This section explains the entry fields, buttons, and status area sections of the Capture control panel.

You can capture packets from either a Data Station on the network or a previously saved file that contains captured packets. To specify a Data Station, select the Interface radio button (the default) as shown in Figure 5-3. By default, its entry field contains the name of your workstation followed by a colon. This specifies that packets should be captured using the default interface on your workstation using RPC snooping.

Figure 5-3. Source Radio Buttons

The format for specifying a Data Station and its interface is:

station:interface 

station is the node name of a Data Station that you want to use to capture packets, and interface is the interface that you want to use on that node. (Use the command netstat –i to list the interfaces for a workstation.) If the interface is not specified, Analyzer captures from the node's default interface. For example, to capture packets from the default interface on a Data Station named reddog, type:

reddog: 

If you want to snoop on an interface other than the default, you must specify it. For example, assume that reddog has an additional EFast™ Ethernet board installed and you wish to capture from it. Type:

reddog:fxp0 

For a distributed environment in which a Data Station is connected to each network or segment, you can capture packets remotely. You must, however, have authorization in the /usr/etc/rpc.snoopd.auth file on each Data Station. Thus, you can use Analyzer to collect data from remote networks and to perform remote diagnostics from one location.

To analyze captured packets that have been saved in a file, select the Snoop file radio button and enter the file name in the entry field. Previously saved files can contain the output of NetSnoop (created by redirecting the output of NetSnoop to a file) or Analyzer (see “Save Packets” in this chapter).

Use the Trigger On entry field shown in Figure 5-4 to specify a filter expression to trigger the start of packet capture. When you enter a filter expression on this line, Analyzer does not start to capture packets until it sees a packet that matches the expression. Then all packets that match the Filter entry field are captured. If this entry field is empty, Analyzer begins capturing packets when you press the Start button.

Figure 5-4. Trigger On Entry Field

You can use the NetFilters button in this window to start up NetFilters and to copy a filter from a filter repository to this entry field. To use NetFilters, make sure the insertion point is in this entry field, click the NetFilters button, and select the filter you want to use by double-clicking it. The filter automatically appears in the entry field. See Chapter 2, “NetFilters,” for more information about NetFilters.

A filter allows you to examine only the packets that interest you because only packets that match the given expression are stored. (Filters are described in detail in Chapter 10.) You can type the filter you want to use in the entry field shown in Figure 5-5 or you can use NetFilters. To use NetFilters, make sure the insertion point is in this entry field, click the NetFilters button, then select the filter you want to use by double-clicking it. The filter automatically appears in the entry field. If you leave this entry field blank, Analyzer stores all packets that it captures.

Figure 5-5. Filter Entry Field

You can capture and store error packets by clicking one or more Errors check boxes (shown in Figure 5-6) for the desired errors. The errors you can capture are:

Framing		Packet received, but with framing error
Chksum		Packet received, but with CRC error
Too big		Packet received, but truncated to fit buffer
Too small		Packet received, but size less than minimum Figure 5-6. Errors Check Boxes

If you don't specify any errors, Analyzer captures only packets without errors. See “Capturing Errors” in Chapter 10 for information on filter expressions you can use to capture errors.

The Decode Last entry field shown in Figure 5-7 allows you to specify that you do not want all captured packets stored and decoded, just the last n packets (a post-trigger). This feature enables you to reduce the amount of memory used for stored packets since only n packets are stored. For example, to capture and store 1000 packets takes 1.5 Mb of memory (1000 x 1500, the maximum size of an Ethernet packet), but if you keep only 100 packets, just .15 Mb of memory is used.

If you leave the Decode Last entry field, shown in Figure 5-7, blank, Analyzer captures and decodes the number of packets you specified in the Stop At entry field. If the Stop At and Decode Last entry fields are blank, only one packet is captured and decoded.

Figure 5-7. Decode Last Entry Field

Three Stop At entry fields allow you to specify when to stop capturing packets. To use the first Stop At entry field, shown in Figure 5-8, specify the number of packets matching the filter that you want to store. Analyzer captures and stores the specified number and then stops. The default is to capture one packet. If you leave this entry field and the next two blank, Analyzer captures indefinitely, or until you stop it using the Stop button.

Figure 5-8. Stop At Entry Field

To use the Or After entry field, shown in Figure 5-9, specify the length of time for the capture. For example, suppose you find that a time-out condition occurs after 30 seconds. You can capture packets for 30 seconds and then decode them to determine the cause of the time-out.

Figure 5-9. Or After Entry Field

Enter a filter expression in the Or On entry field, shown in Figure 5-10. When a packet matches that expression, capturing stops. You can use the NetFilters button to start up NetFilters and copy a filter from a filter repository to this entry field. Put the insertion point in this entry field to make NetFilters copy a filter you select to this entry field.

Figure 5-10. Or On Entry Field

You can specify more than one Stop At condition; when the first condition is met, Analyzer stops capturing packets.

By default, the Capture Only entry field shown in Figure 5-11 is blank, which means that Analyzer captures all bytes of each packet. When a number, n, is entered in this field, only the first n bytes of each captured packet are stored and decoded. The maximum number of bytes per packet for Ethernet is 1500 and for FDDI is 4352.

Figure 5-11. Capture Only Entry Field

To start capturing, click the Start button. The status information at the bottom of the control panel changes from “Idle” to “Capturing.” If you entered a trigger expression in the Trigger On entry field, the status changes from “Idle” to “Waiting for Trigger.”

After you press Start, Analyzer checks filters and other values you've specified in the Capture control panel. If it detects any errors in what you've specified, the backgrounds of entry fields with errors become red and a Capture Warning dialog box appears with an error message.

As packets are captured, the Capture statistics section at the bottom of the Capture control panel, shown in Figure 5-12, is updated to report the number of matched, decoded, and dropped packets, and the current status.

Figure 5-12. Status Area of Capture Control Panel

Analyzer stops capturing packets when one of the three Stop At conditions is met or when you click the Stop button.

After the specified packets are captured, they are decoded and the status in the lower left corner changes to “Decoding.” When all packets are decoded, the status returns to “Idle” and Analyzer's main window is updated with the newly captured packet information.

At times, Analyzer reports that packets are dropped, which means that the data you receive may not be complete. This happens when the interface or system buffers become full or other processes are using the CPU. See “Configuring Analyzer for Best Performance” in this chapter for more information.

The Search button enables you to apply a filter to already captured and decoded packets. Packets that do not match the filter are not displayed. To perform a search, configure the Capture control panel for your search, for example type a filter into the Filter entry field, and click the Search button.

For example, suppose you capture 200 packets and then decide that only the NFS packets are of interest to you. Replace the filter in the Filter entry field, if any, with the filter nfs and click Search. The Summary pane of the Analyzer main window changes to show only the packets with nfs in the Type column. You may decide to look at DECnet packets next. Replace the filter with decnet and click Search. All the DECnet packets from the 200 packets are displayed.

The Summary pane lists each packet in order of capture with the time of capture, the packet length, the source and destination nodes, and the protocol type.

For example, the Summary pane for a TCP packet looks like this:

Seq     Time      Len      Source          Port      Destination    Port   Type
  4 09:17:01.61    60 rachel.wpd.sgi.com   1017   eno.wpd.sgi.com   1016   tcp 

Table 5-2 defines the columns of the Summary pane.

The Detail pane decodes the packet highlighted in the Summary pane. It decodes protocol headers layer by layer and disassembles each layer field by field. An example of the decoded layers and fields for a TCP packet looks like this:

ether          Ethernet
          src        Source Address                           8:0:69:6:bd:d8/SGI
          dst        Destination Address                      8:0:69:2:27:73/SGI
          type       Packet Type                              ip
ip             Internet Protocol
          v          Version                                  4
          hl         Header Length                            5
          tos        Type of Service                          0
          len        Total Length                             40
          id         Identification                           17141
          off        Fragment Offset                          0
          ttl        Time to Live                             60 
          p          Protocol                                 tcp
          sum        Header Checksum                          0x1c26
          src        Source Address                           rollon.wpd.sgi.com
          dst        Destination Address                      midas.wpd.sgi.com
tcp            Transmission Control Protocol
          sport      Source Port                              1023
          dport      Destination Port                         513 (rlogin)
          seq        Sequence Number                          43,968,243
          ack        Acknowledgment Number                    1,841,551,347
          off        Data Offset                              5
          flags      Flags                                    ACK
          win        Window                                   61,440
          sum        Checksum                                 0x6ad5
          urp        Urgent Pointer                           0

Notice how Analyzer decoded Ethernet, IP, and TCP layers. Table 5-3 lists and describes the fields decoded in this packet. When you decode a packet and want a description of a field, refer to that protocol's RFC or specification manual for information about its fields. See Appendix C, “Protocols,” for a list of references for the protocol specifications.

You may find the protocol fields in the Detail pane useful when you construct a filter. For example, you may want to use field names such as src, dst, sport, and dport when building a filter.

The Hex Dump pane provides a full listing of the packet highlighted in the Detail pane in both hexadecimal and ASCII formats. For example, the output of a TCP packet in the Hex Dump pane looks like this:

00000: 08 00 69 02 29 38 08 00 69 06 64 68 08 00 45 00   ..i.)8..i.dh..E. 
00016: 00 28 16 D6 00 00 3C 06 23 6A C0 1A 4F 0B C0 66   .(....<.#j..O..f 
00032: 75 04 03 FF 02 02 6D 44 A8 3A 6D 32 C9 FD 50 10   u.....mD.:m2..P. 
00048: EF 88 29 0B 00 00 00 20 00 01 00 20               ..).... ...           

The left column gives the byte offset of the first byte in the row. The middle section displays 16 bytes in hexadecimal. The right section displays those same bytes in ASCII. A dot (.) appears where the ASCII representation of the byte is not a printing character. Typically, the ASCII representation is useful only when the packet contains ASCII text.

You can use the left mouse button in the Hex Dump pane to select the fields of the packet. Click the left mouse button on any character in the middle or right sections of the Hex Dump pane to highlight the field that includes that byte in the hex and ASCII sections of the Hex Dump pane and in the Detail pane.

The “As Snoop File...” choice on the “Save Packets” rollover menu enables you to save stored packets to a file. When you choose “As Snoop File...”, a file prompter window appears. Use it to specify a file name (see “Using a File Prompter” in the Introduction for more details). You can view these packets with Analyzer again by selecting Snoop file radio button as the source in the Capture control panel and specifying this file name.

You can save packets captured by Analyzer in a text file whose format is similar to the three panes of Analyzer. To do this, choose “As Text File...” from the “Save Packets” rollover menu. The dialog box shown in Figure 5-14 appears. Specify the packets you want to save in one of two ways: select the packets in the Summary pane of the Analyzer main window, or enter a packet number sequence in the entry field of the dialog box. A packet number sequence can be a single packet number, a packet number range, for example 100-200, or the word all. Use the check boxes to specify which information (panes) you want to save (Summary, Detail, and/or Hex Dump).

Figure 5-14. Save Packets As Text File Dialog Box

When you click Accept, a file prompter window appears. Use it to specify the file to which you want to save this “Analyzer main window look-alike” version of the decoded packets. The information is appended to the file and appears one packet at a time. For example, if you request Summary, Detail, and Hex Dump information, Analyzer generates a Summary line for each packet followed by the decoding of the protocol layers from the Detail pane, and the hex and ASCII versions from the Hex Dump pane, as shown below.

+++

Seq     Time   Len Source        Port   Destination         Port           Type
0 15:53:09.16  154 192.26.72.5   1023   maddog.wpd.sgi.com  2049 (sunrpc)  nfs

 ether          Ethernet
           src        Source Address                8:0:69:2:26:11/SGI
           dst        Destination Address           2:cf:1f:e0:81:55/CMC
           type       Packet Type                   ip
 ip             Internet Protocol
           v          Version                       4
           hl         Header Length                 5
           tos        Type of Service               0
           len        Total Length                  140
           id         Identification                44143
           off        Fragment Offset               0
           ttl        Time to Live                  58
           p          Protocol                      udp
           sum        Header Checksum               0x7583
           src        Source Address                192.26.72.5
           dst        Destination Address           maddog.wpd.sgi.com
 udp            User Datagram Protocol
           sport      Source Port                   1023
           dport      Destination Port              2049 (sunrpc)
           len        Length                        120
           sum        Checksum                      0x33f9
 sunrpc         Sun Remote Procedure Call
           xid        Transaction ID                13041
           direction  Message Direction             CALL
           rpcvers    RPC Version Number            2
           prog       Program Number                nfs
           vers       Version Number                2
           proc       Procedure Number              16
           credtype   Credential Flavor             AUTH_UNIX
           credlen    Credential Length             32
           cred       Call Credentials              moose:1274.10,10
           verftype   Verifier Flavor               AUTH_NULL
           verflen    Verifier Length               0
 nfs            Sun Network File System
           proc       Procedure                     READDIR
           fh         File Handle                   1e00:4794 [1e00 a0000 12ba 29ceb8f2 a 0 229ce b8f20000]
           offset     Offset                        0
           count      Count                         4096

00000: 02 CF 1F E0 81 55 08 00 69 02 26 11 08 00 45 00   .....U..i.&...E.
00016: 00 8C AC 6F 00 00 3A 11 75 83 C0 1A 48 05 C0 30   ...o..:.u...H..0
00032: 96 1E 03 FF 08 01 00 78 33 F9 00 00 32 F1 00 00   .......x3...2...
00048: 00 00 00 00 00 02 00 01 86 A3 00 00 00 02 00 00   ................
00064: 00 10 00 00 00 01 00 00 00 20 2A AD 2E D5 00 00   ......... *.....
00080: 00 05 6D 6F 6F 73 65 00 00 00 00 00 04 FA 00 00   ..moose.........
00096: 00 0A 00 00 00 01 00 00 00 0A 00 00 00 00 00 00   ................
00112: 00 00 00 00 1E 00 00 0A 00 00 00 00 12 BA 29 CE   ..............).
00128: B8 F2 00 00 00 0A 00 00 00 00 00 02 29 CE B8 F2   ............)...
00144: 00 00 00 00 00 00 00 00 10 00                     ..........

The “Save Controls” choice enables you to save user interface configuration information. This choice has a rollover menu with two choices, “Save” and “Save As...”. These choices save user interface configuration information to the file ~/.analyzerrc or to a file name of your choice. When you choose “Save As...”, a file prompter window appears. Use the procedure in the section “Using a File Prompter” in the Introduction to specify the file name for the user interface configuration data.

By default, the file ~/.analyzerrc is read when you start Analyzer; you can specify a different network configuration file at startup with the –u command line option.

To exit Analyzer, select “Quit” from the File menu. An Analyzer Question window appears. To save the current Capture control panel settings in the file shown in the message and to quit Analyzer, click the Yes button. To quit without saving configuration information, click the No button. If you want to write the information to another file or decide not to quit NetLook, click the Cancel button.

Table 5-4 shows the packets that Analyzer stores during four sessions in which it captures identical packets. Each session has different specifications for the Trigger On, Filter, and Or On entry fields.

In Session 1, no expressions are given so Analyzer stores all packets it captures.

In Session 2, Analyzer waits for the Trigger On expression (nfs), stores all packets on the network because no filter to compare the packets to is specified, and stops capturing when it sees a UDP packet because udp was specified in the Or On entry field.

In Session 3, Analyzer stores only TCP packets because they match the tcp filter.

In Session 4, Analyzer waits for an NFS packet (the trigger), stores only TCP packets because they match the tcp filter, and stops capturing when it sees a UDP packet.

Suppose you know that a condition occurs after a certain number of packets (say, 200) are captured. You suspect that the last few packets cause the condition. Use a value in the Decode Last entry field as a post-trigger to store (and subsequently decode) only the last few captured packets. Capture 200 packets and store the last 20 that were captured by filling in Capture control panel entry fields as shown in Figure 5-15.

Figure 5-15. Example Decode Last and Stop At Entry Fields

Analyzer captures 200 packets, stores the last 20 captured, and decodes these 20 packets.

As another example, suppose you know that a problem occurs before an NFS packet whose procedure field (proc) contains GETATTR. To view the last 30 packets before the GETATTR packet, specify Capture control panel entry fields as shown in Figure 5-16.

Figure 5-16. Example Decode Last and Or On Entry Fields

Analyzer captures all packets from the time you click the Start button, but it stores only the last 30 packets it has seen. It stops capturing when it finds a packet with nfs.proc equal to GETATTR, then decodes the 30 stored packets.

The example in “Using NetLook to Monitor Network Security Intrusions” in Chapter 3 describes how to use NetLook to identify a network security breach and trace its source. Often, however, just knowing that a breach has occurred and who the violator is may not be sufficient. To understand the implications of the breach, you may want to know exactly what transpired. For instance, were files copied or changed? Use Analyzer to help you rebuild what happened; it records a network intrusion in its entirety, packet by packet.