Table of Contents

Using Protocol Decode on UNIX Platforms

Loading a Data Capture File (UNIX)

Selecting Protocol Decode Properties
Establishing Post-Capture Filters

Performing Protocol Decode (UNIX)

Summary Mode
Using Raw Mode
Protocol Decode (Seven-Level, Decoded Format)
Using Zoom Mode

Using Protocol Decode on Microsoft Windows Platforms

Loading a Data Capture File (Microsoft Windows)

Selecting Protocol Decode Properties
Establishing Post-Capture Filters

Performing Protocol Decode (Microsoft Windows)

Using Summary Mode
Using Raw Mode
Protocol Decode (Seven-Level, Decoded Format)
Using Zoom Mode

Decoding Packets

Protocol Decode performs an in-depth analysis of the contents of data packets captured and stored in files created with Data Capture.

This analysis lets you view an individual packet using the full OSI seven-layer analysis feature to detect packet status at each layer. You can use the Zoom feature to examine the individual layers of a packet more closely, or use the Raw mode to examine the individual bytes of a packet.

Protocol Decode is slightly different for UNIX and Microsoft Windows platforms. Use the following section that applies to your specific platform:

• Using Protocol Decode on UNIX Platforms

• Using Protocol Decode on Microsoft Windows Platforms

Using Protocol Decode on UNIX Platforms

The following sections describe how to use Protocol Decode on UNIX platforms:

• Loading a Data Capture File (UNIX)

• Performing Protocol Decode (UNIX)

Loading a Data Capture File (UNIX)

You can start Protocol Decode from the Traffic, Protocol, or Application level of the TrafficDirector main window.

To use Protocol Decode, follow these steps:

The Protocol Decode window is displayed (Figure 29-1).

Figure 29-1: Protocol Decode Window (UNIX)

The Select File window is displayed (Figure 29-2).

Figure 29-2: Protocol Decode Select File Window (UNIX)

The Protocol Decode window is displayed (Figure 29-3) and the contents of the data capture file is displayed. Each line in the display represents one frame.

Figure 29-3: Protocol Decode Window with Captured Data (UNIX)

Selecting Protocol Decode Properties

To modify the four default properties that determine how decoded data in each mode is displayed, follow these steps:

Step 1 In the Protocol Decode window, select the frame you want to decode.

Step 2 Click the Properties button on the main Protocol Decode window.

The Properties window is displayed (Figure 29-4).

Figure 29-4: Protocol Decode Properties Window (UNIX)

Table 29-1 describes the property fields.

Table 29-1: Protocol Decode Properties---UNIX

The Information in This Field....	Performs This Function
Raw Mode	Determines whether the decoded bytes are displayed in as ASCII (default) or EBCDIC characters.
Time Mode	Determines whether the time displayed (in hh:min:sec:msecs) is absolute (the actual time the packet was captured, which is the default), or delta (the difference between arrival of the current and previous packet).
Address Mode	Sets the Source/Destination address display as Network (IP, which is the default), Vendor, or Hex.
Zoom Mode	Enables (default) and disables the multipaneled, multicolor effect in the seven-layer Protocol Decode window and the Zoom Mode feature.

Establishing Post-Capture Filters

Post-capture filters let you to narrow the scope of the display of previously captured data. For example, if you only wanted to see IP, TCP, and FTP packets from all of the packets in a previously captured data file, you could do so by establishing a post-capture filter.

To establish a Post-Capture Filter, follow these steps.

Step 1 From the Protocol Decode window, select Post-Capture Filtering.

The Post-Capture Filters window is displayed (Figure 29-5).

Figure 29-5: Protocol Decode Post-Capture Filters Window (UNIX)

Performing Protocol Decode (UNIX)

Table 29-2 describes the methods you can use Protocol Decode to view contents of a data capture file.

Table 29-2: Protocol Decode Modes---UNIX

Use This Mode...	To View the Data Capture File in This Manner
Summary (default)	In a list box with a separate line entry for each frame within the Data Capture file loaded that has not yet been decoded.
Raw	As a single frame you select that is decoded and presented in raw byte format.
Protocol Decode	As a single frame you select that is decoded and presented in full seven-level format.
Zoom	At any of the seven layers, as appropriate for the packet being decoded; can be displayed in the full window.

Summary Mode

Summary Mode is the default mode of the Protocol Decode main window. Each frame is represented by a single line numbered from 1 to n, where n is the total count of the frames in the capture buffer. The frame currently selected is highlighted.

Table 29-3 describes the headings in the Summary Mode list box.

Table 29-3: Protocol Decode Summary Mode List Box Fields---UNIX

This Field...	Contains This Information
Pkt ID	The index number of the frame, starting with 1.
Timestamp	The timestamp value, determined by the time mode you selected when determining protocol decode properties. The format of the timestamp is: mmm dd hh:mm:ss:ttt. An absolute timestamp reveals the date and time when the frame was captured. For example, Dec 7 17:32:25.569. A delta timestamp reveals the time difference between the arrival of the current and previous packets. For example, Dec 7 0:00:00.014.
Size	The number of bytes in the frame.
Source Node	The address of the node that sent the frame. However, if Vendor Name is the default, the vendor ID displays instead.
Destination Node	The address of the destination node specified in the frame.However, if Vendor Name is the default, the name of the vendor displays instead.
Protocol	The name of the highest-level protocol in the frame.
Information	The source and destination port numbers for TCP and UDP protocols.
Status	If a frame is faulty, the type of fault (more than one may apply): R--- Runt frame (a frame less than minimum length). J---Jabber frame (a frame more than maximum length). C--- CRC/alignment error frame. P---Processing error. For example, Frame #40 with a processing error indicates that the agent was unable to process packets just before capturing Frame #40. --> is a packet from DTE to DCE (WAN only). <-- is a packet from DCE to DTE (WAN only).

Table 29-4 describes these buttons:

Table 29-4: Protocol Decode Selection Buttons

Use This Button...	To Perform This Function
(Change Mode) Raw	Switch directly to Raw Mode to display decoded data in raw (hexadecimal) byte format.
(Change Mode) Protocol	Switch directly to Protocol Decode Mode to display up to seven list boxes, with each box corresponding to successive layers of the protocol.
Up/Down arrows	Scroll up or down one frame at a time.
Home	Display the first frame displayed in the list box.
End	Display the last frame displayed in the list box.
PgUp	Display the entire previous page (page toward the first packet).
PgDn	Display the entire next page (page toward the last packet).

Using Raw Mode

Raw Mode is an option available from the Protocol Decode main window. The Raw Mode displays decoded data in raw (hexadecimal) byte format.

To view protocol information in Raw Mode, follow these steps:

Step 1 Highlight a Pkt Id number.

Step 2 Click Raw (next to the Change Mode label).

The Raw Decode window is displayed (Figure 29-6).

Figure 29-6: Raw Decode Window (UNIX)

Table 29-4 describes the remaining functions of the Raw Decode window that are represented by selection buttons:

Table 29-5: Raw Decode Selection Buttons

Use This Button...	To Perform This Function
(Change Mode) Protocol	Switch directly to Protocol Decode Mode to display up to seven list boxes, with each box corresponding to successive layers of the protocol.
Up/Down Arrows	Scroll up or down one frame at a time.
Home	Display the first frame displayed in the list box.
End	Display the last frame displayed in the list box.
PgUp	Display the entire previous page.
PgDn	Display the entire next page.

Protocol Decode (Seven-Level, Decoded Format)

The seven-level, decoded format for Protocol Decode is an option available from the Protocol Decode main window and the Raw Decode window. Decoding is automatic and causes the frame to display in up to seven list boxes, with each box corresponding to successive layers of the protocol.

To view protocol information in the seven-level format, follow these steps:

Step 1 In the Protocol Decode main window or in the Raw Decode window, highlight a Pkt Id or frame number.

Step 2 Click Protocol (next to the Change Mode label).

The Seven-Level Protocol Decode window is displayed (Figure 29-7).

Figure 29-7: Seven-Level Protocol Decode Window (UNIX)

Using Zoom Mode

Protocol Decode Zoom Mode is an option available from the Seven-level Protocol Decode window. Zoom Mode presents a full display of any displayed protocol layer.

To select Zoom Mode (for the packet currently displayed in the Seven-level Protocol Decode window), click Zoom.

The Zoom Decode window is displayed (Figure 29-8).

Using Protocol Decode on Microsoft Windows Platforms

The following sections describe how to use Protocol Decode on Microsoft Windows platforms:

• Loading a Data Capture File (Microsoft Windows)

• Performing Protocol Decode (Microsoft Windows)

Loading a Data Capture File (Microsoft Windows)

To use Protocol Decode, follow these steps:

Step 1 Load a data capture file.

Step 2 From the TrafficDirector main window, click the Protocol Decode icon.

The Protocol Decode window is displayed (Figure 29-9):

Figure 29-9: Protocol Decode Window---Microsoft Windows

The Select File window is displayed (Figure 29-10).

Figure 29-10: Select File Window (Windows)

The Protocol Decode window is displayed (Figure 29-11). It displays the contents of the data capture file, with each line representing one frame.

Figure 29-11: Protocol Decode Window (Windows)

Selecting Protocol Decode Properties

To modify the four default properties that determine how decoded data in each mode displays, follow these steps:

Step 1 In the Protocol Decode window, select the frame you want to decode.

Step 2 Select Properties from the menu bar.

The Properties window is displayed (Figure 29-12).

Figure 29-12: Protocol Decode Properties Window (Windows)

Table 29-6 describes the properties fields and their contents.

Table 29-6: Protocol Decode Properties---Microsoft Windows

The Information in This Field....	Performs This Function
Raw Mode	Determines whether the decoded bytes are displayed in Raw Mode as ASCII (default) or EBCDIC characters.
Time Mode	Determines whether the time displayed (in hh:min:sec:msecs) is absolute (the actual time the packet was captured, which is the default) or delta (the difference between arrival of the current and previous packet).
Address Mode	Sets the Source/Destination address display as Network (IP, which is the default), Vendor, or Hex.
Zoom Mode	Enables (default) and disables the multipaneled, multicolor effect in the seven-layer Protocol Decode window and the Zoom Mode feature.

Establishing Post-Capture Filters

Post-capture filters let you further narrow the scope of the display of previously captured data.

To establish a Post-Capture Filter, follow these steps:

Step 1 Select Post-Capture Filtering from the Protocol Decode menu bar.

The Post-Capture Filters window is displayed (Figure 29-13):

Figure 29-13: Post-Capture Filters Window (Windows)

Performing Protocol Decode (Microsoft Windows)

Table 29-7 describes how you can use Protocol Decode to view contents of a data capture file:

Table 29-7: Protocol Decode Modes---Microsoft Windows

Use This Mode...	To View the Data Capture File in This Manner
Summary (default)	In a list box with a separate line entry for each frame within the Data Capture file loaded that has not yet been decoded.
Raw	A single frame you select that is decoded and presented in raw byte format.
Protocol Decode	A single frame you select that is decoded and presented in full seven-level format.
Zoom	Any of the seven layers, as appropriate for the packet being decoded; can be displayed in the full window.

Using Summary Mode

Summary Mode is the default mode of the Protocol Decode main window. Each frame is represented by a single line numbered from 1 to n, where n is the total count of frames in the capture buffer. The frame currently selected is highlighted.

Table 29-8 describes the Summary Mode list box headings.

Table 29-8: Protocol Decode Summary Mode List Box Fields---
Microsoft Windows

This Field...	Contains This Information
Pkt ID	The index number of the frame, starting with 1.
Timestamp	The timestamp value, determined by the time mode you selected when determining protocol decode properties. The format of the timestamp is: mmm dd hh:mm:ss:ttt. An absolute timestamp reveals the date and time when the frame was captured. For example, Dec 7 17:32:25.569. A delta timestamp reveals the time difference between the arrival of the current and previous packets. For example, Dec 7 0:00:00.014.
Size	The number of bytes in the frame.
Source Node	The address of the node that sent the frame. However, if Vendor Name is the default, the vendor ID displays instead.
Destination Node	The address of the destination node specified in the frame.However, if Vendor Name is the default, the name of the vendor displays instead.
Protocol	The name of the highest-level protocol in the frame.
Information	The source and destination port numbers for TCP and UDP protocols.
Status	If a frame is faulty, the type of fault (more than one may apply): R---Runt frame (a frame less than minimum length). J---Jabber frame (a frame more than maximum length). C---CRC/alignment error frame. P---Processing error. For example, Frame #40 with a processing error indicates that the agent was unable to process packets just before capturing Frame #40. --> is a packet from DTE to DCE (WAN only). <-- is a packet from DCE to DTE (WAN only).

Table 29-9 describes the remaining functions in the top section of the main Protocol Decode window that are represented by selection buttons:

Table 29-9: Protocol Decode Selection Buttons---Microsoft Windows

Use This Button	To Perform This Function
Up/Down Arrows	Scroll up or down one frame at a time.
Home	Display the first frame displayed in the list box.
End	Display the last frame displayed in the list box.
PgUp	Display the entire previous page.
PgDn	Display the entire next page.
(Mode) Raw	Switch directly to Raw Mode to display decoded data in raw (hexadecimal) byte format.
(Mode) Protocol	Switch directly to Protocol Decode Mode to display up to seven list boxes, with each box corresponding to successive layers of the protocol.

Using Raw Mode

Raw Mode is an option available from the Protocol Decode main window. Raw Mode displays decoded data in raw (hexadecimal) byte format.

To specify a particular frame, follow these steps:

Step 1 Highlight a Pkt Id number.

Step 2 Click Raw (next to the Mode label).

The Raw Decode window is displayed (Figure 29-14).

Figure 29-14: Raw Decode Window---Microsoft Windows

Table 29-10 describes the remaining functions of the Raw Decode window that are represented by selection buttons.

Table 29-10: Raw Decode Selection Buttons---Microsoft Windows

Use This Button...	To Perform This Function
(Change Mode) Protocol	Switch directly to Protocol Decode Mode to display up to seven list boxes, with each box corresponding to successive layers of the protocol.
Up/Down Arrows	Scroll up or down one frame at a time.
Home	Display the first frame displayed in the list box.
Close	Display the last frame displayed in the list box.
PgUp	Display the entire previous page.
PgDn	Display the entire next page.

Protocol Decode (Seven-Level, Decoded Format)

The seven-level, decoded format of Protocol Decode is an option available from the Protocol Decode main window and the Raw Decode window. The decoding is fully automatic and causes the frame to display in up to seven list boxes, with each box corresponding to successive layers of the protocol.

To view protocol information in this format, follow these steps:

Step 1 Highlight a Pkt Id or frame number.

Step 2 Click Protocol (next to the Mode label).

The Seven-level Protocol Decode window is displayed (Figure 29-15).

Figure 29-15: Seven-Level Protocol Decode Window (Microsoft Windows)

Using Zoom Mode

Zoom Mode is an option available from the Seven-level Protocol Decode window. Zoom Mode provides a full display of any protocol layer contained in the Seven-level Protocol Decode window.

To select Zoom Mode (for the packet currently displayed in the Seven-level Protocol Decode window), click Zoom.

The Zoom Decode window is displayed (Figure 29-16).

Figure 29-16: Zoom Decode Window (Microsoft Windows)

Posted: Fri Mar 31 09:08:04 PST 2000
Copyright 1989 - 2000©Cisco Systems Inc.