Copyright: (c) 1994 Network Instruments, LLC


Contents

Introduction

License Agreement

Installation

Using Observer

Capturing Packets

Discovery Mode

Filters

Long Term Bandwidth Utilization

Monitoring Bandwidth Utilization

Modes

Network Statistics

Printing Captured Packets

Saving Captured Packets to a File

Select Filter

Settings

Viewing Captured Packets


Introduction

 Observer is a LAN (Local Area Network) packet viewer and much more.

Observer was designed to be useful for both the average LAN user and the computer professional.  Observer can be used by a system administrator, network user, programmer, network application developer, network product tester or anyone who needs to know what exactly happens on their networks, and how to make them run smoothly.

After using Observer, network administrators will not be able to imagine how was it possible to work without it.   Observer allows you to truly "see" your LANs workings.

Observer allows you to keep track of your network conditions, warn you about a network overload, capture packets from a single computer (or multiple computers) on the network, or if you wish - all computers.

You can choose to trace all protocols on your network, or choose only TCP/IP, or only Novells IPX/SPX suite of protocols.  For the IPX/SPX suite, you can view and decode IEEE 802.3, ETHERNET_II (8137), 802.2 SNAP, and/or 802.2 frame types.  Many Novell networks support one, two or all of these protocols, and if you want you can choose capturing all protocols simultaneously.

A Bandwidth Utilization and Long Term Bandwidth Utilization graphs allow you to monitor the general state of your LAN.

Packet Capture and filtering can help you localize existing problems.  Translation of packets into function and type gives an record and an explanation of the data exchange on a LAN.  If you need to thoroughly study packet content byte by byte, raw mode allows the packets to be viewed without any translation.  Once packets are captured, you can filter and print captured packets to a printer, or to a file.

Network Statistics let you see who is using your LAN and what is generating traffic.

Discovery Mode allows you to capture all of the network addresses on your LAN, store them in the filters table, and alias them as names or IP addresses.


License Agreement

Observer is neither freeware nor shareware.  This is a commercial software package that is subject to international copyright laws.  Network Instruments, LLC  reserves all rights on development and distribution of the Observer  package.

Upon registration of the Observer product you are licensed to use Observer at one site on one LAN.  You may not move the Observer license from one site to another.  If you have multiple LANs (LANs which are not connected to each other) or multiple physical sites (different locations or buildings) you will need to purchase additional copies of Observer.

For information on how to purchase a  license for Observer please contact Network Instruments, or see the ORDER.DOC that came with your demonstration copy of Observer.

Network Instruments, LLC

P.O. Box 581156

Minneapolis, MN  55458-1156

Voice	(612) 822-2025

FAX 	(612) 825-5647

BBS 	(612) 822-0902

Network Instruments, LLC shall not be liable for material, equipment, data or time loss, caused directly or indirectly by proper or improper use of the Observer software.  Network Instruments, LLC does not take any other responsibility.

By using the product "Observer" you agree with the above stated license.


Installation

You can install and use Observer in the following two ways:

1. You can run Observer in DEMO mode to simulate LAN traffic and see what Observer looks like, or;

2. You can install the licensed version on your PC using either ODI, NDIS or the Packet Driver.

1. Using Observer in DEMO mode

For the using Observer in DEMO mode, you should run the Install program from your floppy or hard drive, and choose "Continue" from the first screen.  Install will then ask for an installation directory, and will default to C:\OBSERVER.  Check the box on the bottom of the screen to install Observer in DEMO mode, and Install will decompress and install the Observer program.

You should now have an Observer program group and an Observer icon.  Double click on the icon to start Observer in DEMO mode.

Should you decide that you want to license Observer, choose " License" from the "File" menu and follow the instructions.

2. If you own the licensed version of Observer

See the installation instructions in the manual for more information on using the licensed version of Observer.


Using Observer

Observer has five main modes of operation:

1. Discovery Mode allows you to capture all of the network addresses on your LAN, store them in the filters table, and alias them as names or IP addresses.

2. Packet Capture allows you to capture packets.  Once  packets have been captured, you can view the capture buffer contents or filter and print the results.  The packets captured will depend on the filters you set in the Filters dialog.

3. Bandwidth Utilization allows you to view a real-time graph of your network traffic, graphed against the network theoretical maximum bandwidth.

4. Long Term Bandwidth Utilization allows you to view you bandwidth utilization over an extended period of time.  This graph shows high, low, and average utilization points for a configurable time periods.  You either view this graph, or export the data to a comma delimited file.

5. Network Statistics mode displays the network utilization based on the network station or network protocol or shows packet size distribution based on station address.

Capturing of packets and Network Statistics allow filtering based on address or protocol or both.  LAN bandwidth utilization does not use any filters (it reads and records all packets regardless of type or address).

For monitoring of network utilization you must set your maximum theoretical network bandwidth of your network in the "Modes" then "Settings" dialog box (default is set 10MB/s - the speed of an ethernet network).

The Network Statistics mode also gives you a way to discover the network addresses on your LAN and copy an address to the clipboard to use in the filter and alias dialog boxes.


Capturing Packets

Observers main screen consists of a menu bar, monitor graph, Start(/Stop), View and Clear buttons.

Note: To capture packets, you must first select a filter set.  This can be done using the "Filters" menu choice from receive packets screen to bring up the "Filters" dialog box.  See the help section on "Filters" for more information.

To begin capturing packets press the "Start" button.  You will see three different lines on the capture graph.  The red line shows the non-captured traffic, the blue line shows the captured traffic, and the black line shows the dropped packets.

Note the red blinking "Capturing" in the upper right hand corner of the graph.  This is your "capture is on" indicator.  Observer will also tell you the percent of your capture buffer that is full, and will automatically stop capturing when the buffer becomes full.  For more information on the capture buffer size see the "Settings" section.

Once you have captured the packets you can view the packets with the "View" button.  Pressing the "View" button will turn capturing off unless you disable the "Stop capturing if switched from the main window" checkbox from the "Modes" then "Settings" dialog box.

For information on viewing captured packets see the "Viewing Captured Packets" section.

To stop capturing packets press the "Stop" button.

To clear the capture buffer press the "Clear" button.


Bandwidth utilization
Monitoring Bandwidth Utilization

The Bandwidth Utilization screen can be activated from the main window by selecting "Modes" then "Bandwidth Utilization".

The Long Term Bandwidth Utilization screen can be activated from the main window by selecting "Modes" then "Long Term Bandwidth Utilization".

Bandwidth Utilization

Once you are in the Bandwidth Utilization screen, the graph shows the current utilization, as well as the Maximum Utilization.  This graph is a rolling 8 minute "snapshot" of your LAN segment.

Long Term Bandwidth Utilization

Long Term Bandwidth Utilization (LTBU) can be selected from the Modes then "Long Term Bandwidth Utilization".

Once the LTBU graph pops up, it automatically begins capturing data.  Three lines will be shown, red - maximum, blue - average, and green for minimum.  Although data points are only shown for the time period set in "Modes" then "Settings", data is collected and processed every second.

The scroll bar at the bottom of the graph will allow you to see historical utilization data.  The LTBU graph can collect 10,922 data points.  So, for example, if you choose a 1 minute averaging time, this calculates out to 7.59 days before the LTBU graph will reach its data limit.

See the Settings section for more information on Averaging Time and Time scales.

Note that neither Bandwidth Utilization or Long Term Bandwidth Utilization are subject to any filters.

See Also:

Settings


Network Statistics

The Network Statistics screens can be activated from the main window by selecting "Modes" then either:

Received Packets Statistics - shows the Received Packets Statistics screen.

Size Distribution Statistics - shows the Size Distribution Statistics screen.

Protocol Statistics - shows the Protocol Statistics screen.

For more information see:

Received Packets Statistics

Size Distribution Statistics

Protocol Statistics


Received Packets

To start the Received Packets capture press the "Start" button.  To stop the capture, press the "Stop" button.

Once you are in the Received Packets screen, you have a number of choices to make.  By default, the traffic list will show all traffic (as described by your current filter selections) by the "Destination Address".  You can press the "Direction" button to switch from a "Destination Address" listing to "Source Address" listing.

You can press the "-Aliases" button to switch from a listing of Source or Destination Address as a hard network address or as an aliases that you have set up in the "Filters" dialog box.  When the button shows "-Aliases", aliasing is off, when it shows "+Aliases" aliasing is on.

The "Clear" button clears the current capture buffer.

The "%" field show the percent of  bandwidth utilization for that destination/source address, based on the current filter.

The "Packets" field shows the number of packets to (or from) the destination/source address.

The "Bytes" field shows the bytes to (or from) the destination/source address.

Once the capture begins, you can double click on any address to copy the hard address into the windows clipboard.  When this is done in conjunction with a filter of  "ANY_ADDRESS" (both directions) it can be a good way to see all of the hard addresses on your segment, and a convenient way to begin building an alias table.  For example, if you double click on an address, and then switch to the "Filter" dialog box, you can then paste that address into the "Hardware address" section with Shift-Ins.


Size Distribution
Size Distribution Statistics

The Destination/Source Address field will show either the destination or source address.

The % field shows the percent of  bandwidth utilization for that destination/source address.  Note that this is the % of filtered packets.  If you would like to see the percent of total packets that that particular address is using, you will need to set up an ANY_ADDRESS to and from ANY_ADDRESS filter.

The Packets field shows the number of packets to (or from) the destination/source address, subject to the current filter set.

The rest of the screen shows the packet size distribution divided by packet size in bytes.  This is shown as a percentage of the total for that address.


Protocol Statistics

The Protocol Statistics screen shows LAN traffic divided by network protocol and sub-protocol.  Protocols are displayed as a percentage of the total filtered traffic.  Sub-protocols are displayed by the number of packets received of that type


Filters

The "Filters" dialog allows you to select one to five computers (or hosts), whose network traffic you want to capture or get statistics about.

You can select "ANY_ADDRESS " to get information from one computer to any address or any address to one computer.

You can also select "ANY_ADDRESS" to and from "ANY_ADDRESS" to activate a "filter" that sees all addresses, and thus all LAN activity.

Filtering can be done by address or protocol or both.  You can select a protocol that you intend to monitor, or receive all protocols present on your network.  Observer currently supports translation of IP and IPX/SPX suite of protocols.  Other protocols are viewed in raw mode.

After you made changes in the Filters dialog you can either click on "O.K." button to save and enable the changes, or "Cancel" to discard all changes and preserve previous filter settings.

See Also:

Adding and Editing Hardware Addresses

Setting Filters

Choosing Protocol


Adding hardware addresses
Adding and Editing Hardware Address

The hardware address listbox shows the addresses (and aliases) you may want to monitor.  You can create as many entries as you like (although you can only monitor 5 at a time).

The format of an Ethernet entry is the six numbers of the ethernet address separated by colons or dots, a Token Ring entry is the Token Ring address.  This may be followed by an alias up to 17 letters long (you should include one space between the address and the alias).  The alias is a name that Observer will substitute for an address when showing the headers of incoming packets when you tell Observer to use aliases.  This can make packets easier to recognize and analyze.

For example:

00:02:8A:49:B2:48    Al Gore

To add an entry: enter the address in the edit line on top of the edit screen and press <ENTER> or click on a down arrow at the end of the edit line.  The entry will be added to the list.  To edit existing entry, choose that entry and  click on "Edit" button to the right from the hardware addresses list, or simply double-click on the line you want to edit.  It will appear in the edit line and you can make all necessary changes and save it as described above.  You can not edit or change the "ANY_ADDRESS" entry.

To remove an entry highlight it by a clicking on it and press the "Remove" button.


Setting Filters

Observer filters allow you to capture packets coming from one hardware address to another - in one or both directions:  All incoming packets to a particular address from any source, all outgoing packets from a particular address to any destination, or all the traffic on the network - subject to the protocol sub-filter.

To set up a filter, select one of the five lines in the three boxes below the hardware address with a mouse click.  Then click on an address you want to monitor in the hardware address box and click on the Add button over right or left filter sub-box.  Repeat the above procedure for the second address.

Once you have added both addresses, you can choose the direction to capture.  Choose the right arrow to only see packets from the left address the right address on the filter line.  Choose the left arrow to only see packets from the right address to the left address on the filter line.  Choose the bi-directional arrow to see packets from or to the right and left addresses on the filter line.

If you want to capture all packets in one or both directions - select the line ANY_ADDRESS in the hardware addresses box and add it to the filter line.

If you want your current filters to be loaded on startup of Observer, check the Enable current filters on startup box, otherwise Observer will start up with no filter and thus default to a capture all packets state.


Choosing Protocol

Observer allows you to select a protocol that you want to monitor.

To choose a protocol click the arrow on the right of the "Protocol" line at the bottom of the "Filters" dialog box.  A list of supported protocols filters will appear.  Select the option that best filters the situation you have.  It is best to do as much filtering as possible when trying to isolate network problems.

Note: Observer can analyze many more protocols that it allows to filter, and if your particular protocol is not present in the list of protocols, just choose "All protocols" (no filtering by protocol) line.


Modes

The "Modes" menu shows both a Settings selection and choice of operating mode.

Settings - the dialog box that allows customization of global monitor parameters.  For example, the capture buffer size, and other conformation information.

Modes:

Settings - The Settings dialog lets you configure Observers options.

Packet Capture - shows the receive packet graph.

Bandwidth Utilization - shows the bandwidth utilization graph

Long Term Bandwidth Utilization - shows the bandwidth utilization graph

Received Packets Statistics - shows the Received Packets Statistics screen.

Size Distribution Statistics - shows the Size Distribution Statistics screen.

Protocol Statistics - shows the Protocol Statistics screen.

Discovery Mode - allows you to discover new addresses on your LAN.

To select on of the four modes, click Modes then one of mode choices, and you will see that mode on your screen.

For detailed information see:

Settings

Capturing Packets

Monitoring Bandwidth Utilization

Network Statistics


Viewing received packets
Viewing Captured Packets

To view the packets captured in the capture buffer, click on the "View" button from the "Packet Capture" screen.

Once you are in the view screen you can click on a particular packet to see the packets decoded information.  Observer decodes all Novell packets and all IP packets.  Other packets are shown in raw mode.

You can click on one of the packet types on the top part of the screen with your right mouse button to set a default color for that packet type.

Post filtering is set up by choosing "Setting" then "View Configuration".  The post- filters will filter out any unwanted data both in the packet decode screen and on any print outs of the data capture.

You can search for a particular packet by choosing "File" then "Find Packet".  This will search the data segment of all packets captured.  You can initiate multiple search windows.

Click on the show aliases box at the bottom of the screen to enable aliasing of network addresses.

The packet buffer can be saved to a file by selecting "File" then "Save Packet Buffer".  Naturally, you can load a packet buffer by selecting "File" then "Load Saved Packet Buffer".


Settings

The settings dialog box allows you to set the global variable information in Observer.

Windows buffer size is the amount of Windows memory that Observer will set aside to store captured packets.  Values are in kilobytes, so a setting of 132 would represent a .132 megabyte (MB) buffer.  A 2048 KB buffer would represent a 2.048 MB buffer.

You should choose the smallest buffer that will capture the event you are interested in looking at.  Observer will show the buffer percentage full and you will get an idea of what is the best buffer for a particular situation.  Keep in mind that a full 4 MB buffer is a lot of data to sort through.  You will want to capture an event in as little time with as little buffer space as possible.

It is not recommended (although it is allowed) to use a buffer larger than the amount of physical RAM in your PC.

On a 16 MB system the maximum recommended buffer is 10 MB (a setting of 10,000).  On a 8 MB system, the maximum recommended buffer is 4 MB (a setting of 4,000).  Again, use the smallest buffer possible to capture the event of interest.

Lock Windows buffer from paging will tell Windows to not page out the Observer packet buffer.  This will make Observer more efficient, since its buffers will always stay in RAM (as opposed to Windows swapping out the buffer).

This is the recommended mode for operation of Observer, but be careful.  If you set your buffer size to high and lock the buffer from paging, Windows may swap out its own programs and cause Windows to crash.

Stop capturing if switched from main window will turn capturing off when you switch focus from the capture graph window.  Switching focus is done when you start another Windows application, when you choose to view packets, or when you move the Windows focus to another window.

Observer can capture packets while Windows is doing something else.  However, under heavy traffic conditions, (or with a slow PC) Observer may drop packets if this option is not checked.

Ask conformation to clear packet buffers - brings up a conformation (yes/no) dialog when the Clear button pressed.

Show Packet Capture Legend - turns the legend off or on in the Capture Packets graph.

Network Bandwidth - select the network bandwidth of your LAN.  This will be used to calculate the % of Bandwidth Utilization when in Bandwidth utilization mode.  Modes are:

4 Mbps	- Used for 4 MB Token Ring

10 Mbps	- Used for all ethernets

16 Mbps	- Used for 16 MB Token Ring

Long Term Bandwidth Utilization (LTBU)

Averaging Time - The amount of time that Observer will collect data for before it averages and reports high, low and average.  Observers LTBU graph can display and record 10,922 data points.  So, for example, you could choose 30 seconds for and averaging time and Observers buffer would capture and display for  10922 (points) / 120 (points per hour) / 24 (hours per day) =3.79 days.

Stretch time scale - By default, the LTBU graph will plot each data point 10 pixels apart (10x) and fill in the distance between with a solid line.  Setting this to 1x will plot data points one pixel apart.  LTBU will plot times on the graph in a manner which insures not time stamps will overwrite the previous or next.  All export files contain all time stamps and all data points as described in the averaging time above.


Printing Captured Packets

Observer allows you to print a packet capture either on your printer or to a file.

Once you have captured some number of packets, go to the View Packets screen (by pressing the "View" button from the Packet Capture graph screen).  From the View Packets screen choose "Print".  This will bring up the print dialog box.  You choices are:

Save to a File (see help item "Saving Captured Packets to a File")

Print

Print Setup

Print - This dialog is where you specify the information Observer should use to when printing a packet capture buffer.  Options are explained below.

The Print dialog box will tell the number of packets that you have in the active capture.  You can save only a specific range of packets, or all packets (the default).  Once you have chosen the range you are interested in, you can specify what kind of packet information you would like to have printed, and how you want the print job formatted.  You can also choose to use hard network addresses or use aliases.

Note: Both printing of a packet buffer and saving to a file will reflect the current display post-filters set.  In other words, if you have used a Customized View Configuration from the " Settings"


Saving to a file
Saving Captured Packets to a File

From the View Packets screen, choose "Print" then "Save to a File".

Save to a File - This dialog is where you specify the information Observer should use to when creating the packet capture dump file.

The Save to a File dialog box will report the number of packets that have been collected in the active capture.  You can save only a specific range of packets, or all packets (the default).  Once you have chosen the range you are interested in, you can specify what kind of packet information you would like to have saved.  You can also choose to use hard network addresses or use aliases.


Select Filter

Once you have set a filter, it can be saved as a named filter that can then be selected at a later time using the Filters, Select Filter dialog.  You can save and name up to 5 different filters to be recalled at a later time.


Discovery Mode

Discovery mode allows you to capture all of the hard network addresses on your LAN, store them in the filters table, and alias them as names or IP addresses.

Press "Start" to begin, and the discovery mode table will begin capturing addresses.  Once captured you can:

Stop - stop the capture

Clear - clear the table

Add/Edit Alias - selecting one address and pressing this button will pop up the edit box to add an alias.  Make sure you click on the down arrow at the right when complete.

Highlight New - shows the new addresses.  These would be addresses that were discovered, but are not yet on you address list in the filter section.

Save Highlighted - saves the highlighted address to your filter table.


TCP/IP

TCP/IP stands for Transport Control Protocol / Internet Protocol.  Actually, TCP is only one (maybe the best known) of the many IP protocols.  Some other examples of IP protocols are UDP and ICMP.


IPX/SPX

IPX/SPX is Novells protocol of choice.  It stands for Internetwork Packet eXchange / Sequential Packet eXchange.  IPX is the workhorse for most Netware applications.  SPX is mostly used to confirm delivery of information.


Filter

Setting filter is a way sort out the data you would like to see from the data you do not want to see.  Filters are key to problem solving with Observer.  You will find that Observer allows both pre- and post- filtering of data and protocols.

Ideally, when you find a potential LAN problem, you should then filter on exactly that station or type of data so that you will not be bothered by extraneous information.


packet

A packet is the bundle of information that one LAN station sends to another.  Packets can contain data, system calls, or just acknowledgements.  LAN traffic is a series of packets.


alias

An alias is a name that you supply that will be displayed instead of a hard network address.  For example, a hard network address might look like:

00:AE:3B:00:F5:C3:11:1A

But you may want to alias this to:

Server 01

This way, all displays will show Server 01, instead of 00:AE:3B:00:F5:C3:11:1A.