicast packets. For example:V,bGÀH* $€X€ˆˆ‘€„€‚ÿRate of change of Bcast/Mcast Packets=500:jHúH' €&€œŒ‚€‚ÿEXPERT DIAGNOSISU)ÀHOJ, &€S€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The broadcast storm expert threshold has been exceeded for this segment, resulting in a MAC Broadcast Storm symptom.__________________________________________________________________ Probable Cause(s): ß­úH.K2 2€[€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The network is overloaded. 2. Variations in application traffic patterns.3. Heavy Internet usage.4. Too many broadcast/multicast packets from the switch/bridge.…]OJ³K( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):«~.K^L- *€ü€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated storms, your router or switch may needed upgrading or reconfiguring.J³K¨L1cr*+h¨LëLÍ„Duplicate Network AddressC^LëL' €8€ ˆ‚€‚ÿDuplicate Network AddressÆ•¨L±M1 0€-€ˆˆ‚€†"€7‚ÿA separate table showing duplicate network addresses is available. Press the button on the Data View or Capture View toolbar to see this table. 1 ëLâM' €€œŒ‚€‚ÿCOUNTERM%±M/O( €K€ˆˆ‚€‚ÿDuplicate Network Address is a counter of all duplicate network addresses over a period of time per segment. A count of all duplicate network addresses displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms for all duplicate network Addresses.8âMgO' €"€œŒ‚€‚ÿEXPERT SYMPTOM%ý/O˜€( €û€ˆˆ‚€‚ÿDuplicate network addresses are automatically logged as either "Duplicate IP Address" or "Duplicate IPX Address"gO˜€^L expert symptoms. The Symptom Summary field in the Analysis Table provides information about the duplicate IP or IPX address. For example:BgOÚ€* $€0€ˆˆ‘€„€‚ÿAddr=[206.250.228.67]:˜€' €&€œŒ‚€‚ÿEXPERT DIAGNOSISoBÚ€ƒ‚- (€…€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: This network address has multiple MAC station address association.This is a serious problem if the associated MAC stations are not routers. __________________________________________________________________ Probable Cause(s): é¹lƒ0 .€s€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. An existing network address has been assigned to a new machine withoutverification. 2. An old (discarded) machine using this address has been re-introducedinto the network. Ú¯ƒ‚F„+ $€_€ˆˆ‚€‚‚‚ÿ__________________________________________________________________ Recommended Action(s): Change the network address of one or more hosts so thatthere are no duplicates.2 lƒx„' €€œŒ‚€‚ÿSEE ALSOU%F„Í„0 0€J€ˆˆ‚ãL!ŒÒ€‰€‚ÿDuplicate Network Address View @x„ …1W·‡*+i …F…lŒExcessive BOOTP9Í„F…' €$€ ˆ‚€‚ÿExcessive BOOTP1 …w…' €€œŒ‚€‚ÿCOUNTERÎF…‹‡F Z€€ˆˆ‚€€€€€€€€€€€‚ÿThe Excessive BOOTP counter increments when a change in the number of Bootp/Dhcp requests per second exceeds a threshold. The default threshold is a delta of 10 Bootp/Dhcp requests per second; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all Excessive BOOTP events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8w…Ç' €"€œŒ‚€‚ÿEXPERT SYMPTOMòÊ‹‡µˆ( €•€ˆˆ‚€‚ÿExcessive BOOTP events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the rate of change for Bootp/Dhcp requests. For example:V,Ç ‰* $€X€ˆˆ‘€„€‚ÿRate of change of Bootp/Dhcp Requests=25 :µˆE‰' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS; ‰€Š, &€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The expert threshold for number of BOOTP/DHCP requests has been exceeded for this segment.__________________________________________________________________ Probable Cause(s): ¤wE‰$‹- *€î€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. The network has many devices that are being reset. 2. The DHCP server has many requests from floating clients.…]€Š©‹( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Ó$‹lŒ0 .€'€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Load balance your network.2. Add more DHCP servers.3. Your network may have just come up after a power down; if so, ignore this problem.> ©‹ªŒ1+‚ƒ+jªŒáŒÌÄExcessive ARP7lŒáŒ' € € ˆ‚€‚ÿExcessive ARP1 ªŒ' €€œŒ‚€‚ÿCOUNTER¼áŒF Z€y€ˆˆ‚€€€€€€€€€€€‚ÿThe Excessive ARP counter increments when a change in the number of ARP requests per second exceeds a threshold. The default threshold is a delta of 10 ARP requests per second; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all Excessive ARP events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8L' €"€œŒ‚€‚ÿEXPERT SYMPTOMéÁAÀ( €ƒ€ˆˆ‚€‚ÿExcessive ARP events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information abouLAÀlŒt the rate of change for ARP requests. For example:O%LÀ* $€J€ˆˆ‘€„€‚ÿRate of change of ARP Requests=20 :AÀÊÀ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS\0À&Â, &€a€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The expert threshold for ARP Broadcasts requests has been exceeded for this segment, resulting in an Excessive ARP symptom.__________________________________________________________________ Probable Cause(s): ÂÊÀèÂ2 2€!€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The network is overloaded.2. Variations in application traffic patterns.3. Heavy Internet usage.4. Too many new TCP/IP connections.…]&ÂmÃ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):_-èÂÌÄ2 2€[€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated overloads and maybe too many retransmissions, your router or switch may need upgrading.3. Your network may have just come up after a power down; if so, ignore this problem.4. If it is due to higher Internet usage, then ignore this message.EmÃÅ11+H…+kÅOÅOÇExcessive Broadcasts>ÌÄOÅ' €.€ ˆ‚€‚ÿExcessive Broadcasts1 Å€Å' €€œŒ‚€‚ÿCOUNTERÏ¥OÅOÇ* "€K€ˆˆ‚€‚‚‚ÿExcessive Broadcasts is a counter that can be used to monitor fluctuations in the number of broadcast messages over a period of time per segment. A delta threshold for this counter can be set in Expert Alarms to establish what is considered excessive broadcasts. An alarm event can also be generated based on an absolute number of multicasts over time.The default is 400 broadcast packets per sec on a 100MB network.E€Å”Ç11‚ƒ+‡+l”ÇÒÇÒÉExcessive Multicasts>OÇÒÇ' €.€ ˆ‚€‚ÿExcessive Multicasts1 ”ÇÈ' €€œŒ‚€‚ÿCOUNTERÏ¥ÒÇÒÉ* "€K€ˆˆ‚€‚‚‚ÿExcessive Multicasts is a counter that can be used to monitor fluctuations in the number of multicast messages over a period of time per segment. A delta threshold for this counter can be set in Expert Alarms to establish what is considered excessive broadcasts. An alarm event can also be generated based on an absolute number of multicasts over time.The default is 400 multicast packets per sec on a 100MB network.EÈÊ1ëH…+h‰+mÊUÊÍExcessive Collisions>ÒÉUÊ' €.€ ˆ‚€‚ÿExcessive Collisions1 ʆÊ' €€œŒ‚€‚ÿCOUNTER_6UÊåÌ) €m€ˆˆ‚€‚‚ÿExcessive Collisions is a counter that can be used to monitor fluctuations in the number of collisions or the absolute number of collisions over a period of time per segment. A delta threshold for this counter can be set in Expert Alarms to establish what is considered excessive collisions. An alarm event can also be generated based on an absolute number of collisions over time.The Excessive Collisions counter is incremented by counting runt packets and by counting packets with CRC errors. The Excessive Collisions counter only applies to Ethernet networks.*†ÊÍ' €€ˆˆ‚€‚ÿ: åÌIÍ1:‡+>,nIÍ|Í‘HSRP Coup3 Í|Í' €€ ˆ‚€‚ÿHSRP Coup1 IÍ­Í' €€œŒ‚€‚ÿCOUNTERY+|ÍÏ. *€W€ˆˆ‚€€€‚ÿHSRP Coup events are counted in the HSRP Errors counter, which displays in the Overview tab of Expert View. A Coup message indicates that the router wishes to become active. A threshold can be set in Expert Alarms for HSRP Coup/Resign packets, which includes both Resign and Coup HSRP messages.8­Í>Ï' €"€œŒ‚€‚ÿEXPERT SYMPTOMä¼Ï.( €y€ˆˆ‚€‚ÿHSRP Coup events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the IP address of the router tryin>Ï.Íg to become active. For example:T*>Ï‚* $€T€ˆˆ‘€„€‚ÿSA=[206.250.226.11] DA=[206.250.228.69]:.¼' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS Ý‚Å, &€»€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________Problem Description:A Router has generated an HSRP Coup message.__________________________________________________________________Probable Cause(s):`5¼%+ &€j€Vˆˆ¶L„6€ƒ‚ÿ1. The router wishes to become the active router.„\Å©( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):¾%g. *€!€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Make sure that the router coming up is a stand by router.2. Make sure there was a router Resign message (by Master router) before coup.*©‘' €€ˆˆ‚€‚ÿ< gÍ1 h‰+Ò,oÍÝHSRP Errors5‘' €€ ˆ‚€‚ÿHSRP Errors1 Í3' €€œŒ‚€‚ÿCOUNTERª|Ý. *€ù€ˆˆ‚€€€‚ÿSome Hot Standby Routing Protocol (HSRP) packets are counted in the HSRP Errors counter, which displays in the Overview tab of Expert View. Both Coup and Resign packets are counted. Coup/Resign packets in the HSRP are used to activate/deactivate routers. A threshold can be set in Expert Alarms for HSRP Coup/Resign packets, which includes both Resign and Coup HSRP messages.< 31/>,<,pNL HSRP Resign5ÝN' €€ ˆ‚€‚ÿHSRP Resign1 ' €€œŒ‚€‚ÿCOUNTERf8Nå. *€q€ˆˆ‚€€€‚ÿHSRP Resign events are counted in the HSRP Errors counter, which displays in the Overview tab of Expert View. A Resign message indicates that the router is requesting to become inactive. A threshold can be set in Expert Alarms for HSRP Coup/Resign packets, which includes both Resign and Coup HSRP messages.8' €"€œŒ‚€‚ÿEXPERT SYMPTOMèÀå ( €€ˆˆ‚€‚ÿHSRP Resign events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the IP address of the router trying to become inactive. For example:T*Y * $€T€ˆˆ‘€„€‚ÿSA=[206.250.226.11] DA=[206.250.228.69]: “ ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS ßY ž , &€¿€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________Problem Description:A router has generated an HSRP Resign message.__________________________________________________________________Probable Cause(s):f;“  + &€v€Vˆˆ¶L„6€ƒ‚ÿ1. The router no longer wishes to be the active router.„\ž ˆ ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Ä– L . *€-€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Make sure the router is going back to stand by mode.2. Make sure you get a Coup message or Hello message from new router that has taken over.@ˆ Œ 1µÒ,‡,qŒ Å WBICMP All Errors9L Å ' €$€ ˆ‚€‚ÿICMP All Errors1 Œ ö ' €€œŒ‚€‚ÿCOUNTER.Å $) € €ˆˆ‚€‚‚ÿICMP All Errors is a counter of all ICMP symptoms. A count of all ICMP symptoms displays in the Overview Tab of Expert View. This counter can also be set in Expert Alarms to set a threshold for all ICMP errors.The following types of ICMP errors are counted:ÑŸö  @2 2€?€VˆˆÈ:‚H€ ƒ€€‚ÿ·Destination Unreachable Network Unreachable, Host Unreachable, Protocol Unreachable, Port Unreachable, Fragmentation Needed [D/F Set], Source Route Failed, Destination Network Unknown, Destination Host Unknown, Destination Network Access Denied, Destination Host Access Denied, Network Unreachable for TOS, Host Unreachable for TOS, Destination Unreachable (catches all other Destination Unreachable Errors)$ @L D$P@0 0€(€VˆˆÈ:‚H€ ƒ€€‚ÿ·Source QuenchÅ“ @A2 2€'€VˆˆÈ:‚H€ ƒ€€‚ÿ·RedirectNetwork Redirect, Host Redirect, Network Redirect for TOS, Host Redirect for TOS, ICMP Redirect (catches all other Redirect errors)’aP@§A1 2€Â€VˆˆÈ:‚H€ ƒ€€‚ÿ·Time ExceededICMP Time Exceeded, Time To Live Exceeded, Fragment Reassembly Time Exceeded°AWB1 2€þ€VˆˆÈ:‚H€ ƒ€€‚ÿ·Parameter ProblemBad IP Header, Required IP Option Missing, ICMP Parameter Problem (catches all other Parameter errors)C§AšB1$<,æ‡,ršBÖBÉJICMP Bad IP Header<WBÖB' €*€ ˆ‚€‚ÿICMP Bad IP Header1 šBC' €€œŒ‚€‚ÿCOUNTERõÍÖBüC( €›€ˆˆ‚€‚ÿICMP Bad IP Header events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8C4D' €"€œŒ‚€‚ÿEXPERT SYMPTOMå½üCE( €{€ˆˆ‚€‚ÿICMP Bad IP Header events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. Examples are:E4D^F, &€3€ˆˆ‘€„€‚‚ÿSent by Destination Host [206.250.228.69] to [206.250.228.11]. Bad Octet at 14. SA=[206.250.228.11] DA=[206.250.228.69]Sent by Gateway [206.250.228.61] to [206.250.228.11] when forwarding to Destination [206.250.228.69]. Bad Octet at 14. SA=[206.250.228.11] DA=[206.250.228.69]:E˜F' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS%ù^F½G, &€ó€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Parameter Problem (IP header is bad) message has been sent. __________________________________________________________________ Probable Cause(s): 1˜FîH1 0€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. A host/router may send this message if the IP header parametershave problems that prevents it from processing the packet. 2. A host/router may have a bad network stack or a bad interface card. 3. There may be incorrect arguments in IP options. …]½GsI( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):V#îHÉJ3 4€G€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the ICMP Pointer field to see the octet in the IP headerwhere the error was detected.2. Verify that the source that sent this IP header has a goodnetwork interface card.3. Check if the network stack on the source that sent the badIP header parameters is working properly.T#sIK1Õ‡,%-sKjKƒICMP Destination Host Access DeniedM&ÉJjK' €L€ ˆ‚€‚ÿICMP Destination Host Access Denied1 K›K' €€œŒ‚€‚ÿCOUNTER”ljK/M( €Ù€ˆˆ‚€‚ÿICMP Destination Host Access Denied events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8›KgM' €"€œŒ‚€‚ÿEXPERT SYMPTOMõÍ/M\N( €›€ˆˆ‚€‚ÿICMP Destination Host Access Denied events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹agMçN* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:\N!O' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS-çNZ€, &€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Host Administratively Prohibited message has been sent. ___________!OZ€ÉJ_______________________________________________________ Probable Cause(s): á!Ok0 .€Ã€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if the destination host does not have proper access. 3. The source may have an incorrectly configured subnet mask. …]Z€ð( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):çkƒ0 .€Ï€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source and/or the router.3. Ignore this message, if the host is truly prohibited (no action required).NðUƒ1–æ‡,-tUƒœƒ‹ICMP Destination Host UnknownG ƒœƒ' €@€ ˆ‚€‚ÿICMP Destination Host Unknown1 Uƒ̓' €€œŒ‚€‚ÿCOUNTERŽfœƒ[…( €Í€ˆˆ‚€‚ÿICMP Destination Host Unknown events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8̓“…' €"€œŒ‚€‚ÿEXPERT SYMPTOMïÇ[…‚†( €€ˆˆ‚€‚ÿICMP Destination Host Unknown events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹a“… ‡* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:‚†G‡' €&€œŒ‚€‚ÿEXPERT DIAGNOSISí ‡`ˆ, &€Û€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Host Unknown message has been sent. __________________________________________________________________ Probable Cause(s): ØG‡h‰0 .€±€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if it does not know the destination host. 3. The source may have an incorrectly configured subnet mask. …]`ˆí‰( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):äh‰‹0 .€É€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source and/or the router.3. Ignore this message, if the host is truly unknown (no action required).W&í‰X‹1%-‚-uX‹¨‹HÃICMP Destination Network Access DeniedP)‹¨‹' €R€ ˆ‚€‚ÿICMP Destination Network Access Denied1 X‹Ù‹' €€œŒ‚€‚ÿCOUNTER—o¨‹p( €ß€ˆˆ‚€‚ÿICMP Destination Network Access Denied events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8Ù‹¨' €"€œŒ‚€‚ÿEXPERT SYMPTOMøÐp Ž( €¡€ˆˆ‚€‚ÿICMP Destination Network Access Denied events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹a¨+* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]: Že' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS0+¡À, &€ €ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination e¡À‹Network Administratively Prohibited message has been sent. __________________________________________________________________ Probable Cause(s): Øe©Á0 .€±€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if the network does not have proper access. 3. The source may have an incorrectly configured subnet mask. …]¡À.Â( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):ê©ÁHÃ0 .€Õ€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source and/or the router.3. Ignore this message, if the network is truly prohibited (no action required).Q .™Ã1¥-ˆ-v™ÃãÃWËICMP Destination Network UnknownJ#HÃãÃ' €F€ ˆ‚€‚ÿICMP Destination Network Unknown1 ™ÃÄ' €€œŒ‚€‚ÿCOUNTER‘iãÃ¥Å( €Ó€ˆˆ‚€‚ÿICMP Destination Network Unknown events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8ÄÝÅ' €"€œŒ‚€‚ÿEXPERT SYMPTOMòÊ¥ÅÏÆ( €•€ˆˆ‚€‚ÿICMP Destination Network Unknown events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹aÝÅZÇ* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:ÏÆ”Ç' €&€œŒ‚€‚ÿEXPERT DIAGNOSISðZǰÈ, &€á€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Network Unknown message has been sent. __________________________________________________________________ Probable Cause(s): ۔ǻÉ0 .€·€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if it does not know the destination network. 3. The source may have an incorrectly configured subnet mask. …]°È@Ê( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):ç»ÉWË0 .€Ï€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source and/or the router.3. Ignore this message, if the network is truly unknown (no action required).M@ʤË1õ ‚-ß.w¤ËêËtICMP Destination UnreachableFWËêË' €>€ ˆ‚€‚ÿICMP Destination Unreachable1 ¤ËÌ' €€œŒ‚€‚ÿCOUNTER4 êËOÏ* "€€ˆˆ‚€‚‚‚ÿICMP Destination Unreachable is a counter of all ICMP destination unreachable errors over a period of time per segment. A count of all destination unreachable ICMP symptoms displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms for all destination unreachable ICMP errors.The following types of destination unreachable ICMP errors are counted:Network Unreachable, Host Unreachable, Protocol Unreachable, Port Unreachable, Fragmentation Needed [D/F Set], Source Route Failed, Destination Network Unknown, Destination Host Unknown, Destination Network Access Denied, Destination Host Access Denied, Network Unreachable for TOS, Host Unreachable for TOS, Destination Unreachable (catches all other Destination Unreachable Errors)8̇Ï' €"€œŒ‚€‚ÿEXPERT SYMPTOMúÑOÏ) €£€ˆˆ‚€‚‚ÿICMP Destination Unreachable is also an expert symptom, and has its own expert ‡ÏWËdiagnosis. However, this expert symptom reflects only those destination unreachable conditions which cannot be assigned to one of the other destination unreachable symptoms defined above.ICMP Destination Unreachable events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹a‡Ï* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:R' €&€œŒ‚€‚ÿEXPERT DIAGNOSISìj, &€Ù€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): yFRã3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a destination is unreachable. 3. If the packet needs to be fragmented and yet the don't fragment flag is setthe host/router will send this message. 4. The source may have an incorrectly configured subnet mask. „\jg( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s): Ýãt0 .€»€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the destination is truly unreachable (no action required).T#gÈ1 ˆ-9 .xÈïICMP Fragmentation Needed [D/F set]M&t' €L€ ˆ‚€‚ÿICMP Fragmentation Needed [D/F set]1 ÈF' €€œŒ‚€‚ÿCOUNTER”lÚ( €Ù€ˆˆ‚€‚ÿICMP Fragmentation Needed [D/F set] events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8F ' €"€œŒ‚€‚ÿEXPERT SYMPTOMõÍÚ ( €›€ˆˆ‚€‚ÿICMP Fragmentation Needed [D/F set] events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:´‰ » + $€€ˆˆ‘€„€‚ÿMTU of next Hop=2 to reach [206.250.228.69]. Cannot be reached by [206.250.228.11] as D/F Set. SA=[206.250.228.11] DA=[206.250.228.69]: õ ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS>» 3 - (€#€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination (Fragmentation needed, but, D/F set)Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): 4õ g 1 0€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. If the packet needs to be fragmented and yet the don't fragment flag is setthe host/router will send this message. 3. The source may have an incorrectly configured subnet mask. …]3 ì ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Óg ï0 .€§€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the D/F is meant to be set (no action required).W&ì F1ãß.€„.yF–´FICMP Fragment Reassembly Time ExceededP)ï–' €R€ ˆ‚€‚ÿICMP Fragment Reassembly Time Exceeded1 FÇ' €€œŒ‚€‚ÿCOUNTER á–Ü@( €Ã€ˆˆ‚€‚ÿICMP Fragment ReÇÜ@ïassembly Time Exceeded events are counted in the All ICMP Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8ÇA' €"€œŒ‚€‚ÿEXPERT SYMPTOMøÐÜ@ B( €¡€ˆˆ‚€‚ÿICMP Fragment Reassembly Time Exceeded events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:“iAŸB* $€Ò€ˆˆ‘€„€‚ÿSent by Destination Host [206.250.228.69] to [206.250.228.11]. SA=[206.250.228.11] DA=[206.250.228.69]: BÙB' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS"öŸBûC, &€í€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Fragment Reassembly Time Exceeded message has been sent. __________________________________________________________________ Probable Cause(s): ; ÙB6E2 2€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. A host may send this message if it cannot reassemblethe fragments (due to missing fragments) on time. 2. There may be a lot of missing IP fragments (possibly dueto NFS traffic or network overload). 3. If the routing tables are incorrect on the source. …]ûC»E( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):ùÇ6E´F2 2€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the source.2. Check the netmask configuration of the source.3. Check if there are missing IP fragments.4. May need to upgrade the host that sent this message.C»E÷F1ê9 .Š.z÷F3GìNICMP Host Redirect<´F3G' €*€ ˆ‚€‚ÿICMP Host Redirect1 ÷FdG' €€œŒ‚€‚ÿCOUNTER^63GÂH( €m€ˆˆ‚€‚ÿICMP Host Redirect events are counted in the ICMP Redirect Errors counter and the ICMP All Errors counter. A count of ICMP redirect errors and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP redirect errors or for all ICMP errors.8dGúH' €"€œŒ‚€‚ÿEXPERT SYMPTOMä¼ÂHÞI( €y€ˆˆ‚€‚ÿICMP Host Redirect events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:ŸuúH}J* $€ê€ˆˆ‘€„€‚ÿUse Gateway [206.250.54.61] to reach [206.250.228.69] from [206.250.228.11] SA=[206.250.228.11]DA=[206.250.228.69]:ÞI·J' €&€œŒ‚€‚ÿEXPERT DIAGNOSISâ}JÅK, &€Å€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Host Redirect message has been sent. __________________________________________________________________ Probable Cause(s): s@·J8M3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if according to its (proper) routingtables it finds a shorter path via a different router. 3. The source may have an incorrectly configured subnet mask. 4. The host (source) may have an old routing table. „\ÅK¼M( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Ö8MÂN0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the redirect message is valid (no action required).*¼MìN' €€ˆˆ‚€‚ÿKÂN7O1Ì€„.Ê/{7O{O@‡ICMP Host Redirect for TOSDìN{O' €:€ ˆ‚€‚ÿICMP Host Redirect for TOS1 7O¬O' €€œŒ‚€‚ÿCOUNTERf>{O( €}€ˆˆ‚€‚ÿICMP Host Redirect for TOS events are count¬OìNed in the ICMP Redirect Errors counter and the ICMP All Errors counter. A count of ICMP redirect errors and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP redirect errors or for all ICMP errors.8¬OV' €"€œŒ‚€‚ÿEXPERT SYMPTOMìÄB‚( €‰€ˆˆ‚€‚ÿICMP Host Redirect for TOS events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:­‚Vï‚+ $€€ˆˆ‘€„€‚ÿUse Gateway [206.250.54.61] to reach [206.250.228.69] and TOS 22 from [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:B‚)ƒ' €&€œŒ‚€‚ÿEXPERT DIAGNOSISîï‚C„, &€Ý€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Redirect for TOS and Host message has been sent. __________________________________________________________________ Probable Cause(s): s@)ƒ¶…3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if according to its (proper) routingtables it finds a shorter path via a different router. 3. The source may have an incorrectly configured subnet mask. 4. The host (source) may have an old routing table. „\C„:†( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Ö¶…@‡0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the redirect message is valid (no action required).F:††‡1vŠ.„ /|†‡Ň ICMP Host Unreachable?@‡Ň' €0€ ˆ‚€‚ÿICMP Host Unreachable1 †‡ö‡' €€œŒ‚€‚ÿCOUNTER†^Ň|‰( €½€ˆˆ‚€‚ÿICMP Host Unreachable events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8ö‡´‰' €"€œŒ‚€‚ÿEXPERT SYMPTOMç¿|‰›Š( €€ˆˆ‚€‚ÿICMP Host Unreachable events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹a´‰&‹* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:›Š`‹' €&€œŒ‚€‚ÿEXPERT DIAGNOSISñ&‹}Œ, &€ã€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Host Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): Ò`‹0 .€¥€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a destination host is unreachable. 3. The source may have an incorrectly configured subnet mask. …]}ŒŽ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Ö 0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the host is truly unreachable (no action required).NŽX1÷Ê/„„/}XŸCÇICMP Host Unreachable for TOSG Ÿ' €@€ ˆ‚€‚ÿICMP Host Unreachable for TOS1 XÐ' €€œŒ‚€‚ÿCOUNTERŽfŸjÁ( €Í€ˆˆ‚€‚ÿICMP HoÐjÁ st Unreachable for TOS events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8ТÁ' €"€œŒ‚€‚ÿEXPERT SYMPTOMïÇjÁ‘Â( €€ˆˆ‚€‚ÿICMP Host Unreachable for TOS events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:˜n¢Á)Ã* $€Ü€ˆˆ‘€„€‚ÿTOS=22 service on [206.250.228.69] unavailable for [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:‘ÂcÃ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS(ü)ËÄ, &€ù€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Host is Unreachable for TOS message has been sent. __________________________________________________________________ Probable Cause(s): %ôcðÅ1 0€é€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a destination host is unreachablefor the type of service requested. 3. The source may have an incorrectly configured subnet mask. …]‹Ä5Æ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Þ°ÅCÇ0 .€½€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the host is truly unreachable for TOS (no action required).F5ƉÇ1É„ /ŽŠ/~‰ÇÈÇ`ÏICMP Network Redirect?CÇÈÇ' €0€ ˆ‚€‚ÿICMP Network Redirect1 ‰ÇùÇ' €€œŒ‚€‚ÿCOUNTERa9ÈÇZÉ( €s€ˆˆ‚€‚ÿICMP Network Redirect events are counted in the ICMP Redirect Errors counter and the ICMP All Errors counter. A count of ICMP redirect errors and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP redirect errors or for all ICMP errors.8ùÇ’É' €"€œŒ‚€‚ÿEXPERT SYMPTOMç¿ZÉyÊ( €€ˆˆ‚€‚ÿICMP Network Redirect events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:Ÿu’ÉË* $€ê€ˆˆ‘€„€‚ÿUse Gateway [206.250.54.61] to reach [206.250.228.69] from [206.250.228.11] SA=[206.250.228.11]DA=[206.250.228.69]:yÊRË' €&€œŒ‚€‚ÿEXPERT DIAGNOSISåËcÌ, &€Ë€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Network Redirect message has been sent. __________________________________________________________________ Probable Cause(s): s@RËÖÍ3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if according to its (proper) routingtables it finds a shorter path via a different router. 3. The source may have an incorrectly configured subnet mask. 4. The host (source) may have an old routing table. „\cÌZÎ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):ÖÖÍ`Ï0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the redirect message is valid (no action required).NZήÏ1ò„„/0®Ï ÍICMP Network Redirect for TOSG `Ï ' €@€ ˆ‚€‚ÿICMP Network Redirect for TOS®Ï `Ï1 ®Ï=' €€œŒ‚€‚ÿCOUNTERiA ¦( €ƒ€ˆˆ‚€‚ÿICMP Network Redirect for TOS events are counted in the ICMP Redirect Errors counter and the ICMP All Errors counter. A count of ICMP redirect errors and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP redirect errors or for all ICMP errors.8=Þ' €"€œŒ‚€‚ÿEXPERT SYMPTOMïǦÍ( €€ˆˆ‚€‚ÿICMP Network Redirect for TOS events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:¬Þy+ $€€ˆˆ‘€„€‚ÿUse Gateway [206.250.54.61] to reach [206.250.228.69] and TOS 22 from [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:ͳ' €&€œŒ‚€‚ÿEXPERT DIAGNOSISñyÐ, &€ã€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Redirect for TOS and Network message has been sent. __________________________________________________________________ Probable Cause(s): s@³C3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if according to its (proper) routingtables it finds a shorter path via a different router. 3. The source may have an incorrectly configured subnet mask. 4. The host (source) may have an old routing table. „\ÐÇ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):ÖCÍ0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the redirect message is valid (no action required).IÇ1ŽŠ/à 0€X¦ICMP Network UnreachableBÍX' €6€ ˆ‚€‚ÿICMP Network Unreachable1 ‰' €€œŒ‚€‚ÿCOUNTER‰aX ( €Ã€ˆˆ‚€‚ÿICMP Network Unreachable events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8‰J ' €"€œŒ‚€‚ÿEXPERT SYMPTOMê 4 ( €…€ˆˆ‚€‚ÿICMP Network Unreachable events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹aJ ¿ * $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:4 ù ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS ô¿  , &€é€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Network Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): Òù 0 .€¥€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a destination host is unreachable. 3. The source may have an incorrectly configured subnet mask. …]  ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Ö¦0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the host is truly unreachable (no action required).Q   @1Ì0†0 @V@ñGICMP Network Unreachable for TOS¦ @¦J#¦V@' €F€ ˆ‚€‚ÿICMP Network Unreachable for TOS1 @‡@' €€œŒ‚€‚ÿCOUNTER‘iV@B( €Ó€ˆˆ‚€‚ÿICMP Network Unreachable for TOS events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8‡@PB' €"€œŒ‚€‚ÿEXPERT SYMPTOMòÊBBC( €•€ˆˆ‚€‚ÿICMP Network Unreachable for TOS events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:˜nPBÚC* $€Ü€ˆˆ‘€„€‚ÿTOS=22 service on [206.250.228.69] unavailable for [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:BCD' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS+ÿÚC?E, &€ÿ€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Network is Unreachable for TOS message has been sent. __________________________________________________________________ Probable Cause(s): ëD[F1 0€×€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a network is unreachable for the typeof service requested. 3. The source may have an incorrectly configured subnet mask. …]?EàF( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):á[FñG0 .€Ã€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the network is truly unreachable for TOS (no action required).GàF8H1Sà 01‚8HxH{€ICMP Parameter Problem@ñGxH' €2€ ˆ‚€‚ÿICMP Parameter Problem1 8H©H' €€œŒ‚€‚ÿCOUNTERùÑxH¢I( €£€ˆˆ‚€‚ÿICMP Parameter Problem events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8©HÚI' €"€œŒ‚€‚ÿEXPERT SYMPTOMèÀ¢IÂJ( €€ˆˆ‚€‚ÿICMP Parameter Problem events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:“iÚIUK* $€Ò€ˆˆ‘€„€‚ÿBad IP Header sent from [206.250.228.11] to [206.250.228.69]. SA=[206.250.228.11] DA=[206.250.228.69]šÂJL( €5€ˆˆ‚€‚ÿThis Expert Symptom will be used to identify a parameter problem only if the problem cannot be identified as a Bad IP Header or as a Missing IP Option.:UKQL' €&€œŒ‚€‚ÿEXPERT DIAGNOSISæLcM, &€Í€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Parameter Problem message has been sent. __________________________________________________________________ Probable Cause(s): 1QL”N1 0€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. A host/router may send this message if the IP header parametershave problems that prevents it from processing the packet. 2. A host/router may have a bad network stack or a bad interface card. 3. There may be incorrect arguments in IP options. …]cMO( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):V#”N{€3 4€G€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the ICMP Pointer field to see the octet in the IP headerwhere the error was detected.2. Verify that the source that sent this IP header has a goodnetwork interface cO{€ñGard.3. Check if the network stack on the source that sent the badIP header parameters is working properly.FOÁ€1†0à1ƒÁ€lˆICMP Port Unreachable?{€' €0€ ˆ‚€‚ÿICMP Port Unreachable1 Á€1' €€œŒ‚€‚ÿCOUNTER†^·‚( €½€ˆˆ‚€‚ÿICMP Port Unreachable events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.81ï‚' €"€œŒ‚€‚ÿEXPERT SYMPTOMç¿·‚Öƒ( €€ˆˆ‚€‚ÿICMP Port Unreachable events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:–lï‚l„* $€Ø€ˆˆ‘€„€‚ÿPort=22 on [206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:Öƒ¦„' €&€œŒ‚€‚ÿEXPERT DIAGNOSISñl„Ã…, &€ã€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Port Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): öƦ„¹†0 .€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a port is unreachable. 3. The source may have an incorrectly configured subnet mask. …]Ã…>‡( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):.ý¹†lˆ1 0€û€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the port is truly unreachable (no action required) for ex: SNMP port connection requests.J>‡¶ˆ1ž1€1„¶ˆùˆaÀICMP Protocol UnreachableClˆùˆ' €8€ ˆ‚€‚ÿICMP Protocol Unreachable1 ¶ˆ*‰' €€œŒ‚€‚ÿCOUNTERŠbùˆ´Š( €Å€ˆˆ‚€‚ÿICMP Protocol Unreachable events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8*‰ìŠ' €"€œŒ‚€‚ÿEXPERT SYMPTOMëôŠ׋( €‡€ˆˆ‚€‚ÿICMP Protocol Unreachable events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:špìŠqŒ* $€à€ˆˆ‘€„€‚ÿProtocol=IP on [206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:׋«Œ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS!õqŒÌ, &€ë€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Protocol Unreachable message has been sent. __________________________________________________________________ Probable Cause(s): úÊ«ŒÆŽ0 .€•€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A host may send this message if a protocol is unreachable. 3. The source may have an incorrectly configured subnet mask. …]ÌK( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s): ÚÆŽaÀ0 .€µ€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.KaÀlˆ3. Ignore this message, if the protocol is truly unreachable (no action required).> KŸÀ13 à1A‡1…ŸÀÖÀØÉICMP Redirect7aÀÖÀ' € € ˆ‚€‚ÿICMP Redirect1 ŸÀÁ' €€œŒ‚€‚ÿCOUNTERЦÖÀ×Â* "€M€ˆˆ‚€‚‚‚ÿICMP Redirect is a counter of all ICMP redirect errors over a period of time per segment. A count of all redirect ICMP symptoms displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.The following types of ICMP redirect errors are counted:Network Redirect, Host Redirect, Network Redirect for TOS, Host Redirect for TOS, ICMP Redirect (catches all other Redirect errors)8ÁÃ' €"€œŒ‚€‚ÿEXPERT SYMPTOM¾•×ÂÍÄ) €+€ˆˆ‚€‚‚ÿICMP Redirect is also an expert symptom, and has its own expert diagnosis. However, this expert symptom reflects only those redirect conditions which cannot be assigned to one of the other redirect symptoms defined above.ICMP Redirect events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:ŸuÃlÅ* $€ê€ˆˆ‘€„€‚ÿUse Gateway [206.250.54.61] to reach [206.250.228.69] from [206.250.228.11] SA=[206.250.228.11]DA=[206.250.228.69]:ÍĦÅ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS ÝlůÆ, &€»€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Redirect message has been sent. __________________________________________________________________ Probable Cause(s): s@¦Å"È3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if according to its (proper) routingtables it finds a shorter path via a different router. 3. The source may have an incorrectly configured subnet mask. 4. The host (source) may have an old routing table. „\¯Æ¦È( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Ö"ȬÉ0 .€­€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.3. Ignore this message, if the redirect message is valid (no action required).,¦ÈØÉ( €€ˆˆ‚€‚‚ÿP¬É(Ê1€1ƒ2†(ÊqÊICMP Required IP Option MissingI"ØÉqÊ' €D€ ˆ‚€‚ÿICMP Required IP Option Missing1 (Ê¢Ê' €€œŒ‚€‚ÿCOUNTERÚqʤË( €µ€ˆˆ‚€‚ÿICMP Required IP Option Missing events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8¢ÊÜË' €"€œŒ‚€‚ÿEXPERT SYMPTOMñɤËÍÌ( €“€ˆˆ‚€‚ÿICMP Required IP Option Missing events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:“iÜË`Í* $€Ò€ˆˆ‘€„€‚ÿBad IP Header sent from [206.250.228.11] to [206.250.228.69]. SA=[206.250.228.11] DA=[206.250.228.69]:ÍÌšÍ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS6 `ÍÐÎ, &€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Parameter Problem (IP Options required, but, missing) message has been sent. __________________________________________________________________ Probable Cause(s): 1šÍ 1 0€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. A host/router may send this message if the IP header parametershave problems that prevents it from processing the packet. 2. A host/router may have a bad network stack or a bad interface card. 3. There may be incorrect arguments in IP options. ÐÎ ØÉ…]ÐÎ’( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):V# è3 4€G€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Check the ICMP Pointer field to see the octet in the IP headerwhere the error was detected.2. Verify that the source that sent this IP header has a goodnetwork interface card.3. Check if the network stack on the source that sent the badIP header parameters is working properly.*’' €€ˆˆ‚€‚ÿIè[16A‡12‡[¢ ICMP Source Route FailedB' €6€ ˆ‚€‚ÿICMP Source Route Failed1 [Î' €€œŒ‚€‚ÿCOUNTER‰aW( €Ã€ˆˆ‚€‚ÿICMP Source Route Failed events are counted in the ICMP All Errors and the ICMP Destination Unreachable counters. A count of all destination unreachable ICMP symptoms and a count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all destination unreachable ICMP errors or for all ICMP errors.8Î' €"€œŒ‚€‚ÿEXPERT SYMPTOMêÂWy( €…€ˆˆ‚€‚ÿICMP Source Route Failed events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:‹a* $€Â€ˆˆ‘€„€‚ÿ[206.250.228.69] cannot be reached by [206.250.228.11] SA=[206.250.228.11] DA=[206.250.228.69]:y>' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS.l, &€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Destination Unreachable (Source Route Failed) message has been sent. __________________________________________________________________ Probable Cause(s): ýÍ>i0 .€›€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a routing table problem, it may send this message. 2. A router may send this message if it cannot route the packet. 3. The source may have an incorrectly configured subnet mask. …]lî( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):´†i¢ . *€ €Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Check the routing tables of the router that this message was generated from.2. Check the netmask configuration of the source.Cîå 1ƒ2?2ˆå ! âAICMP Source Quench<¢ ! ' €*€ ˆ‚€‚ÿICMP Source Quench1 å R ' €€œŒ‚€‚ÿCOUNTERõÍ! G ( €›€ˆˆ‚€‚ÿICMP Source Quench events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8R  ' €"€œŒ‚€‚ÿEXPERT SYMPTOMå½G d ( €{€ˆˆ‚€‚ÿICMP Source Quench events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. Examples are:(ü Œ , &€ù€ˆˆ‘€„€‚‚ÿSent by Destination Host [206.250.228.69] to [206.250.228.11]. SA=[206.250.228.11] DA=[206.250.228.69]Sent by Gateway Host [206.250.228.61] to [206.250.228.11] when forwarding to Destination [206.250.228.69]. SA=[206.250.228.11] DA=[206.250.228.69]:d Æ ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS⌠Ô, &€Å€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Source Quench message has been sent. __________________________________________________________________ Probable Cause(s): ÚÆ ß1 0€µ€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. If a router has a buffer space problem, it may send this message. 2. A host may send this message if it can't keep up withprocessing of packets and is reaching its limits. 3. The network may be overloaded. …]Ôp@( €º€ˆˆ‚ßp@¢ €‚‚ÿ__________________________________________________________________ Recommended Action(s):r?ßâA3 4€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. Check the routing table buffer statistics and upgradethe router if problem persists.2. If the message is from a host, you may need to upgrade it's resources.3. Increase the bandwidth of your network to reduce network overload.4. Ignore this message, if it is infrequent as the problem will rectify itself.Kp@-B1ä2E†2‰-BqB$IICMP Time to Live ExceededDâAqB' €:€ ˆ‚€‚ÿICMP Time to Live Exceeded1 -B¢B' €€œŒ‚€‚ÿCOUNTERýÕqBŸC( €«€ˆˆ‚€‚ÿICMP Time to Live Exceeded events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8¢B×C' €"€œŒ‚€‚ÿEXPERT SYMPTOMìÄŸCÃD( €‰€ˆˆ‚€‚ÿICMP Time to Live Exceeded events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:º×C}E+ $€€ˆˆ‘€„€‚ÿSent by Gateway [206.250.228.61] to [206.250.228.11] when forwarding to Destination [206.250.228.69] SA=[206.250.228.11] DA=[206.250.228.69]:ÃD·E' €&€œŒ‚€‚ÿEXPERT DIAGNOSISê}EÍF, &€Õ€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Time To Live Exceeded message has been sent. __________________________________________________________________ Probable Cause(s): è·EçG2 2€Ñ€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. A router may send this message if it encounters an IP packet with aTTL value of 0. 2. The source may have an incorrectly configured subnet mask, causinglonger hops. 3. If the routing tables are incorrect on the source. …]ÍFlH( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):ŽaçGúH- *€Â€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Check the routing tables of the source.2. Check the netmask configuration of the source.*lH$I' €€ˆˆ‚€‚ÿCúHgI1 ?2»3ŠgI£Iù€ICMP Time Exceeded<$I£I' €*€ ˆ‚€‚ÿICMP Time Exceeded1 gIÔI' €€œŒ‚€‚ÿCOUNTERõÍ£IÉJ( €›€ˆˆ‚€‚ÿICMP Time Exceeded events are counted in the ICMP All Errors counter. A count of all ICMP errors displays in the Overview Tab of Expert View. A threshold can be set in Expert Alarms for all ICMP errors.8ÔIK' €"€œŒ‚€‚ÿEXPERT SYMPTOMä¼ÉJåK( €y€ˆˆ‚€‚ÿICMP Time Exceeded events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the IP addresses involved. For example:ºKŸL+ $€€ˆˆ‘€„€‚ÿSent by Gateway [206.250.228.61] to [206.250.228.11] when forwarding to Destination [206.250.228.69] SA=[206.250.228.11] DA=[206.250.228.69]:åKÙL' €&€œŒ‚€‚ÿEXPERT DIAGNOSISâŸLçM, &€Å€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An ICMP Time Exceeded message has been sent. __________________________________________________________________ Probable Cause(s): ‰TÙLpO5 8€©€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. A router may send this message if it encounters an IP packet with aTTL value of 0. 2. The source may have an incorrectly configured subnet mask, causinglonger hops. 3. If the routing tables are incorrect on the source. 4. A host may send this message if it cannot reassemblethe fragments (due to missing fragments) on time. „\çM €( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):pO €$Ií»pOù€2 2€w€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. Check the routing tables of the source.2. Check the netmask configuration of the source.3. Check if there are missing IP fragments.4. May need to upgrade your router or host.D €=1›E†2o3‹=zä‡TCP Checksum Errors=ù€z' €,€ ˆ‚€‚ÿTCP Checksum ErrorsP)=Ê' €R€ˆˆ‚€‚ÿThis symptom is turned OFF by default.1 zû' €€œŒ‚€‚ÿCOUNTERí¿Êè‚. *€€ˆˆ‚€€€‚ÿTCP Checksum Errors is a counter of all incorrect TCP checksums over a period of time per segment. A count of all TCP Checksum Errors events displays in the Overview tab of Expert View. 8û ƒ' €"€œŒ‚€‚ÿEXPERT SYMPTOMöÎè‚„( €€ˆˆ‚€‚ÿTCP Checksum Errors events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the IP source and destination address for the checksum error. For example:U+ ƒk„* $€V€ˆˆ‘€„€‚ÿSA=[206.250.228.69] DA=[206.250.228.11]:„¥„' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS5 k„Ú…, &€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An TCP/IP packet has a checksum value that is in error. The packet may be discarded.__________________________________________________________________ Probable Cause(s): »¥„•†. *€€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. The station that sent this packet may have a faulty network stack. 2. The router that forwarded this packet may have a faulty stack.…]Ú…‡( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Êœ•†ä‡. *€9€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Identify the station that sent this packet (source addresses).2. Verify the network layer stack for this station. The station may need to be reset.K‡/ˆ1»3Í 3Œ/ˆsˆPIllegal MAC Source AddressDä‡sˆ' €:€ ˆ‚€‚ÿIllegal MAC Source Address1 /ˆ¤ˆ' €€œŒ‚€‚ÿCOUNTER4 sˆ؉( €€ˆˆ‚€‚ÿIllegal MAC Source Address is a counter of all illegal MAC station source addresses over a period of time per segment. A count of all illegal MAC source addresses displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8¤ˆŠ' €"€œŒ‚€‚ÿEXPERT SYMPTOM彨‰õŠ( €{€ˆˆ‚€‚ÿIllegal MAC source addresses are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the number of illegal address encountered. For example:X.ŠM‹* $€\€ˆˆ‘€„€‚ÿNumber of illegal sources (since last)=[22]à¸õŠ-Œ( €q€ˆˆ‚€‚ÿThis symptom can help catch malfunctioning NIC cards or bad addresses generated due to collisions. Illegal MAC source addresses may be discovered on Ethernet or Token Ring networks.:M‹gŒ' €&€œŒ‚€‚ÿEXPERT DIAGNOSISe8-ŒÌ- (€q€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A broadcast Ethernet (or Token Ring) address has appeared as a source address.This is problem associated with a bad adapter card. __________________________________________________________________ Probable Cause(s):  sgŒlŽ- *€æ€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Someone is transmitting illegal frames using a traffic generator. 2. There may be a faulty adapter card. ä¹ÌP+ $€s€ˆˆ‚€‚‚‚ÿ__________________________________________________________________ Recommended Action(s): Filter on the Network address and determine which host hasthe faulty card and replace it.OlŽŸ1˜o3É„3Ÿ ÀoÆIllegal Network Source AddressH!P À' €B€ ˆ‚€‚ÿIllegal Network Source AddressŸ ÀP1 Ÿ=À' €€œŒ‚€‚ÿCOUNTER4  ÀqÁ( €€ˆˆ‚€‚ÿIllegal Network Source Address is a counter of all illegal network source addresses over a period of time per segment. A count of all illegal MAC source addresses displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8=À©Á' €"€œŒ‚€‚ÿEXPERT SYMPTOMéÁqÁ’Â( €ƒ€ˆˆ‚€‚ÿIllegal network source addresses are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the number of illegal address encountered. For example:X.©ÁêÂ* $€\€ˆˆ‘€„€‚ÿNumber of illegal sources (since last)=[22]Šc’ÂtÃ' €Æ€ˆˆ‚€‚ÿThis symptom can help catch malfunctioning routers or bad addresses generated due to collisions.:ê®Ã' €&€œŒ‚€‚ÿEXPERT DIAGNOSISLtÃúÄ- (€?€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A broadcast network address has appeared as a source address.This is problem associated with a bad host. __________________________________________________________________ Probable Cause(s): ¥x®ÃŸÅ- *€ð€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Someone is transmitting illegal frames using a traffic generator. 2. There may be a faulty adapter card/host. ЦúÄoÆ* "€M€ˆˆ‚€‚‚‚ÿ__________________________________________________________________ Recommended Action(s): Filter on the MAC address and determine the faulty card and replace it.CŸÅ²Æ1CÍ 3K‰3޲ÆîÆÍIP Checksum Errors<oÆîÆ' €*€ ˆ‚€‚ÿIP Checksum Errors1 ²ÆÇ' €€œŒ‚€‚ÿCOUNTERê¼îÆ È. *€y€ˆˆ‚€€€‚ÿIP Checksum Errors is a counter of all incorrect IP checksums over a period of time per segment. A count of all IP Checksum Errors events displays in the Overview tab of Expert View. 8ÇAÈ' €"€œŒ‚€‚ÿEXPERT SYMPTOMõÍ È6É( €›€ˆˆ‚€‚ÿIP Checksum Errors events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the IP source and destination address for the checksum error. For example:U+AÈ‹É* $€V€ˆˆ‘€„€‚ÿSA=[206.250.228.69] DA=[206.250.228.11]:6ÉÅÉ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS1‹ÉöÊ, &€ €ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An IP packet has a checksum value that is in error. The packet may be discarded.__________________________________________________________________ Probable Cause(s): »ÅɱË. *€€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. The station that sent this packet may have a faulty network stack. 2. The router that forwarded this packet may have a faulty stack.…]öÊ6Ì( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Êœ±ËÍ. *€9€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Identify the station that sent this packet (source addresses).2. Verify the network layer stack for this station. The station may need to be reset.I6ÌIÍ1®É„3P4IÍ‹ÍöIP Time to Live ExpiringBÍ‹Í' €6€ ˆ‚€‚ÿIP Time to Live Expiring1 IͼÍ' €€œŒ‚€‚ÿCOUNTERmE‹Í)Ï( €‹€ˆˆ‚€‚ÿIP Time to Live Expiring is a counter of all expiring connections over a period of time per segment. A count of all IP Time to Live Expiring events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms to generate an alarm based on a specific number of expiring connections.8¼ÍaÏ' €"€œŒ‚€‚ÿEXPERT SYMPTOMê)Ï( €Õ€ˆˆ‚€‚ÿIP Time to Live Expiring events are automatically logged as expert symptoms. The Symptom Summary field in the AnalysisaÏÍ Table provides information about the "time-to-live" (TTL) and the source and destination addresses. For example:^4aÏÝ* $€h€ˆˆ‘€„€‚ÿTTL=1 SA=[206.250.228.69] and DA=[206.250.228.11]:' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS>ÝU- (€#€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: An IP packet has a time to live value that is going to expire.The packet may be discarded. __________________________________________________________________ Probable Cause(s): yLÎ- *€˜€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. The network is overloaded. 2. Router tables may be misconfigured. †^UT( €¼€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s): xKÎÌ- *€–€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Increase the network bandwidth.2. Check your router configuration.*Tö' €€ˆˆ‚€‚ÿEÌ;1üK‰3â4;yDISL BPDU/CDP Packets>öy' €.€ ˆ‚€‚ÿISL BPDU/CDP Packets1 ;ª' €€œŒ‚€‚ÿCOUNTERšqyD) €ã€ˆˆ‚€‚‚ÿISL BPDU/CDP Packets is a counter of all Bridge Protocol Data Unit (BPDU) or Cisco Discovery Protocol (CDP) packets in an ISL frame over a period of time per segment. A count of BPDU/CDP packets displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms to generate an alarm based on a specific number of BPDU/CDP packets.Dªˆ1òP44‘ˆÅ† ISL Illegal VLAN ID=DÅ' €,€ ˆ‚€‚ÿISL Illegal VLAN ID1 ˆö' €€œŒ‚€‚ÿCOUNTERíÅ ( €Û€ˆˆ‚€‚ÿISL Illegal VLAN ID is a counter of all ISL illegal VLAN IDs over a period of time per segment. A count of all ISL Illegal VLAN ID displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms. 8öC' €"€œŒ‚€‚ÿEXPERT SYMPTOMÕ­  ( €[€ˆˆ‚€‚ÿISL Illegal VLAN IDs are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the number of the illegal VLAN ID. For example:;CS * $€"€ˆˆ‘€„€‚ÿVLAN ID=[1036]:  ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS5S  - (€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The VLAN ID in the ISL protocol is illegal. The allowable range is from1 to 1024. __________________________________________________________________ Probable Cause(s): ¬~ n . ,€ü€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. An error made in the VLAN configuration for the Switch may haveintroduced an illegal VLAN ID. 2. A faulty Switch. †^ ô ( €¼€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s): ’en † - *€Ê€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Reconfigure your Switch's VLAN configuration to use valid ID's.2. Replace the faulty Switch.Aô Ç 1Õâ4Ê‚4’Ç  „DNetwork Overload:†  ' €&€ ˆ‚€‚ÿNetwork Overload1 Ç 2 ' €€œŒ‚€‚ÿCOUNTER6ð hF Z€á€ˆˆ‚€€€€€€€€€€€‚ÿNetwork Overload is a counter of instances where a threshold for the percentage change in network utilization is exceeded. Network utilization is compared to the utilization for the previous time segment. The default threshold is a 40% change in network utilization; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all instances where the threshold is reached displays in the Overview tab of Expert View.82  ' €"€œŒ‚€‚ÿEXPERT SYMPTOMâºhŽ@( €u€ˆˆ‚€‚ÿNetwork Overload events are automatically logged as exp Ž@† ert symptoms. The Symptom Summary field in the Analysis Table provides information about the change in utilization. For example:< Ê@* $€$€ˆˆ‘€„€‚ÿ%Utilization=42:Ž@A' €&€œŒ‚€‚ÿEXPERT DIAGNOSISJÊ@NB, &€=€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The utilization expert threshold has been exceeded for this segment, resulting in a LAN Overload symptom.__________________________________________________________________ Probable Cause(s): É—AC2 2€/€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The network is overloaded. 2. Variations in application traffic patterns.3. Heavy Internet usage.4. Too many broadcast/multicast packets. …]NBœC( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):¾CZD. *€!€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated overloads and/or too many retransmissions, your router or switch may needed upgrading.*œC„D' €€ˆˆ‚€‚ÿAZDÅD1;4—„4“ÅDÿD GNew MAC Stations:„DÿD' €&€ ˆ‚€‚ÿNew MAC Stations1 ÅD0E' €€œŒ‚€‚ÿCOUNTERÙ°ÿD G) €a€ˆˆ‚€‚‚ÿNew MAC Stations is a counter of all the new MAC stations over a period of time per segment. A threshold for this counter can be set in Expert Alarms. The threshold for new MAC stations is typically set to 1 as an absolute value.The new MAC station counter detects new MAC stations (nodes) on a LAN segment. After a segment is stabilized with a specific number of stations, this counter can indicate possible intruder stations.D0EMG1?Ê‚4Š4”MGŠG˜NNFS Retransmissions= GŠG' €,€ ˆ‚€‚ÿNFS Retransmissions1 MG»G' €€œŒ‚€‚ÿCOUNTERëŠGÎH( €×€ˆˆ‚€‚ÿNFS Retransmissions is a counter of all NFS Retransmissions over a period of time per segment. A count of all NFS Retransmissions displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8»GI' €"€œŒ‚€‚ÿEXPERT SYMPTOMúÒÎHJ( €¥€ˆˆ‚€‚ÿNFS retransmission events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the addresses of the client and server involved. For example:nDInJ* $€ˆ€ˆˆ‘€„€‚ÿClient [206.250.228.69] retransmitting to Server [206.250.228.14]:J¨J' €&€œŒ‚€‚ÿEXPERT DIAGNOSISP#nJøK- (€G€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: There is a retransmission of an NFS request packet as the RPCidentifier for this connection has been reused. __________________________________________________________________ Probable Cause(s): R¨JJM3 4€?€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. An NFS data maybe transmitted over several fragmented IP packets.If any of the IP fragments are missing, it will result in a retransmission. 2. The network is overloaded. 3. The path to the receiving station has long delays. 4. There may be an overloaded switch or router. „\øKÎM( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Ê›JM˜N/ ,€7€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Check if there are any missing IP fragments.2. If you see repeated delays and too many retransmissions, your router or switch may need upgrading.GÎMßN1N —„45•ßNO‡Non Responsive Station@˜NO' €2€ ˆ‚€‚ÿNon Responsive Station1 ßNPO' €€œŒ‚€‚ÿCOUNTER)éO…@ N€Ó€ˆˆ‚€€€€€€€€€‚ÿNon Responsive Station is a counter of all non-responsive stations over a period of time per segment. A non-resPO…˜Nponsive station is defined as successive TCP/IP retransmissions over the same connection that are greater than a threshold value. The default threshold is 3 successive retransmissions; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu ICMP Protocol Unreachable events are counted in the ICMP All Errors8PO½' €"€œŒ‚€‚ÿEXPERT SYMPTOMéÁ…¦‚( €ƒ€ˆˆ‚€‚ÿNon Responsive Station events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides the IP address of the non-responsive station. For example:U+½û‚* $€V€ˆˆ‘€„€‚ÿStation [206.250.228.11] not responding :¦‚5ƒ' €&€œŒ‚€‚ÿEXPERT DIAGNOSISR&û‚‡„, &€M€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The successive retransmissions expert threshold has been exceeded, resulting in a Non Responsive Station symptom.__________________________________________________________________ Probable Cause(s): 'ó5ƒ®…4 6€ç€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The ACK sent by the receiver was lost. 2. The network is overloaded.3. The path to the receiving station has long delays. 4. There may be a problem with the receiver's TCP/IP stack.5. There may be an overloaded switch or router.…]‡„3†( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):»®…î†. *€€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated delays and too many retransmissions, then your router or switch may need upgrading.*3†‡' €€ˆˆ‚€‚ÿ@î†X‡1ߊ4†5–X‡‘‡?‰OSPF Broadcasts9‡‘‡' €$€ ˆ‚€‚ÿOSPF Broadcasts1 X‡‡' €€œŒ‚€‚ÿCOUNTER}T‘‡?‰) €©€ˆˆ‚€‚‚ÿOSPF Broadcasts is a counter of all OSPF broadcasts over a period of time per segment. A count of all OSPF broadcasts displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.If OSPF broadcasts fall below a certain threshold, this may indicate that a OSPF router is not functioning properly.P‡‰1Õ5ú5—‰؉|‹Overload Utilization PercentageI"?‰؉' €D€ ˆ‚€‚ÿOverload Utilization Percentage1 ‰ Š' €€œŒ‚€‚ÿCOUNTERsH؉|‹+ $€‘€ˆˆ‚€‚‚‚‚ÿOverload Utilization Percentage counts bits over time and compares this value to the maximum utilization possible (bandwidth). A threshold for this percentage value can be set in Expert Alarms.Overload utilization percentage can help catch network overloads. The default for a 100MB network is 25% of maximum utilization.D ŠÀ‹1Ά5[5˜À‹ý‹šOverload Frame Rate=|‹ý‹' €,€ ˆ‚€‚ÿOverload Frame Rate1 À‹.Œ' €€œŒ‚€‚ÿCOUNTERlAý‹š+ $€ƒ€ˆˆ‚€‚‚‚‚ÿOverload Frame Rate counts frames over a one-second time period. A threshold for the number of frame per second can be set in Expert Alarms.Overload Frame Rate can help catch network overloads. Values for the threshold can range from 1 to 148,800 frames/sec for a 100 MB network. The default is 37,200 frames/sec.@.ŒÚ1êú5$„5™ÚŽFÆPhysical Errors9šŽ' €$€ ˆ‚€‚ÿPhysical Errors1 ÚDŽ' €€œŒ‚€‚ÿCOUNTER~8ŽÎÀF Z€q€ˆˆ‚€€€€€€€€€€€‚ÿThe Physical Errors counter increments when a change in the number of total MAC physical errors per second exceeds a threshold. Physical errors include CRC/alignment errors, dropped events, collisions, jabbers, oversize packets, undersize packets, and fragments. The default threshold is a delta of 400 physical error packets per second; however, this value can be changed DŽÎÀšfrom the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all instances where the threshold is reached displays in the Overview tab of Expert View. 8DŽÁ' €"€œŒ‚€‚ÿEXPERT SYMPTOM÷ÏÎÀýÁ( €Ÿ€ˆˆ‚€‚ÿPhysical Error events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the rate of change for total MAC physical errors. For example:IÁFÂ* $€>€ˆˆ‘€„€‚ÿRate of change of Errors=450:ýÁ€Â' €&€œŒ‚€‚ÿEXPERT DIAGNOSISEFÂÅÃ, &€3€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The errors threshold has been exceeded for this segment, resulting in a MAC Physical Errors symptom.__________________________________________________________________ Probable Cause(s): !ï€ÂæÄ2 2€ß€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The network is overloaded. 2. A faulty hub/switch/router device.3. A hub may have been incorrectly used. For example, an uplink port may have been used as a data port.4. An end station may have a faulty network interface card.…]ÅÃkÅ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):Û­æÄFÆ. *€[€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Restart capture after setting up a filter to capture error packets (only). 2. Based on the capture results, isolate the device that is in error and fix the problem.?kÅ…Æ1Ú[5Ž…5š…Æ½ÆfÈRIP Broadcasts8FƽÆ' €"€ ˆ‚€‚ÿRIP Broadcasts1 …ÆîÆ' €€œŒ‚€‚ÿCOUNTERxO½ÆfÈ) €Ÿ€ˆˆ‚€‚‚ÿRIP Broadcasts is a counter of all RIP broadcasts over a period of time per segment. A count of all RIP broadcasts displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.If RIP broadcasts fall below a certain threshold, this may indicate that a RIP router is not functioning properly.?îÆ¥È1Ú$„5ø†5›¥ÈÝȆÊSAP Broadcasts8fÈÝÈ' €"€ ˆ‚€‚ÿSAP Broadcasts1 ¥ÈÉ' €€œŒ‚€‚ÿCOUNTERxOÝȆÊ) €Ÿ€ˆˆ‚€‚‚ÿSAP Broadcasts is a counter of all SAP broadcasts over a period of time per segment. A count of all SAP broadcasts displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.If SAP broadcasts fall below a certain threshold, this may indicate that a SAP router is not functioning properly.@ÉÆÊ1c Ž…56œÆÊÿÊ6TCP/IP Long Ack9†ÊÿÊ' €$€ ˆ‚€‚ÿTCP/IP Long Ack1 ÆÊ0Ë' €€œŒ‚€‚ÿCOUNTER7ñÿÊgÍF Z€ã€ˆˆ‚€€€€€€€€€€€‚ÿThe TCP/IP Long Ack counter increments when the TCP/IP acknowledgement for a connection is not seen for greater than a threshold value, measured in milliseconds. The default threshold is no acknowledgement for 200 milliseconds; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all TCP/IP Long Ack events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.80ËŸÍ' €"€œŒ‚€‚ÿEXPERT SYMPTOM/gÍÎÎ( €€ˆˆ‚€‚ÿTCP/IP Long Acks are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the acknowledgement time and the well-known ports(WKP) involved, including the port number and the IP address. For example:†\ŸÍTÏ* $€¸€ˆˆ‘€„€‚ÿAck Time= [300 ms] between [206.250.228.69]/[TCP/IP WKP:1988] and [206.250.228.11]/[SMTP]Á™ÎÎ!( €3€ˆˆ‚€‚ÿThe time required to acknowledge a TCP/IP packet is calculated for every packet. When a value exceeds 200ms, the event is logged asTÏ!†Ê an Expert Symptom.:TÏ[' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS8 !“- (€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A TCP/IP ACK (Acknowledgment) has taken longer than 200 msecto arrive to the sender. __________________________________________________________________ Probable Cause(s): I[Ü4 6€+€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The receiver which generated the ACK was very busy. 2. The network is overloaded. 3. The path to the sender from the receiver has long delays. 4. There may be a problem with the receiver's TCP/IP stack. 5. There may be an overloaded switch or router in the path.„\“`( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):¬~Ü . ,€ü€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated delays and long acknowledgements, your receiver may need upgrading.*`6' €€ˆˆ‚€‚ÿG }1šø†5 6}½& TCP/IP Retransmissions@6½' €2€ ˆ‚€‚ÿTCP/IP Retransmissions1 }î' €€œŒ‚€‚ÿCOUNTER â½ù) €Å€ˆˆ‚€‚‚ÿTCP/IP Retransmissions is a counter of all TCP/IP Retransmissions over a period of time per segment. This variable counts the number of retransmitted packets to measure excessive retransmission in TCP/IP. A count of all TCP/IP Retransmissions displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms. Retransmissions are determined by sweeping the capture data periodically to catch connections that retransmitted within an interval.8î1' €"€œŒ‚€‚ÿEXPERT SYMPTOMðùI( €á€ˆˆ‚€‚ÿTCP/IP Retransmissions are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the well-known ports(WKP) involved, including the port number and the IP address. For example:}S1Æ* $€¦€ˆˆ‘€„€‚ÿBetween [206.250.228.69]/[TCP/IP WKP:1988] and [206.250.228.11]/[TCP/IP WKP:197]:I ' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS˜jƘ . *€Õ€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A TCP/IP packet has been retransmitted as the sequence numberis being repeated. There was no ACK (acknowledgement),from the receiver, causing the sender to retransmit the packet. __________________________________________________________________ Probable Cause(s): (ô À 4 6€é€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. An ACK sent by the receiver was lost. 2. The network is overloaded. 3. The path to the receiving station has long delays. 4. There may be a problem with the receiver's TCP/IP stack. 5. There may be an overloaded switch or router.„\˜ D ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):¸‰À ü / ,€€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. Load balance your network.2. If you see repeated delays and too many retransmissions, your router or switch may need upgrading.*D & ' €€ˆˆ‚€‚ÿCü i 1Â6 6ži ¥ 6TCP/IP RST Packets<& ¥ ' €*€ ˆ‚€‚ÿTCP/IP RST Packets1 i Ö ' €€œŒ‚€‚ÿCOUNTER`7¥ 6) €o€ˆˆ‚€‚‚ÿTCP/IP RST Packets is a counter of all TCP/IP RST Packets over a period of time per segment. This variable counts the number of RST responses to monitor resets in TCP/IP. A count of all TCP/IP RST packets displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.BÖ x1ü  6=†6Ÿx³çGTCP/IP SYN Attack;6³' €(€ ˆ‚€‚ÿTCP/IP SYN Attack1 x @' €€œŒ‚€‚ÿCOUNTER³ @6 ųBF Z€‹€ˆˆ‚€€€€€€€€€€€‚ÿThe TCP/IP SYN Attack counter increments when a change in the number of SYN requests per second exceeds a threshold. The default threshold is a delta of 100 SYN requests per second; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all TCP/IP SYN Attack events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8 @OB' €"€œŒ‚€‚ÿEXPERT SYMPTOMíÅBçGjH' €.€ ˆ‚€‚ÿTCP/IP Window Frozen1 ,H›H' €€œŒ‚€‚ÿCOUNTERÏjH°JF Z€Ÿ€ˆˆ‚€€€€€€€€€€€‚ÿThe TCP/IP Window Frozen counter increments when the TCP/IP window is frozen for greater than a threshold value, measured in seconds. The default threshold is a frozen window of 5 seconds; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all TCP/IP Window Frozen events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.8›HèJ' €"€œŒ‚€‚ÿEXPERT SYMPTOMC°J+L( €7€ˆˆ‚€‚ÿTCP/IP Window Frozen events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the frozen window size, duration, and the well-known ports(WKP) involved, including the port number and the IP address. For example:eèJºL* $€Ê€ˆˆ‘€„€‚ÿFrozen at 29909 for [19 ms] between [206.250.228.69]/[TCP/IP WKP:1988] and [206.250.228.11]/[SMTP]u+LWN( €ë€ˆˆ‚€‚ÿA frozen window event is defined as the TCP/IP window size remaining the same for all packets over a 5 second period for one connection in one direction. If only one packet is detected over the 5 second interval, this is also logged as a TCP/IP frozen window event. Events of this type can indicate when a problem with the TCP/IP connection or excessive network traffic.:ºL‘N' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS°‚WNM€. *€€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A TCP/IP packet has the window size stuckfor longer than 5 secs. If the window size is less than the maximum,then the flow of data is restricted as the sender will not exceed the receiver's window size. ________________________‘NM€çG__________________________________________ Probable Cause(s): â‘Nb3 4€Å€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The receiver is overloaded. 2. The receiver has run out of buffer space. 3. There may be a problem with the receiver's TCP/IP stack. 4. There may too many connections to the receiver causingreduced buffer space. „\M€æ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):ºŠb ‚0 .€€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Upgrade the receiver's CPU and or Memory.2. Reduce the number of connections to the receiver.3. Increase the network bandwidth.Cæã‚1% =†6× 7¡ã‚ƒTCP/IP Zero Window< ‚ƒ' €*€ ˆ‚€‚ÿTCP/IP Zero Window1 ã‚Pƒ' €€œŒ‚€‚ÿCOUNTERg>ƒ·„) €}€ˆˆ‚€‚‚ÿTCP/IP Zero Window is a counter of all TCP/IP Zero Window events over a period of time per segment. A count of all TCP/IP Zero Window events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.All TCP/IP zero window events are also counted as frozen window events.8Pƒï„' €"€œŒ‚€‚ÿEXPERT SYMPTOM3 ·„"†( €€ˆˆ‚€‚ÿTCP/IP Zero Window events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the time, location, and the well-known ports(WKP) involved, including the port number and the IP address. For example:Š`†* $€À€ˆˆ‘€„€‚ÿStuck at 0 for [14 ms] between [206.250.228.69]/[TCP/IP WKP:1988] and [206.250.228.11]/[SMTP]ݵ"†‰ˆ( €k€ˆˆ‚€‚ÿThe TCP window size is examined for every packet to check against a window size of zero. If the window size remains zero for 5 seconds for one connection in one direction, the event is logged. If only one packet with a zero window size is detected over the 5 second interval, this is also logged as a TCP/IP zero window event. Events of this type indicate when a receiver's buffer is full which can indicate problems with the network.:¬†È' €&€œŒ‚€‚ÿEXPERT DIAGNOSIS}O‰ˆ@Š. *€Ÿ€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: A TCP/IP packet has zero window sizefor longer than 5 secs. The receiver is shutting downcommunication and will accept no more data from the other end. __________________________________________________________________ Probable Cause(s): c.È£‹5 8€]€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿ1. The receiver is overloaded. 2. The receiver has run out of buffer space. 3. The non-responsive receiver intends the sender to close the connection. 4. There may be a problem with the receiver's TCP/IP stack. 5. There may too many connections to the receiver causingreduced buffer space.„\@Š'Œ( €¸€ˆˆ‚€‚‚ÿ__________________________________________________________________Recommended Action(s):Â’£‹éŒ0 .€%€Vˆˆ¶L„6€ƒ‚ƒ‚ƒ‚ÿ1. Upgrade the receiver's CPU and or Memory.2. Reduce the number of connections to the receiver.3. Increase the bandwidth of your network.*'Œ' €€ˆˆ‚€‚ÿCéŒV1VÈ7À 7¢V’·Total MAC Stations<’' €*€ ˆ‚€‚ÿTotal MAC Stations1 VÃ' €€œŒ‚€‚ÿCOUNTERôÊ’·* "€•€ˆˆ‚€‚‚‚ÿTotal MAC Stations is a counter of all the MAC stations over a period of time per segment. A count of all MAC stations displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.The MAC station counter helps detect excessive MAC stations (nodes) on a LAN segment. This helps indicate possible intruder stations as well as help the network manager limit and control the number of stations allowed on a segment.Hà À1Þ× 7w7£ ÀMÀúÁTotal Router Broadcasts· À·A·MÀ' €4€ ˆ‚€‚ÿTotal Router Broadcasts1 À~À' €€œŒ‚€‚ÿCOUNTER|SMÀúÁ) €§€ˆˆ‚€‚‚ÿTotal Router Broadcasts is a counter of all total router broadcasts over a period of time per segment. A threshold for this counter can be set in Expert Alarms for total router broadcasts.If total router broadcasts go above a certain threshold, this may indicate that a router in the network is generating excessive broadcast messages.= ~À7Â1À 7u‡7¤7ÂmÂ>ÊUnstable MST6úÁmÂ' €€ ˆ‚€‚ÿUnstable MST1 7žÂ' €€œŒ‚€‚ÿCOUNTER Åm©ÄF Z€‹€ˆˆ‚€€€€€€€€€€€‚ÿThe Unstable MST counter increments when a change in the number of MST topology changes per second exceeds a threshold. The default threshold is a delta of 5 topology changes per second; however, this value can be changed from the Expert Thresholds tab in the Configuration ® Module ® Settings... menu. A count of all Unstable MST events displays in the Overview Tab of Expert View. A threshold for this counter can be set in Expert Alarms.พ‰Å( €q€ˆˆ‚€‚ÿMST topology changes are topology changes required to support IEEE 802.1d (Minimum Spanning Tree). Excessive topology changes infer that the Minimum Spanning Tree (MST) is unstable.8©ÄÁÅ' €"€œŒ‚€‚ÿEXPERT SYMPTOMìĉÅ­Æ( €‰€ˆˆ‚€‚ÿUnstable MST events are automatically logged as expert symptoms. The Symptom Summary field in the Analysis Table provides information about the rate of change for the MST topology. For example:J ÁÅ÷Æ* $€@€ˆˆ‘€„€‚ÿRate of change of Topology=10:­Æ1Ç' €&€œŒ‚€‚ÿEXPERT DIAGNOSIStH÷Æ¥È, &€‘€ˆˆ‚€‚‚‚‚‚ÿ__________________________________________________________________ Problem Description: The threshold for the number of IEEE 802.1D packets with topology change bit has been exceeded for this segment. The Spanning tree may be unstable.__________________________________________________________________ Probable Cause(s): ®€1ÇSÉ. *€€Vˆˆ¶L„6€ƒ‚ƒ‚ÿ1. There may be too many configuration changes for the bridge or switch. 2. There may be a temporary loss of connectivity.…]¥ÈØÉ( €º€ˆˆ‚€‚‚ÿ__________________________________________________________________ Recommended Action(s):f;SÉ>Ê+ &€v€Vˆˆ¶L„6€ƒ‚ÿ1. Identify the device causing this message and fix it.S"ØÉ‘Ê1 w7ÿÿÿÿ¥‘ÊÝÊÈHints and Tips for Expert FeaturesL%>ÊÝÊ' €J€ ˆ‚€‚ÿHints and Tips for Expert FeaturesT‘Ê\Ë+ &€¨€VˆˆÈ:„H€ƒ‚ÿ1.Double-click any symptom in the Analysis Table to view Diagnostic information.•aÝÊñÍ4 6€Ã€Vˆˆ¶L„6€ƒ€€‚ƒ‚ÿ2.You can jump directly to the frame in Capture View that is associated with the expert symptom. Select (single-click) the expert symptom from the Analysis Tab using the Right Mouse Button. Select the Go To Frame… option. The frame associated with the expert symptom displays in Capture View. 3.When looking at Expert View in Monitor only mode, no Frame ID displays for Expert Symptoms detected and you cannot examine a frame related to a symptom. If you think you'll need to look at specific frames related to Expert Symptoms, look at the frame information in the capture buffer or in a capture file.Ý\Ë6 :€»€VˆˆÈ:„H€ƒ€€‚ƒ‚ƒ‚ÿ4.Click, hold, and drag a column border to resize columns in any Expert View Table. Increasing the size of the Symptom column gives you a view of the complete name of the symptom.5.Click, hold, and drag a column border to remove columns in any Expert View Table. Double-click on the same column border to bring back the display of a column.6.Duplicate addresses appear both in the Duplicate Network Address Table and as a symptom in the Analysis Table of Expert VieñÍ>Êw.BöñÍRL f€í€VˆˆÈ:„H€ƒ€)€‚ƒ€€€€€€€€‚ÿ7.You can directly access statistics about a particular host associated with an expert event. From the Expert Overview table, click on any of the counters underlined in blue to see the symptoms broken down by host or conversation. You can then click on the host for more in-depth statistics.8.Thresholds can be set for Expert Symptoms. Select Module à Settings… from the Configuration menu and choose the Expert Thresholds Tab. Change the threshold value for any of the listed symptoms.j¼d –€ €VˆˆÈ:„H€ƒ€€€€€€€€‚ƒ€€€€€€€€€€‚ÿ9.Expert Symptoms can be selectively disabled. Select Module à Settings… from the Configuration menu and choose the Expert Symptoms tab. Remove the check from the Expert Symptoms you wish to disable.10.Expert Symptoms can be displayed in the Summary field of Capture View. From the Configuration menu, select Capture View Options à Display and select the Display Expert Symptom check box. Packets that trigger an expert symptom and have expert symptom information will display in reverse video. ÁRÈK d€ƒ€VˆˆÈ:„H€ƒ€€€€€€€€€€‚‚ÿ11.Expert Views can be disabled on a per module basis. Select Module à Settings… from the Configuration menu and choose the Modes Tab. Remove the check from the Expert Views box.< ¼1·ÿÿÿÿÿÿÿÿ¦9¿Go To Frame5È9' €€ ˆ‚€‚ÿGo To Frame÷X( €ï€ˆˆ‚€‚ÿFrom the Analysis Tab within Expert View, you can jump directly to the frame in Capture View that is associated with the expert symptom. The go to frame option works only in Capture mode. In Monitor mode, the frame selection option is disabled.Ê–9"4 6€-€VˆˆÈ:„H€ƒ‚ƒ€€‚ÿ1.Select (single-click) the expert symptom from the Analysis Tab of Expert View using the Right Mouse Button.2.Select the Go To Frame… option.pIX’' €’€ˆˆ‚€‚ÿThe frame associated with the expert symptom displays in Capture View.-"¿* $€€Vˆˆ¶L„6€‚ÿ1’ð1Uÿÿÿÿÿÿÿÿ§ÿÿÿÿð $¿ " €€€ÿ> ðR 1.ÿÿÿÿÿÿÿÿ¨R ˆ ‘KWhat's New...6 ˆ & € €&˜š€‚ÿWhat's New...qFR ù + &€Œ€$Šš€€€‚ÿA brief synopsis of what’s new in Surveyor 3.0 is provided below.H"ˆ A & €D€&°Œš€‚ÿGigabit Analysis Module Supportáù O - (€Ã€&ŒŒš€€€‚ÿSurveyor supports Shomiti’s Gigabit Analysis Module (GAM) analyzer card and the Explorer Gigabit analyzer module. The GAM is a high-speed network analyzer card with an on-board capture/ transmit buffer and filtering for fiber-optic networks. The GAM provides full line-speed capture and transmit for Gigabit Ethernets. GAM analyzer cards install in a PC or in the Gigabit Explorer analyzer. GAM also supports real-time monitoring for network statistics and MAC error counters.2 A  & €€&°Œš€‚ÿMulti-QoSÚO ‡, &€µ€$Šš€€€‚ÿThe optional Multi-QoS plug-in module for Surveyor decodes H.323 packets in an Ethernet environment and presents call and channel information in an easy-to-read table format. Surveyor’s Multi-QoS plug-in provides important statistics similar to CDR (Call Detail Records) in telephone PBXs that describe conversations carried by the H.323 group of protocols. The table information provides a means to validate QoS parameters of PSTN/IP Gateways, IP switches, and IPBXs.›u .@& €ë€$Šš€‚ÿFull decode of H.323 provides users with the ability to look at any packet of the previously captured data and understand its contents. Leveraging the existing full-line rate capture of Shomiti hardware and the graphical tools already in Surveyor, the Voice over In plug-in turns a general-purpose protocol analyzer into an effective tool‡.@  to measure Quality of Service. B‡p@& €8€&°Œš€‚ÿNew Filter User InterfaceÛµ.@KA& €k€$Šš€‚ÿSurveyor provides a new filtering user interface. The new interface is easier to use, and has additional features to create filters. Some of the highlights of the new interface:cp@ÛA- *€Æ€tŠÈš:‚H€ ƒ€‚ÿ·A single window which contains virtually everything you need to create a basic set of filtersi<KADB- *€x€tŠÈš:‚H€ ƒ€‚ÿ·Organized filter templates in a browser-type interfaceT'ÛA˜B- *€N€tŠÈš:‚H€ ƒ€‚ÿ·Greatly improved logic capabilitytGDB C- *€Ž€tŠÈš:‚H€ ƒ€‚ÿ·Macro filters -- single filter elements can contain OR conditionsˆ[˜B”C- *€¶€tŠÈš:‚H€ ƒ€‚ÿ·Separation of template files and exported files makes user-defined templates reusable‡Z CD- *€´€tŠÈš:‚H€ ƒ€‚ÿ·More format selections for data and offset display (hexadecimal, decimal, and ASCII)R”CšD- *€¤€tŠÈš:‚H€ ƒ€‚ÿ·Ability to correct entry errors without having to clear all previous entries²„DLE. *€ €tŠÈš:‚H€ ƒ€‚ÿ·The preservation of the multi-state logic generation feature for advanced filters, while not being required for simple filters<šDˆE( €(€&°Œš‚H€‚ÿProtocol Decoding~QLEF- *€¢€tŠÈš:‚H€ ƒ€‚ÿ·New protocol decodes may be added to Surveyor by inclusion of a .DLL file. \/ˆEbF- *€^€tŠÈš:‚H€ ƒ€‚ÿ·Many protocol decodes have been enhanced.Z2F¼F( €d€&°Œš‚H€‚ÿDisplay of Cumulative Byte Count and ThroughputˆabFDG' €Â€$Šš‚H€‚ÿCumulative Byte Count and Throughput in bytes per second can now be displayed in Capture View.̤¼FI( €I€$Šš‚H€‚ÿThe Cumulative Byte Count is a sum of all bytes received to this point in time in a capture file. It displays as a column in Capture View. The Throughput is calculated by dividing the cumulative bytes by the elapsed time. The Throughput also displays as a column in Capture View. The elapsed time is the difference between the module arm time (start time) and the time stamp of the current packet in the capture file.õµDGJ@ N€k€$Šš‚H€€€€€€€€€‚ÿThese Capture View counters can be turned on and off in the Capture View Display Options dialog box accessed from the Configuration à Capture View Options à Display menu.AIFJ( €2€&°Œš‚H€‚ÿOther Helpful Features`JÓJ- *€À€tŠÈš:‚H€ ƒ€‚ÿ·Support for Datacom switches for complex Explorer configurations in switched environments.uHFJHK- *€€tŠÈš:‚H€ ƒ€‚ÿ·New Expert symptoms are displayed for TCP and IP header checksums.IÓJ‘K- *€8€tŠÈš:‚H€ ƒ€‚ÿ·Enhanced NDIS support.?HKÐK1Œ ÿÿÿÿÿÿÿÿ©ÐKLâ‡About Surveyor7‘KL& €"€&˜š€‚ÿAbout Surveyorú¼ÐKN> J€y€$Šš€âÙ=…n€‰€â"SÚ€‰€‚ÿSurveyor is an intuitive, graphical Windows 95/98/NT application for managing and troubleshooting Ethernet, Fast Ethernet, Gigabit Ethernet, and Token Ring Networks. Surveyor typically interfaces to one or more hardware devices called Century Media Modules (CMM2) or Gigabit Analysis Modules (GAM) to achieve line-rate performance. Surveyor can simultaneously capture, monitor, and analyze multiple devices and analyze captured data.ŒeLO' €Ë€&Œ˜š€‚ÿSurveyor is an integrated analyzer + monitor for local area networks. Features such as real-time network statistics, 7-layer packet decode and analysis, expert diagnostic analysis, advanced alarm setting and actions, multi-layer filtering, packet slicing, and automatic name table updating provide you with a robust network analysis and monitoring tool.0 NÉ€& €€$Šš€‚ÿSurveyor incorporates comprehensive real-time monitoring capabilities with tOÉ€‘Khe powerful troubleshooting capabilities of a protocol analyzer. These capabilities can function simultaneously, enabling a user to maintain the network using a single multi-purpose tool.±ŠOzƒ' €€$˜š€‚‚ÿAn optional Expert plug-in includes expert features for automatic and very detailed problem diagnosis. Expert logic internal to Surveyor reports significant symptoms as well as any information related to the symptom. No configuration is required to use Expert. You can also set alarms to be informed of any events detected by Expert.Upon startup, Surveyor automatically begins monitoring all of the network segments locally attached to the PC. An optional Remote plug-in software module gives Surveyor the capability to monitor any remote 10/100/1000 Ethernet or 4/16 Token Ring segment that has Surveyor or Shomiti analysis hardware installed. È’É€B‡6 :€%€$˜š€€€€€‚€*‚ÿSurveyor’s two-tier GUI provides both an extensive view of a network as well as the ability to drill down to a specific network segment. Surveyor’s main window provides a view of all of the segments being monitored. You can define what information to view for each segment such as network utilization, protocol distribution, MAC stations, etc. In this same window, Surveyor allows you to create alarms that monitor multiple segments simultaneously. To focus on a particular segment, double-click on a remote device in that segment. You can simultaneously set capture filters, view full 7-layer decodes of captured packets and display multiple real-time MAC, network and application layer statistics to understand the status and performance characteristics of the network segment. VLAN breakdowns, network conversations, and real-time protocol decode summaries provide an extra layer of intelligence.  {zƒâ‡% €ö€$Šš€‚ÿOptional plug-ins are available to decode and analyze H.323 traffic and to transmit packets over the local area network.@B‡"ˆ1ç ÿÿÿÿÿÿÿÿª"ˆZˆ¿ÃAbout NDIS Mode8â‡Zˆ& €$€&˜š€‚ÿAbout NDIS ModeŸy"ˆù‰& €ó€$˜š€‚ÿSurveyor in NDIS mode uses an NDIS driver and interfaces to a variety of network adapters. All basic capture, transmit, and monitor functions are the same in NDIS mode. However, it is not recommended that an NDIS module be used to transmit packets; the transmit rate is likely to fall below the specified transmission rate and transmission of error packets is not supported.ÇZˆÀŒF Z€€$Šš€‚€€€€€€€€‚€€‚ÿThe limitations and unique interface capabilities in the software interface when using an NDIS driver are described below: Captured Packets - Since the NDIS interface filters out frames with errors, only “good” Ethernet frames are captured. In addition, Surveyor in NDIS mode captures both frames received by the Ethernet adapter as well as frames transmitted by the Ethernet adapter.Counters - The error counters supported through the NDIS interface are those counters supported by the network adapter. Some vendors do not support any error counters. Only supported error counters are incremented and shown within data views.œrù‰\* $€ä€$Šš‚´€€‚ÿRx Counter Display - Counters not supported by the NDIS module will display with an "N/A" next to the counter.GÀŒ£* $€:€$˜š‚´€€‚ÿTransmit Specification - b5\Ž- *€j€VˆˆÈ:‚H€ ƒ€‚ÿ·Transmission of error packets is not supported.ŠW£Ž3 6€®€VˆˆÈ:‚H€ ƒ€€€‚ÿ·The minimum and maximum values for the Packet Size field are 64 and 1518 bytes.¨{Ž7- *€ö€VˆˆÈ:‚H€ ƒ€‚ÿ·The radio button for setting the packet gap in microseconds is grayed. Packet gaps in microseconds are not supported.„QŽ»3 6€¢€VˆˆÈ:‚H€ ƒ€€€‚ÿ·Entering a zero in the Packet Gap field forces the shortest gap possible.Ò§7™À+ $€O€$Šš‚H€€‚ÿCapture Rate / Transmit S»™Àâ‡peed - Capture/transmit rates depend on the network adapter and the CPU. Typically, the rate will fall below the line rate of the network.E»ÞÀ( €:€&°Œš‚H€‚ÿNDIS Configuration Optionsg™ÀEÂI `€=€$Šš‚H€€€€€€€€€€€€‚ÿInterface and Module References - The Interface and Interface Mode options are grayed on the Module menu when an NDIS module is the currently selected module. The Identify option on the Module menu is grayed and does not function when the current module is an NDIS module.K ÞÀÃ+ $€A€$Šš‚H€€‚ÿSet Capture Buffer and Packet Slicing Size - The capture buffer memory size can be set in increments that double from 64K to 16MB. The buffer size uses physical memory and the size settings are automatically updated by Surveyor depending on the system resource to an appropriate size./E¿Ã, (€€tŠA‚šÃ}‚A€‚ÿY(ÃÄ1¥ÿÿÿÿÿÿÿÿ«ÄiÄÝÄSurveyor Help System Version InformationQ+¿ÃiÄ& €V€&˜š€‚ÿSurveyor Help System Version Informationt>ÄÝÄ6 <€~€$Šš€‚€‚€†"€b‚ÿSurveyor Help System, Version 3.0Shomiti Systems, Inc.LiÄ)Å1äÿÿÿÿÿÿÿÿ¬)ÅmÅ ÇContacting Customer SupportDÝÄmÅ& €<€&˜š€‚ÿContacting Customer SupportnI)ÅÛÅ% €’€$Šš€‚ÿThere are several ways to contact Shomiti Systems if you need support.âmÅõÆ8 >€Å€tŠA‚šÃ}‚A€ƒ‚ƒ‚ƒ‚ƒ‚ƒ‚ÿCustomer Support Phone(408) 437-4059Customer Support FAX(408) 437-4041Internet Addresssupport@shomiti.comWorld-Wide Webhttp://www.shomiti.comMailing AddressShomiti Systems, Inc.1800 Bering DriveSan Jose, CA 95112+ÛÅ Ç( €€$Šš‚A€‚ÿ1õÆQÇ1Uÿÿÿÿÿÿÿÿ­ÿÿÿÿQÇuÇ$ ÇuÇ" €€€ÿMQÇÂÇ1ŽqĈ9®ÂÇÈdÎFrame Size Distribution ViewEuÇÈ& €>€&˜š€‚ÿFrame Size Distribution View ÔÂÇË9 @€«€$Šš€‚†"€+€€‚‚‚‚ÿFrame size distribution is available as a table or a chart. From Detail View, click on the button to open a window with frame size distribution view. From Summary View, set the view preferences to Frame Size Distribution to see this view in the first tab.NOTES: When using CMM2 or GAM modules, frame sizes of less than 64 bytes are not counted or displayed in Frame Size Distribution view.When using an NDIS module, the byte count in Frame Size Distribution view includes the 4 bytes of the Frame Check Sequence; however, for other views, these 4 bytes are not counted for each packet. Therefore, the total-byte counters in other views will be different than total-byte counters in Frame Size Distribution view./ÈCË' €€œŒ‚€‚ÿCHARTÆžË Ì( €=€$Šš‚€‚ÿEach range of frame sizes is expressed as a percentage of the total number of frames counted. The chart can be toggled between a pie chart and a bar graph./CË8Ì' €€œŒ‚€‚ÿTABLE±‰ ÌéÌ( €€$Šš‚€‚ÿFrame size distribution view as a table shows a range of frame sizes expressed as a percentage of the total number of frames counted. –%8ÌÍq ²€J€$Šš‚€†Œ€ÀCµ¿!,PI(`Surveyor.hlp',`Columns_for_Frame_Size_Distribution_View')‚ÿ Click here to see table columns.2 é̱Í' €€œŒ‚€‚ÿSEE ALSOT$ÍÎ0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views _/±ÍdÎ0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module KίÎ1"„9¢:¯¯ÎòÎgProtocol Distribution ViewCdÎòÎ& €:€&˜š€‚ÿProtocol Distribution ViewƯÎÄ7 <€!€$Šš€†"€,€€‚‚‚ÿFrom Detail View, click on the button to open a window with Protocol Distribution View. From Summary View, set the view preferences to Protocol Distribution to see this view in the first tab.Protocol distributòÎÄdÎion view is available as a chart or a table. Protocol distribution view shows the distribution of major network protocol types. GAM devices do not support this view in monitor mode.0 òÎô' €€œŒ‚€‚ÿ CHART yÄ”' €ò€$Šš‚€‚ÿProtocol distribution as a chart can be viewed in many different ways, depending on the buttons selected in the view. ·HôKo ®€€$Šš‚€†ˆ€ÀC³¿!,PI(`Surveyor.hlp',`Buttons_for_Protocol_Distribution_View')‚ÿ Click here to see the controls for the protocol distribution chart./”z' €€œŒ‚€‚ÿTABLEtMKî' €š€$Šš‚€‚ÿProtocol distribution as a table shows frame and byte counts by protocol. ”%z‚o ®€J€$Šš‚€†ˆ€ÀC³¿!,PI(`Surveyor.hlp',`Columns_for_Protocol_Distribution_View')‚ÿ Click here to see table columns.2 î´' €€œŒ‚€‚ÿSEE ALSOT$‚0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views _/´g0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module @§1åĈ9ý:°§ß“ Host Table View8gß& €$€&˜š€‚ÿHost Table View é§ÿ7 <€Õ€$Šš€†"€/€€‚‚‚ÿFrom Detail View, click on the button to open a window with Host Table View. From Summary View, set the view preferences to Host Table to see this view in the first tab.Host Table View is available as a chart showing the ten MAC stations with the most traffic or as table showing all MAC stations. Click on the tab at the bottom of the window to select table or chart.The station address and name are provided in the table or chart. If a Surveyor name table exists with an address-to-name entry for this station, the Station Name field will be the station name in the name table. If no entry in a Surveyor name table exists, the name of the Station Name field will be the vendor's ID followed by the last 6 bytes of the station address.]8ß\% €p€$Šš€‚ÿGAM devices do not support this view in monitor mode./ÿ‹' €€œŒ‚€‚ÿCHART*\µ ( €€$Šš‚€‚ÿHost Table View as a chart shows only ten MAC stations. The ten stations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" stations based on a different station information field./‹ä ' €€œŒ‚€‚ÿTABLE÷µ  ( €ï€$Šš‚€‚ÿHost Table View as a table shows network activity from the view of MAC stations. The table lists statistics for all stations found. The table can be customized to include other columns of information, or to delete columns you don't want to see.‰%ä Œ d ˜€J€$Šš‚€†r€ÀC¨¿!,PI(`Surveyor.hlp',`Columns_for_Host_Table_View')‚ÿ Click here to see table columns.†_  ' €¾€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected MAC station. 2 Œ D ' €€œŒ‚€‚ÿSEE ALSOT$ ˜ 0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views ND æ 0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views N˜ 4 0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Views _/æ “ 0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module N4 á 1q ¢:bƒ:±á 'ÑFNetwork Layer Host Table ViewF “ '& €@€&˜š€‚ÿNetwork Layer Host Table View«tá Þ@7 <€ë€$Šš€†"€0€€‚‚‚ÿFrom Detail View, click on the button to open a window with Network Layer Host Table View. From Summary View, set the view preferences to Network Layer Host Table to see this view in the first tab.Network layer host table view is available as a chart showing the ten network stations with the most traffic or as a table showing all network stations. Click on the tab at the bottom of the window to select table o'Þ@“ r chart.The station address and name are provided in the table or chart. The name and address will be the same if Surveyor does not have a name table with an address-to-name correspondence for this station. ]8';A% €p€$Šš€‚ÿGAM devices do not support this view in monitor mode./Þ@jA' €€œŒ‚€‚ÿCHART<;A¦B( €)€$Šš‚€‚ÿNetwork Layer Host Table View as a chart shows only ten network stations. The ten stations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" stations based on a different station information field./jAÕB' €€œŒ‚€‚ÿTABLEÞ¦BÛC( €½€$Šš‚€‚ÿNetwork Layer Host Table View as a table shows network activity from the view of network stations. The table lists statistics for all stations found. The table can be customized to include other columns of information. —%ÕBrDr ´€J€$Šš‚€†Ž€ÀCúx!,PI(`Surveyor.hlp',`Columns_for_Network_Layer_Host_Table_View')‚ÿ Click here to see table columns.ŠcÛCüD' €Æ€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected network station. 2 rD.E' €€œŒ‚€‚ÿSEE ALSOT$üD‚E0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views N.EÐE0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views N‚EF0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Views _/ÐE}F0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module *F§F' €€$Šš‚€‚ÿ*}FÑF' €€$Šš‚€‚ÿR!§F#G1… ý:5;²#GmGÆ€Application Layer Host Table ViewJ$ÑFmG& €H€&˜š€‚ÿApplication Layer Host Table ViewzC#GçI7 <€‰€$Šš€†"€1€€‚‚‚ÿFrom Detail View, click on the button to open a window with Application Layer Host Table View. From Summary View, set the view preferences to Application Layer Host Table to see this view in the first tab.Application Layer Host Table View is available as a chart showing the ten network stations with the most traffic or as a table showing all network stations.The network station address and name are provided in the table or chart. The name and address will be the same if Surveyor does not have a name table with an address-to-name correspondence for this station. ]8mGDJ% €p€$Šš€‚ÿGAM devices do not support this view in monitor mode./çIsJ' €€œŒ‚€‚ÿCHARTR*DJÅK( €U€$Šš‚€‚ÿApplication Layer Host Table View as a chart shows only ten applications over network stations. The ten stations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" stations based on a different station information field./sJôK' €€œŒ‚€‚ÿTABLE̤ÅKÀM( €I€$Šš‚€‚ÿApplication Layer Host Table View as a table shows network activity from the view of application protocols running on network stations. The table lists all application protocols found on each network station. Each network station may have many application protocols in use. The table lists statistics of all applications within the stations found. The table can be customized to include other columns of information.›%ôK[Nv ¼€J€$Šš‚€†–€ÀC^­!,PI(`Surveyor.hlp',`Columns_for_Application_Layer_Host_Table_View')‚ÿ Click here to see table columns.ŠcÀMåN' €Æ€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected network station. 2 [NO' €€œŒ‚€‚ÿSEE ALSOT$åNkO0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views NO¹O0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views NkO€0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Vie¹O€ÑFws _/¹Or€0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module *€œ€' €€$Šš‚€‚ÿ*r€Æ€' €€$Šš‚€‚ÿAœ€1Ýbƒ:ˆ;³@ì‰Host Matrix View9Æ€@& €&€&˜š€‚ÿHost Matrix View2ûr„7 <€ù€$Šš€†"€2€€‚‚‚ÿFrom Detail View, click on the button to open a window with Host Matrix View. From Summary View, set the view preferences to Host Matrix to see this view in the first tab.Host Matrix View is available as a chart showing the ten MAC conversations with the most traffic or as a table showing all MAC conversations. Click on the tab at the bottom of the window to select table or chart.The station addresses and names are provided in the table or chart. If a Surveyor name table exists with an address-to-name entry for this station, the Station Name field will be the station name in the name table. If no entry in a Surveyor name table exists, the name of the Station Name field will be the vendor name followed by the last 6 bytes of the station address.]8@Ï„% €p€$Šš€‚ÿGAM devices do not support this view in monitor mode./r„þ„' €€œŒ‚€‚ÿCHART3 Ï„1†( €€$Šš‚€‚ÿHost Matrix View as a chart shows only ten MAC conversations. The ten conversations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" conversations based on a different information field. /þ„`†' €€œŒ‚€‚ÿTABLEöÎ1†V‡( €€$Šš‚€‚ÿHost Matrix View as a table shows network activity from the view of MAC station pairs. The table lists statistics for all pairs found. The table can be customized to include other columns of information.Š%`†à‡e š€J€$Šš‚€†t€ÀCŨ!,PI(`Surveyor.hlp',`Columns_for_Host_Matrix_View')‚ÿ Click here to see table columns.‹dV‡kˆ' €È€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected MAC conversation. 2 à‡ˆ' €€œŒ‚€‚ÿSEE ALSOT$kˆñˆ0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views Nˆ?‰0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views Nñˆ‰0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Views _/?‰ì‰0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module J‰6Š1|5;';´6ŠxŠËÂNetwork Layer Matrix ViewBì‰xŠ& €8€&˜š€‚ÿNetwork Layer Matrix View¨q6Š 7 <€å€$Šš€†"€3€€‚‚‚ÿFrom Detail View, click on the button to open a window with Network Layer Matrix View. From Summary View, set the view preferences to Network Layer Matrix to see this view in the first tab.Network Layer Matrix View is available as a chart showing the ten network conversations with the most traffic or as a table showing all network conversations. Click on the tab at the bottom of the window to select table or chart.The station addresses and names in the conversation are provided in the table or chart. The name and address are the same if Surveyor does not have a name table with address-to-name correspondences.]8xŠ}% €p€$Šš€‚ÿGAM devices do not support this view in monitor mode./ ¬' €€œŒ‚€‚ÿCHART>}êŽ( €-€$Šš‚€‚ÿNetwork Layer Matrix View as a chart shows only ten network conversations The ten conversations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" conversations based on a different information field./¬' €€œŒ‚€‚ÿTABLEÛêŽ(À( €·€$Šš‚€‚ÿNetwork Layer Matrix View as a table shows network activity from the view of network station pairs. The table lists statistics for all pairs found. The table can be customized to include oth(Àì‰er columns of information.“%»Àn ¬€J€$Šš‚€††€ÀCΨ!,PI(`Surveyor.hlp',`Columns_for_Network_Layer_Matrix_View')‚ÿ Click here to see table columns.h(ÀJÁ' €Ð€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected network conversation. 2 »À|Á' €€œŒ‚€‚ÿSEE ALSOT$JÁÐÁ0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views N|ÁÂ0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views NÐÁlÂ0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Views _/ÂËÂ0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module NlÂÃ1o ˆ;Ú‡;µÃ_ÃÌApplication Layer Matrix ViewF ËÂ_Ã& €@€&˜š€‚ÿApplication Layer Matrix Viewªsà Æ7 <€é€$Šš€†"€4€€‚‚‚ÿFrom Detail View, click on the button to open a window with Application Layer Matrix View. From Summary View, set the view preferences to Application Layer Matrix to see this view in the first tab.Application Layer Matrix View is available as a chart showing the top ten application conversations or as a table showing all application conversations. Click on the tab at the bottom of the window to select table or chart.The station addresses and names in the conversation are provided in the table or chart. The name and address are the same if Surveyor does not have a name table with address-to-name correspondences.¯ˆ_øÆ' €€$Šš€‚‚ÿFrom Application Layer Matrix View you can save the data in Optimal CSV format.GAM devices do not support this view in monitor mode./ ÆçÆ' €€œŒ‚€‚ÿCHARTS+¸Æ:È( €W€$Šš‚€‚ÿApplication Layer Matrix View as a chart shows only ten application over network conversations The ten conversations displayed are those transmitting the largest relative percentage of frames. The chart can be customized to show the "top ten" conversations based on a different information field./çÆiÈ' €€œŒ‚€‚ÿTABLE5 :ÈžÉ( €€$Šš‚€‚ÿApplication Layer Matrix View as a table shows network activity from the view of applications over network station pairs. The table lists statistics for applications within all station pairs found. The table can be customized to include other columns of information.—%iÈ5Êr ´€J€$Šš‚€†Ž€ÀC†e!,PI(`Surveyor.hlp',`Columns_for_Application_Layer_Matrix_View')‚ÿ Click here to see table columns.hžÉÄÊ' €Ð€$Šš‚€‚ÿPress the right mouse on any table entry to create a filter using the selected network conversation. 2 5ÊöÊ' €€œŒ‚€‚ÿSEE ALSOT$ÄÊJË0 0€H€$Šš‚ãgHw€‰€‚ÿHints and Tips on Using Views NöʘË0 0€<€$Šš‚ã2Á&]€‰€‚ÿCustomizing Chart Views NJËæË0 0€<€$Šš‚ã¶£Ñ€‚ÿCustomizing Table Views _/˜ËEÌ0 0€^€$Šš‚ã¸>쀉€‚ÿSetting the Monitoring View for a Module X(æËÌ0 0€P€$Šš‚ã­Ä$I€‰€‚ÿExport Data to Optimal CSV Format : EÌ×Ì1';ó<¶×Ì ÍÉVLAN View2 Ì Í& €€&˜š€‚ÿVLAN Viewå×Ì%Ï7 <€Í€$Šš€†"€5€€‚‚‚ÿFrom Detail View, click on the button to open a window with VLAN View. From Summary View, set the view preferences to VLAN to see this view in the first tab.VLAN View is available as table showing statistics or as a chart showing the ten virtual LANs with the most traffic. Click on the tab at the bottom of the window to select table or chart. The only virtual LAN protocol recognized at this time is Cisco's ISL protocol.GAM devices do not support this view in monitor mode./ ÍTÏ' €€œŒ‚€‚ÿCHARTê%Ïr( €Õ€$Šš‚€‚ÿVLAN View as a chart shows only ten VLANs. The ten stations displayed are those with the largest relative percentage of frames. TheTÏrÌ chart can be customized to show the "top ten" conversations based on a different information field./TÏ¡' €€œŒ‚€‚ÿTABLErJr( €•€$Šš‚€‚ÿVLAN View as a table shows network activity from the view of vir