 1 Monitoring

You can monitor the network traffic, measuring the flow of packets through the network and viewing their statistics.

The data showed while monitoring is called monitor data .
ASTEC Eyes provides four types of monitor data.

  • Statistical data of traffic
    Displays the traffic classified by source addresses, destination addresses, host pairs, protocols, or combinations of them, in various formats; line chart, bar chart, pie chart, or detailed table.
  • The list of MAC addresses and IP addresses
    Displays the list of the MAC addresses and IP addresses contained in packets.
  • TCP connection status
    Monitors and displays the status of TCP connections on the selected network interface.
  • The ports status of hosts
    Displays the status of the ports of the hosts whose traffic is monitored.
The windows displaying the statistical data of traffic, the list of the addresses, and the TCP connection status is called the monitor windows .
There are three kinds of monitor windows in ASTEC Eyes.
  • traffic window
  • address table
  • TCP status information
The port status of hosts is displayed on the Port Analysis dialog.


 1.1.1 Displaying Monitor Data

You can display network monitor data as follows:

  1. Start Monitoring
  2. Open a Monitor window


 1.1.2 Starting Monitoring

Procedure 1

  1. Select a network interface.
  2. Choose [Start Monitor] from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click on the [Start Monitor] button ( [image]) on the Interface toolbar.
Procedure 3
  1. Right-click on the entry of an interface in the Interface Selector window.
  2. Choose [Start Monitor].


 1.1.3 Pausing Monitoring

Procedure 1

  1. Select a network interface.
  2. Choose [Pause Monitor] from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click on [Pause Monitor] button ( [image]) on the Interface toolbar.
Procedure 3
  1. Right-click on the entry of an interface in the Interface Selector window.
  2. Choose [Pause Monitor].


 1.1.4 Opening a Monitor Window

Procedure 1

  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Choose an item of interest from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Right-click on the entry of an interface of your interest in the Interface Selector window.
  4. Choose the [Monitor].
  5. Choose an item of your interest.


 1.1.5 Displaying Traffic

Procedure 1

  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Choose statistics of your interest from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Right-click on the entry of an interface in the Interface Selector window.
  4. Choose [Monitor].
  5. Choose statistics of your interest.


 1.1.6 Displaying Addresses

IP addresses and MAC addresses are managed for each network interface.
There are three kinds of address tables:

  • MAC address table
  • IP address table
  • MAC address and IP address mapping table

The steps to display address tables are as follows;

Procedure 1

  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Choose [MAC Address Table], [IP Address Table], or [MAC - IP Address Table] from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Right-click on the entry of an interface in the Interface Selector window.
  4. Choose [Monitor].
  5. Choose [MAC Address Table], [IP Address Table], or [MAC - IP Address Table].


 1.1.7 Displaying TCP Connection Status

Procedure 1

  2. Select a network interface.
  3. Start monitoring, if it is not yet started.
  4. Choose [TCP Status Information] from the [Monitor] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Start monitoring, if it is not yet started.
  3. Right-click on the entry of an interface in the Interface Selector window.
  4. Choose [Monitor].
  5. Choose [TCP Status Information].


 1.1.8 Displaying Port Status of a Host

You can display the stauts of UDP and TCP ports of the hosts shown on a Traffic window or Address Table window.

Procedure

  1. Open one of the following Monitor windows:
    • IP Traffic by Source
    • IP Traffic by Destination
    • IP Traffic by Host Pair
    • IP Address Table
    • MAC - IP Address Table
  2. Right-click on the host of your interest.
  3. Choose [Port Analysis].


 1.1.9 Resetting Monitoring

You can initialize (reset) the monitor data of ASTEC Eyes and its Remote Module. Perform the procedure described below for each interface whose monitoring you want initialize.

Procedure 1

  1. Select a network interface.
  2. Choose [Reset Monitor] from the [Monitor] menu of the Main window.
  3. Click [Yes] button.

Procedure 2

  1. Select a network interface.
  2. Right-click on the entry of an interface in the Interface Selector window.
  3. Choose [Reset Monitor].
  4. Click [Yes] button.

Note

  • Resetting the monitor will lose the statistical data, the IP address, the MAC address, and the connection data on TCP which were collected. Moreover, Monitor window will be no longer displayed.
  • Resetting the monitor will stop monitoring automatically.
  • The configuration Privilege is required to reset the monitor.


 1.1.10 Changing the Display Format of the Traffic Window

You can choose how the traffic data is shown; line chart, bar chart, pie chart, or detailed table.

Procedure 1

Click one of the following buttons on the toolbar of each Traffic window:

  • [Line Chart (History)] button ( [image])
  • [Bar Chart (Total)] button ( [image])
  • [Pie Chart (Distribution)] button ( [image])
  • [Table (Detail)] button ( [image])

Procedure 2

  1. Right-click on a Traffic window.
  2. Choose [View].
  3. Select one of the followings:
    • [Line Chart (History)]
    • [Bar Chart (Total)]
    • [Pie Chart (Distribution)]
    • [Table (Detail)]

Further you can choose the line chart is stacked or not.


 1.1.11 Displaying the Property of Chart

You can view the properties of a chart, such as host name, file name, monitor start time, and plotting interval.

Procedure

  1. Right-click on the Traffic window.
  2. Choose [Properties...].
  3. Click on [Information] tab.


 1.1.12 Saving Monitor Data

The monitor data can be saved into a file in comma separated value (CSV), bm, metafile, or enhanced metafile format.

Procedure

  1. Click on the Monitor window whose data you want to save.
  2. Choose [Save Monitor...] from the [File] menu of the Main window.
  3. Specify the file name and file format.

Note

  • The data in a Monitor window of tabular format can be saved only as CSV format.
  • The data being saved will differ, depending on the display format of the Monitor window.
    For example, when the top 10 items are displayed in the source bar chart, only their statistics will be saved.
  • You can use the saved data with other applications. For example, you can insert bmp image in Microsoft Word, or import CSV file into Microsoft Excel.


 1.1.13 Copying Monitor Data to Other Applications

Procedure (charts)

  1. Click on the Monitor window whose data you want to copy.
  2. Choose [Copy] from the [Edit] menu of the Main window, or press <Ctrl-C> key.
  3. Activate the target application and press <Ctrl-V> key.

Procedure (tables)

  1. Right-click on the Monitor window whose data you want to copy.
  2. Choose [Copy Whole Data].
    Pressing <Ctrl-C> key in the tabular format window will copy only the text in the selected cell (surrounded by a white frame).
  3. Activate the target application and press <Ctrl-V> key.

Note

  • You can choose [Paste Special...] of the [Edit] menu instead of pressing the <Ctrl-V> key, with such applications as Microsoft Word and Microsoft Excel.
  • The monitor data being copied will differ, depending on the display format of the Monitor window.
    For example, when the top 10 items are displayed in the source bar chart, only their statistics will be copied.


 1.2.1 Selecting a Graph Item (Traffic)

Procedure 1 (chart)

Click on a Graph Item or its legend.
To select multiple Graph Items, click on each Graph Item or its legend with <Ctrl> key pressed.

While using the chart analysis function, click on a Graph Item with <Alt> key pressed. You cannot select multiple Graph Items, while using the chart analysis function.

Procedure 2 (table)

Click the row corresponding to a Graph Item.
To select multiple Graph Items, click the rows corresponding to each Graph Item with <Ctrl> key pressed.

Procedure 3

  1. Click on the Monitor window.
  2. Press < [image] > or < [image] > key.
    To select multiple Graph Items, move with < [image] > and < [image] > key and select with <Space> key.

Note

  • To select a Graph Item in a line chart, it is recommended to click around the vertices rather than clicking on the line segments.
  • <Ctrl-Space> key toggles the state of the Graph Item between selected and unselected.
  • If you find it difficult to select a Graph Item in a line chart, you can also use corresponding table.
    You can search the string in the Monitor window of tabular format.
  • The name of the selected Graph Item is displayed on the status bar.


 1.2.2 Displaying Specific Data Only

You can display only the selected Graph Item in a line chart of Traffic windows.

Procedure

  1. Select on Graph Item.
  2. Right-click on the chart.
  3. Choose [Show Selected Only].

Note

  • You can open a new Monitor window for the selected Graph Item, choosing [Show Selected Only] while holding down the <Shift> key.


 1.2.3 Hiding Specific Data Only

You can hide only the selected Graph Item in a line chart of Traffic windows.

Procedure

  1. Select a Graph Item.
  2. Right-click on the chart.
  3. Choose [Hide Selected].

Note

  • You can open a new Monitor window which hides the selected Graph Item, choosing [Hide Selected] while holding down <Shift> key.


 1.2.4 Displaying Traffic Breakdown

Procedure

  1. Select a Graph Item.
  2. Right-click on the Traffic window.
  3. Choose [Breakdown].
  4. Choose one of the following menu items:
    • [by Source Hosts]
    • [by Destination Hosts]
    • [by Host Pairs]
    • [by Protocols]

Note

  • You can open a new Monitor window for the breakdown, choosing breakdown while holding down <Shift> key.
  • You cannot display the breakdown, when multiple Graph Items are selected.


 1.2.5 Displaying the Previous Chart

Display the previous chart before you showed/hid an specific Graph Item, or displayed a breakdown.

Procedure

  1. Right-click on the Traffic window.
  2. Choose [Previous Chart].

Note

  • [Previous Chart] is not in the popup menu if a specific traffic is showed or hid on a new window, or a breakdown is displayed on a new window.


 1.2.6 Reading the X-axis Value of a Chart

Procedure

  1. Switch a Traffic window to the line chart format.
  2. Click [Read Values in Chart] button ( [image]) on the toolbar.
  3. Click [Vertical Hair Cursor] button ( [image]) on the toolbar.
  4. Click at or drag the mouse to the position where you want to read the values described below.
    5.  | Clicking | Dragging
Graph Item not selected | the time the vertical cursor is positioned at | the start and end time of the dragged range the time interval of the dragged range
Graph Item selected | Graph Item name the time the vertical cursor is positioned at the value of Graph Item | Graph Item name the start and end time of the dragged range the time interval of the dragged range the total, maximum, minimum, and the average value of Graph Item in the dragged range
  5. You can change the position and the range to read the values also by the keyboard operation. Please refer to "Keyboard Operation within a Monitor Window."

Note

  • When [Read Values in Chart] button ( [image]) is clicked, the Traffic window will be in the following status;
    • The chart is not updated.
    • The popup menu does not appear.
    • The display format of the chart is not changed.
    • The range of Y axis is not changed.
  • When [Vertical Hair Cursor] button ( [image]) is clicked, the mouse cursor will change to the cross hair cursor, and the vertical dashed line will appear. This dashed line is called the vertical cursor.
  • Click [Read Values in Chart] button ( [image]) once again to return to the usual status from the status of reading the values of the chart.
  • The specified area will be zoomed in if you specify an area in the chart by dragging the mouse cursor while holding down the <Shift> key. Right-click while holding down <Shift> key, in order to return to the original chart.
  • You cannot click [Read Values in Chart] button ( [image]), when multiple Graph Items are selected.


 1.2.7 Reading the Y-axis Value of a Chart

Procedure

  1. Switch a Traffic window to the line chart format.
  2. Click [Read Values in Chart] button ( [image]) on the toolbar.
  3. Click [Horizontal Hair Cursor] button ( [image]) on the toolbar.
  4. Click at or drag the mouse to the position where you want to read the values described below.
    Clicking Dragging
    Graph Item not selected the value the horizontal cursor is positioned at (bytes or frames) the lowest and highest values of the dragged range
    the difference of the highest and lowest values of the dragged range
    Graph Item selected Graph Item name
    the value the horizontal cursor is positioned at and all the date and time of the day that the Graph Item takes the specified value         		Graph Item name
    the lowest and highest values of the dragged range
    the difference of the highest and lowest values of the dragged range
  5. You can change the position and the range to read the values also by the keyboard operation. Please refer to "Keyboard Operation within a Monitor Window."

Note

  • When [Read Values in Chart] button ( [image]) is clicked, the Traffic window will be in the following status;
    • The chart is not updated.
    • The popup menu does not appear.
    • The display format of the chart is not changed.
    • The Range of Y Axis is not changed.
  • When [Horizontal Hair Cursor] button ( [image]) is clicked, the mouse cursor will change to the cross hair cursor, and the horizontal dashed line will appear. This dashed line is called the horizontal cursor.
  • Click [Read Values in Chart] button ( [image]) once again to return to the usual status from the status of reading the values of the chart.
  • When a Graph Item is chosen, horizontal cursor moves only among the Y values of the plotting points up and down. It does not move to a position where no plotting points exist.
  • The specified area will be zoomed in if you specify an area in the chart by dragging the mouse cursor while holding down the <Shift> key. Right-click while holding down <Shift> key, in order to return to the original chart.
  • You cannot click [Read Values in Chart] button ( [image]), when multiple Graph Items are selected.


 1.2.8 Searching a String in a Monitor Window of Tabular Form

Procedure

  1. Choose [Find...] from the [Edit] menu of the Main window, or press <Ctrl-F> key.
  2. Enter the text you want to search for, and click [Find Next] button.

Note

  • To use the regular expression, select [Regular Expression] check box.


 1.2.9 Sorting the Rows of Monitor Window of Tabular Form

The rows of the Traffic window of tabular form can be sorted by the cell values of a column.

Procedure

By clicking on a column header in each table, the table will be sorted according to the cell values in the column. Once you click, the table will be sorted in the ascending order. Click again, and the table will be sorted in the descending order this time.


 1.2.10 Displaying Host Names instead of IP Addresses

Search the host names using Domain Name System, WINS (NetBIOS), and the NIS name service, to display hosts by the host names instead of the IP addresses.

Procedure 1 (chart)

  1. Select the Graph Item.
  2. Right-click on the window.
  3. Choose [Search Host Name].
  4. Choose [DNS], [NetBIOS], or [NIS (domain name)].

Procedure 2 (table)

  1. Right-click the row which you want to display hosts by their host names.
  2. Choose [Search Host Name].
  3. Choose [DNS], [NetBIOS], or [NIS (domain name)].

Note

  • You need to specify the NIS domain name before using [NIS (domain name)].


 1.2.11 Using Host Names to Identify Hosts

Host names are used in addition to addresses in the following Traffic windows to identify the hosts;

  • MAC Traffic by Source
  • MAC Traffic by Destination
  • MAC Traffic by Host Pair
  • IP Traffic by Source
  • IP Traffic by Destination
  • IP Traffic by Host Pair
Refer to "Choosing the Host Name Used to Identify the Host" for the type of the host name to be used and the configuration.


 1.2.12 Using Addresses to Identify Hosts

IP addresses and MAC addresses can be used rather than the host names in the Monitor windows to identify the hosts.

Procedure 1

  1. Open [Options] dialog box.
  2. Click [Display Host Name] item in the tree view in the left of the dialog box.
  3. Clear all the check boxes (shown below) in the [Name to display] region.
    • [User Defined Name]
    • [NetBIOS Name]
    • [NIS Name]
    • [DNS Name]

Procedure 2

  1. Choose [Search Host Name...] from the [Tool] menu of the Main window, or press <Ctrl-L> key.
  2. Click [Set Display Preference...] button.
  3. Clear all the check boxes in [Display Host Name] dialog box.

Procedure 3

  1. Choose [MAC Address Book] or [IP Address Book] from [Edit] menu of the Main window.
  2. Right-click on the address book.
  3. Choose [Set Display Preference...].
  4. Clear all the check boxes in [Display Host Name] dialog box.


 1.3 Monitor Filter

You can filter the traffic to be monitored, using the monitor filter.
The filter conditions are configured using the filter editor. You need to configure monitor filters for each interface.
When the monitor filter is applied, all the Monitor windows of the selected interface will be influenced except for the following ones:

  • "MAC Frame Numbers by Frame Size" Traffic window
  • "MAC Error Frames" Traffic window
  • MAC Address Table
  • IP Address Table
  • MAC - IP Address Table
  • "TCP Status Information" window


 1.3.1 Monitoring Specific Data Only

Sometimes you want to monitor only a certain portion of the entire traffic, which can be specified by logical conditions. In this case, you can filter the traffic to be monitored, using the monitor filter.

  1. Define a monitor filter using the filter editor.
  2. Apply the monitor filter to Traffic windows.

Define the monitor filter

Procedure

  1. Open the filter editor.
  2. Click [ [image] Monitor Filter].
  3. Specify logical expressions.

Apply the monitor filter

Procedure 1

  1. Choose [Monitor Filter] from the [Monitor] menu of the Main window.
  2. Choose the filter to apply.

Procedure 2

  1. Click [Monitor Filter] button ( [image]) on the toolbar of the Monitor window.
  2. Choose the filter to apply.

Procedure 3

  1. Right-click on the Monitor window.
  2. Choose [Monitor Filter].
  3. Choose the filter to apply.

Note

  • The monitor filter is applied interface by interface. For example, when the three Monitor windows are displayed to the one interface and the monitor filter is applied, the monitor filter will be applied to all three Traffic windows.


 1.3.2 Making a Monitor Filter from the Traffic on a Chart

You can easily create the logical expressions to select a specific Graph Item on a Traffic window, and set them to the filter editor.

Procedure 1

  1. Choose a Graph Item.
  2. Right-click on the Traffic window.
  3. Choose [Dynamic Filter].
  4. Choose [Send to Filter Editor].

Procedure 2

  1. Open the filter editor.
  2. Drag a Graph Item on the Traffic window and drop it on the [ [image] Monitor Filter] of the filter editor.

Note

  • You cannot open [Generate Filter] nor drag & drop a Graph Item on the filter editor, when multiple Graph Items are selected.


 1.3.3 Displaying Traffic Using a Temporary Monitor Filter

You can easily create the logical expressions to select a specific Graph Item on a Traffic window, and apply them as temporary filter.

Procedure

  1. Select a Graph Item.
  2. Right-click on the Traffic window.
  3. Choose [Dynamic Filter].
  4. Choose [Make and Apply Temporarily].

Note

  • The logical expressions generated by this operation are not set to the filter editor.
  • You cannot open [Dynamic Filter], when multiple Graph Items are selected.


 1.4.1 Restricting the Graph Items to Display

The number of the Graph Items being displayed will be restricted for certain traffic. Only higher-volume Graph Items are displayed for the following traffic by default:

  • MAC Traffic by Source
  • MAC Traffic by Destination
  • MAC Traffic by Host Pair
  • IP Traffic by Source
  • IP Traffic by Destination
  • IP Traffic by Host Pair
You can alter the Graph Item restrictions by the following steps;

Procedure 1 (line charts: the maximum number of Graph Items drawn for the period displayed)

  1. Right-click on the Traffic window.
  2. Choose [Properties...].
  3. Click on the [chart] tab.
  4. Enter the maximum number into [Item size((Top N)] field of [Item size of chart of host or host pair] region.

Procedure 2 (line charts: the maximum number of Graph Items drawn at each plotting poit)

  1. Right-click on the Traffic window.
  2. Choose [Properties...].
  3. Click on the [chart] tab.
  4. Select [more item in line chart] check box of [Item size of chart of host and host pair] region.
  5. Select [history top N] and enter the maximum number into [TopN] field.

Procedure 3(bar and pie charts)

  1. Right click on Traffic window.
  2. Select [Properties...].
  3. Click [chart] tab.
  4. Enter the maximum number into [Item size((Top N)] field of [Item size of chart of host or host pair] region.

Note

  • Trying to display all of the Graph Items will slow the drawing speed of the chart as the usage of memory increases. In addition, the resulting chart might be crowded and difficult to identify.
  • The restrictions of the number of Graph Item to be displayed are only applicable to the current Monitor window. To set the restrictions to a newly created Monitor window, configure the chart default.


 1.4.2 Changing the Monitoring Period of a Chart

There are three time spans; short time span, medium time span, and long time span. Moreover, the monitoring period displayed on the chart can be chosen for every time span. The ranges of the monitoring periods which can be chosen for each time span are as follows.

Time Span | Monitoring Period
 | Shortest | Longest
Short | 5 minutes | 30 minutes
Middle | 1 hour | 6 hours
Long | 1 day | 6 days

Change the time span

Procedure 1

Click one of the [Time Span] button ( [image] [image] [image]) on the toolbar of the Traffic window, the time span will change accordingly.

Procedure 2

  1. Right-click on the Traffic window.
  2. Choose [Time Period].
  3. Choose [Short], [Medium], or [Long].

Change the monitoring period

Procedure

  1. Open [Options] dialog box.
  2. Click [Monitor] in the tree view in the left of the dialog box.
  3. Select a period from the [monitoring period] drop down list for each time span.

Note

  • The usage of memory will increase as the monitoring period is made longer.


 1.4.3 Changing the Interval to Refresh Charts

Procedure

  1. Open [Options] dialog box.
  2. Click [Monitor] in the tree view in the left of the dialog box.
  3. Select the interval to refresh charts from the drop down list of [Refresh interval].

Note

  • Changing the interval to refresh charts is applicable only to the short time span.


 1.4.4 Changing the Unit for Y Axis of a Chart

Changing the bytes, frames, and utilization

  1. Right-click on a Traffic window.
  2. Choose [Unit].
  3. Choose unit.

Note

  • The change is only applicable to the current Traffic window. It is necessary to configure the default display format to change the unit for Y axis for a newly created Traffic window.
  • The utilization is available only for the "MAC Traffic".


 1.4.5 Displaying Network Utilization and Peak Value

You can view the network utilization when you set the unit for the Y axis of "MAC Traffic" to the "utilization".

Procedure

  1. Right-click on a "MAC Traffic" window.
  2. Choose [Unit].
  3. Choose [Utilization].

When you choose "byte" or "utilization" as unit for Y axis, and the time span of "MAC Traffic" window is "middle" or "long", the peak value of the traffic will be shown as the dashed line in lavender.

Procedure

  1. Change the time span of "MAC Traffic" to "middle" or "long".
  2. Right-click on the window.
  3. Choose [Unit].
  4. Choose [Byte] or [Utilization].

Note

  • The network utilization is calculated assuming Ethernet. The displayed utilization may not be correct with any media other than Ethernet.
  • The remote module may not tell the link speed of the network it is monitoring. In such a case, [Link Speed] dialog box appears and inquire about the link speed.


 1.4.6 Changing the Range of Y Axis Displayed on a Chart

You can specify the Range of Y Axis to be displayed on a Traffic window of the line chart or bar chart format.

Procedure 1

  1. Click [Range of Y Axis] button ( [image]) on the toolbar of the Traffic window.
  2. Move the mouse up and down, with the left button pressed, and decide the range of Y axis.

Procedure 2

  1. Right-click on a Traffic window.
  2. Choose [Properties...].
  3. Click [chart] tab.
  4. Enter the maximum and minimum value displayed on the chart, in the [Upper limit] and [Lower limit] fields.

Note

  • The change is only apply to the current Traffic window. It is necessary to configure the charts default to change the range of Y axis of charts for the newly created Traffic window.


 1.4.7 Restoring the Range of Y Axis of a Chart

Procedure

  1. Right-click on a Traffic window.
  2. Choose [Default Y Range].

Note

Restore the range of Y axis to the default value by the following steps;
  1. Right-click on a Traffic window.
  2. Choose [Properties...].
  3. Click [chart] tab.
  4. Set [Upper limit] as "automatic" and [Lower limit] as "0".


 1.4.8 Configuring Charts Default Options

You can change the charts default, such as the unit for the Y axis of the chart, and the number of the Graph Items to be displayed.

Procedure

  1. Open [Options] dialog box.
  2. Click [Chart Defaults] item in the tree view in the left of the dialog box.
  3. Change the unit and range for the Y axis of the chart, the number of the Graph Items to be displayed, and so on.

Note

  • The change is only applicable to newly created Traffic windows. The Traffic windows already displayed will not change.
  • Refer to the "References" below on how to change the charts default of existing Traffic windows.


 1.4.9 Changing the Foreground and Background Colors of a Chart

You can change the foreground and/or background colors of the chart on Traffic windows. When the color of a Graph Item is close to the foreground or background color, you may want to change the color for easy recognition.

Refer to "Changing the Color of Graph Items" to change the color of a Graph Item.

Procedure

  1. Open [Options] dialog box.
  2. Click [Colors in Chart] item in the tree view in the left of the dialog box.
  3. Click [Foreground color] or [Background color] button.
  4. Specify the color using [Color] dialog box.

Note

  • The foreground color is the color for the axes, divisions of axes, legend character string, and so on.
  • The background color is used for the background of a chart.


 1.4.10 Changing the Color of Graph Items

You can change the color for a Graph Item. When the color for a Graph Item is close to the foreground or background color, or that for another Graph Item and it is hard to distinguish the Graph Item, you may want to change one of the colors.

Refer to "Changing the Foreground and Background Colors of a Chart" to change the foreground and background colors.

Procedure 1

  1. Select a Graph Item.
  2. Right-click on the Traffic window.
  3. Choose [Color...].
  4. Specify the color using [Color] dialog box.
Procedure 2
  1. Open [Options] dialog box.
  2. Click [Colors in Chart] item in the tree view in the left of the dialog box.
  3. Choose a traffic type from the list of [Type].
  4. If the Graph Item whose color you want to change is not shown on the [Color] list, add the Graph Item by
    • clicking [Add...] button, or
    • dragging and dropping the Graph Item into the right side of the dialog box.
  5. Choose and click the Graph Item from [Color] list.
  6. Click [Modify...] button.
  7. Specify the color using [Color] dialog box.

Note

  • The items displayed on [Color] list are predetermined for the types of traffic shown below. You cannot add or delete an item.
    • MAC Traffic
    • IP Traffic
    • MAC Address Type
    • MAC Frame Size
    • MAC Error Frames
    • Event


 1.4.11 Restoring the Colors of a Chart

You can restore the foreground, background, and Graph Item color to the default.

Restoring the Color of the Specific Graph Item to the Default

  1. Open [Options] dialog box.
  2. Click [Colors in Chart] item in the tree view in the left of the dialog box.
  3. Choose a traffic type from the list of [Type].
  4. Click a Graph Item from [Color] list to restore its default color.
  5. Click [Reset] button.

Restoring the Color of the All Graph Item to the Default

  1. Open [Options] dialog box.
  2. Click [Colors in Chart] item in the tree view in the left of the dialog box.
  3. Click [Reset all colors] button.


 1.4.12 Toggling the Legend between Shown and Hidden (Monitor Window)

Procedure 1

Click [Legend] button ( [image]) on the toolbar of a Traffic window.

Procedure 2

  1. Right-click on a Traffic window.
  2. Choose [Legend].

Procedure 3

  1. Right-click on a Traffic window.
  2. Choose [Properties...].
  3. Click [chart] tab.
  4. Select or clear [Legend] check box.


 1.4.13 Toggling the Toolbar between Shown and Hidden

Procedure 1

  1. Right-click on a Traffic window.
  2. Choose [Toolbar].

Procedure 2

  1. Right-click on a Traffic window.
  2. Choose [Properties...].
  3. Click [chart] tab.
  4. Select or clear [Toolbar] check box.


 1.4.14 Toggling the Line Graph Stacked or not

Procedure 1

Click [Stacked] button ( [image]) on the toolbar of a Traffic window.

Procedure 2

  1. Right-click on a Traffic window.
  2. Choose [Stacked].

Procedure 3

  1. Right-click on a Traffic window.
  2. Choose [Properties...].
  3. Click [chart] tab.
  4. Select or clear [Stacked] check box.


 1.5.1 Monitoring Protocols not Using Well-Known Ports

ASTEC Eyes identifies an application layer protocol by the port numbers of TCP or UDP. Therefore, ASTEC Eyes can not identify an application or protocol when a proxy server is used and/or an application layer protocol uses a port other than one of the well-known ports. When a well-known port is not assigned for an application or protocol, ASTEC Eyes can not identify it either.

In such cases, configure the decoding hint.

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode Hints] item in the tree view in the left of the dialog box.
  3. Configure the decoding hint.

Note

  • When ASTEC Eyes can not identify an application layer protocol, "Unknown TCP Protocol" or "Unknown UDP Protocol" is used for the protocol in the Traffic window.


 1.5.2 Monitoring the Protocols Which ASTEC Eyes Do not Know

You can monitor the application layer protocol which ASTEC Eyes do not support using a decoding hint .

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode Hints] item in the tree view in the left of the dialog box.
  3. Specify the IP address, transport, and port number, and enter the arbitrary string to the Protocol column as name of the protocol/application.


 2 Logging

ASTEC Eyes can periodically output the statistics of network traffic and monitor events into a file. This function is called logging.

Logging is used to record and later investigate:

  • the long-term traffic trends, e.g., when the network traffic peaks and what protocols constitute the traffic at that time, and/or
  • the monitor events of various kinds.


 2.1.1 Starting Logging

Procedure

  1. Open [Host Properties] dialog box.
  2. Click [Log] tab.
  3. Select [Output log] check box.
  4. If writing logs for certain interface(s) is not necessary, clear the corresponding check box(s) to stop writing logs in the [Interfaces] area.
  5. Fill the following entries as needed.
    • Output interval
    • Number of entries in file
    • Directory where the log is written
    • Compress log files or not
    • Delete log files Automatically or not

Note

  • In order to write log data, ASTEC Eyes Basic Package or Remote Module must be running on the host.
  • Log data can only be used after all the entries in a log file are written. Therefore the latency period is [Output interval] x [Number of entries in file]. The larger the values of [Output interval] and [Number of entries in file] are, the longer it will take before the log data can be retrieved and displayed.
  • Specify the directory where the log file is created as a relative path to the directory where ASTEC Eyes or Remote Module is installed.
  • Select the [Compress log files] check box to compress the log files by bzip2.
  • If you configure ASTEC Eyes to output log files, ASTEC Eyes continues to output them even after you exit the application.


 2.1.2 Stopping Logging

Stop Logging

  1. Open [Host Properties] dialog box.
  2. Click [Log] tab.
  3. Clear [Output log] check box.

Stop Logging with the specific interface

  1. Open [Host Properties] dialog box.
  2. Click [Log] tab.
  3. Clear the check box for the interface listed in the [Interfaces] area.


 2.1.3 Displaying Logs

You can display the log under the directory where ASTEC Eyes or the Remote Module is installed.

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [List Logs].
  3. Right-click on a log entry.
  4. Choose [Log...].
  5. Specify the period to be covered and the plotting interval.
  6. Click [Display chart...] button.
  7. Choose the type of log.

Note

  • You can change the display format of a chart and/or use the monitor filter in a Log window, with the same operations as in a Monitor window which displays real-time traffic.
    Please refer to Monitoring about the operations of Monitor window.
  • You can change the display format for events and/or use the caption filter in a Log window for events, with the same operations as in a Event Viewer.
    Please refer to Reporting Expert Events about the operations of Event Viewer.
  • When you show a log under the directory where ASTEC Eyes Basic Package or the Remote Module is installed, the corresponding log entry is created under the interface entry.


 2.1.4 Displaying the Logs under the Directory You Specified

You can display the logs specifying the directory.

You can display logs even if you change the directory where log data is saved or move log data to another directory. You can also copy log files to the localhost from other hosts running ASTEC Eyes or the Remote Module, and display the log.

Procedure 1

  1. Choose [Open Log Directory...] from the [File] menu of the Main window.
  2. Specify the directory where log files are saved.
  3. Right-click on a log entry.
  4. Choose [Log...].
  5. Specify the period to be covered and the plotting interval.
  6. Click [Display chart...] button.
  7. Choose a type of log.

Procedure 2

  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Open Log Directory...].
  3. Specify the directory where log files are saved.
  4. Right-click on a log entry.
  5. Choose [Log...].
  6. Specify the period to be covered and the plotting interval.
  7. Click [Display chart...] button.
  8. Choose a type of log.

Note

  • You can change the display format of a chart and/or use the monitor filter in a Log window, with the same operations as in a Monitor window which displays real-time traffic.
    Please refer to Monitoring about the operations of Monitor window.
  • You can change the display format for events and/or use the caption filter in a Log window for events, with the same operations as in a Event Viewer.
    Please refer to Reporting Expert Events about the operations of Event Viewer.
  • When you display the logs under the specified directory, a log entry is created under the folder entry.


 2.1.5 Displaying the Property of Log Window

You can display the property of a Log window, such as host name, link speed, start time of monitoring, and plotting interval.

Procedure

  1. Right-click on a Log window.
  2. Choose [Properties...].
  3. Click on [Information] tab.


 2.1.6 Saving Log Data

The log data can be saved into a file in comma separated value (CSV), bmp, metafile, or enhanced metafile format.

Procedure

  1. Click on the Log window whose data you want to save.
  2. Choose [Save Monitor...] from [File] menu of the Main window.
  3. Specify the file name and file format.

Note

  • The data in a Log window of tabular format can be saved only as CSV format.
  • The data being saved will differ, depending on the display format of the Log window.
    For example, when the top 10 items are displayed in a bar chart, only the statistics of those 10 items will be saved.
  • You can use the saved data with other applications. For example, you can insert bmp image in Microsoft Word, or import CSV file into Microsoft Excel.


 2.1.7 Copying Log Data to Other Applications

Procedure (chart format)

  1. Click no the Log window whose data you want to copy.
  2. Choose [Copy] from [Edit] menu of the Main window, or press <Ctrl-C> key.
  3. Activate the target application and press <Ctrl-V> key.

Procedure (table)

  1. Right-click on the Log window whose data you want to copy.
  2. Choose [Copy Whole Data].
    When you press <Ctrl-C> key in the tabular format window, only the character string in the selected cell (surrounded by the white frame) will be copied.
  3. Activate the target application and press <Ctrl-V> key.

Note

  • You can choose [Paste Special...] of [Edit] menu instead of pressing <Ctrl-V> key, with such applications as Microsoft Word and Microsoft Excel.
  • The log data being copied will differ, depending on the display format of the Log window.
    For example, when the top 10 items are displayed in a bar chart, only the statistics of those 10 items will be copied.


 2.1.8 Displaying Property of Log Data

You can display the property of log data, such as the information of network interface which collects the log data, and the period covered by the log.

Procedure

  1. Right-click on a log entry in the Interface Selector window.
  2. Choose [Properties...].


 2.2.1 Configuring Output Interval and Number of Log Entries in a File

A log entry is created at the specified interval, and the specified number of log entries are written into a log file.

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Log] tab.
  3. Specify [Output interval] in minutes, and the number of log entries to be written into a file in [Number of entries in file].
Note
  • Log data can only be used after all the entries in a log file are written. Therefore the latency period is [Output interval] x [Number of entries in file]. The larger the values of [Output interval] and [Number of entries in file] are, the longer it will take before the log data can be retrieved and displayed.


 2.2.2 Specifying the Directory Where Log Files Are Created

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Log] tab.
  3. Enter the directory path where the log files are created into [Directory].

Note

  • Specify the directory path where the log files are created as relative path to the directory where ASTEC Eyes or the Remote Module is installed. The default directory path is "log".
  • You need to create the directory in advance by yourself.


 2.2.3 Saving the Log Files with Compression

You can save the log files compressed by "bzip2".

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Log] tab.
  3. Select [Compress log files] check box.

Note

  • If you compress log files, you can reduce the disk space used by the log files, but it will take longer before the log data is displayed.


 2.2.4 Delete Old Log Files Automatically

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Log] tab.
  3. Select [Delete automatically] check box, and enter the number of days each file should be kept.


 3 Capturing

You can copy the packets flowing through the network into the buffer of ASTEC Eyes (capture buffer) to analyze them in detail, and save them into a file.

Capture buffers are allocated in the memory of the host where ASTEC Eyes or Remote Module is installed, one for each network interface. The data read into a capture buffer from network or capture file is called capture data.

There are types of captures; an ordinary capture with which the captured data is analyzed after capture is stopped, realtime decode capture with which capturing and analyzing data are done concurrently, and continuous capture with which captured data is saved in files automatically.


 3.1.1 Capturing and Decoding Packets

Procedure

  1. Start capture
  2. Pause capture
  3. Decode captured data

Note

  • Trying to close a decode view without saving the data will display an [ASTEC Eyes] dialog box, prompting you to save the data. If you close a decode view while holding down <Shift> key, the [ASTEC Eyes] dialog box will not appear and the data will be lost.


 3.1.2 Performing Realtime Decoding

Procedure

  1. Specify the capture mode so that realtime decode capture will be performed.
  2. Start capture. The decoded result of the captured data will be displayed in realtime decode view.

Note

  • The realtime decode can be performed only with network interfaces of the hosts where ASTEC Eyes Basic Package is installed.
  • Closing realtime decode view will not stop capturing. Stop capture, if you want.
  • Closing realtime decode view and opening it later will also display the decoded results of the data captured while realtime decode view is closed.


 3.1.3 Starting Capture

Procedure 1

  1. Select a network interface.
  2. Choose [Start Capture] from the [Capture] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click [Start Capture] button ( [image]) on the Interface toolbar .
Procedure 3
  1. Right-click on the entry of an interface in the Interface Selector window .
  2. Choose [Start Capture].

Note

  • In realtime decode mode, realtime decode view will be displayed when capture is started.


 3.1.4 Pausing Capture

Procedure 1

  1. Select a network interface.
  2. Choose [Pause Capture] from the [Capture] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click [Pause Capture] button ( [image]) on the Interface toolbar .
Procedure 3
  1. Right-click on the entry of an interface in the Interface Selector window .
  2. Choose [Pause Capture].


 3.1.5 Using Quick Return

In order to investigate network status, it is sometimes necessary to repeat capturing packets and decoding them. In such cases, you need to pause capture, create decode view, delete capture data, and start capture, repeatedly. There is a function performing those procedures in one operation, called Quick Return.

Procedure 1

  1. Select a network interface.
  2. Choose [Quick Return] from the [Capture] menu of the Main window.
Procedure 2
  1. Right-click on the entry of an interface in the Interface Selector window .
  2. Choose [Quick Return].

Note

  • You cannot use Quick Return, when realtime decode is running.
  • A Quick Return function makes the copy of a capture buffer, displays a decode view, deletes the data of a capture buffer, and resumes capturing. If you close a decode view without saving data, the data displayed on the decode view will be lost.
    Please refer to "Saving Decoded Data" in order to save the decoded data into a file.
    Please refer to "Saving Decoded Results into a Text File" in order to save the decoded result into a text file.
  • Please refer to "Decoding Data in the Capture Buffer" in order to decode the data in a capture buffer.


 3.1.6 Saving Captured Data into a File

You can save the data of a capture buffer into a file.

Procedure

  1. Select a network interface.
  2. Choose [Save Capture Buffer...] from the [File] menu of the Main window.
  3. Specify a file name and click [Save] button.

Note

  • You cannot save the captured data from within realtime decode window. Display decode view and save the captured data.
  • The captured data is saved in the uncompressed Sniffer format (extension .enc) by default. You can also save it compressed by bzip2 (extension .ebz).


 3.1.7 Discarding Captured Data

Procedure 1

  1. Select a network interface.
  2. Choose [Discard Capture Data] from the [Capture] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click [Delete Capture Data] button ( [image]) on the Interface toolbar .
Procedure 3
  1. Right-click on the entry of the interface in Interface Selector window .
  2. Choose [Discard Capture Data].

Note

  • You cannot discard the captured data, when realtime decode is running.
  • Trying to discard the captured data without saving or displaying it will display an [ASTEC Eyes] dialog box, telling you the data will be discarded permanently.
    If you do the step 2 of one of the above procedures while holding down <Shift> key, the [ASTEC Eyes] dialog box will not appear and the data will be discarded immediately.


 3.1.8 Specifying Capture Mode

Specify whether the captured data is decoded in realtime.

Procedure

  1. Open [Options] dialog box.
  2. Click [Capture] item in the tree view in the left of the dialog box.
  3. Select a target interface from the [Interface] list.
  4. Select [Real Time Decode] check box, if you want to run realtime decode. Deselect [Real Time Decode] check box, otherwise.
For realtime decode, you need to specify the following values in [Options] dialog box;
  1. Enter the maximum volume of packets displayed in realtime decode view into [Total bytes of holding packets] field.
  2. Select [Stop real time decode when buffer full] check box, if you want to stop capture when the amount of data displayed exceeds the limit set above. Deselect the check box, if you want the old data to be overwritten.

Note

  • The minimum value of [Total bytes of holding packets] is 4 M bytes. The maximum value is one forth (1/4) of the real memory size of the host where ASTEC Eyes Basic Package is running.


 3.1.9 Changing Capture Buffer Size

Procedure

  1. Open [Options] dialog box.
  2. Click [Capture] item in the tree view in the left of the dialog box.
  3. Select a target interface from the [Interface] list.
  4. Enter capture buffer size into the [Size] field.

Note

  • The minimum buffer size is 2 K bytes. The maximum buffer size if quarter (1/4) of the physical memory of the PC where ASTEC Eyes or Remote Module is running.


 3.1.10 Configuring Capture Buffer Full Action

You can choose one from the two actions taken when the capture buffer is full; wrapping the buffer and pausing capture. Wrapping buffer will overwrite new data on the oldest one in the buffer. Pausing capture will stop capturing automatically.

Procedure

  1. Open [Options] dialog box.
  2. Click [Capture] item in the tree view in the left of the dialog box.
  3. Select a target interface from the [Interface] list.
  4. Choose either [Wrap buffer] or [Pause capture].

Note

  • In realtime decode mode, the packets will be dropped when the capture buffer is full. realtime decode view will highlight in orange the row after the packet drop occurred.


 3.1.11 Compressing and Transmitting Data from Remote Module

When decoding the data captured by Remote Module, you can compress the captured data and transmit it to the localhost.
If the bandwidth of the network between Remote Module and the localhost is narrow or the amount of the captured data is large, you can reduce the network load and shorten the transmission time by compressing the data being transmitted.

Procedure

  1. Open [Options] dialog box.
  2. Click [Capture] item in the tree view in the left of the dialog box.
  3. Select a target interface from the [Interface] list.
  4. Select [Compress data from remote module] check box.


 3.2 Capture Filter

Capture filters are the filters for ordinary and realtime decode capture. There are three types of them; one specifying data to capture, one specifying the timiming to start capture, and one specifying the timing to stop capture.

  • Capture filter
  • Capture start trigger
  • Capture stop trigger


 3.2.1 Capturing Specific Data Only

You can use a capture filter to collect only the packets of your interest. Use the filter editor to configure a capture filter. You need to configure a capture filter for each interface.

Procedure

  1. Open filter editor.
  2. Click on the [ [image] Capture Filter] of the target interface.
  3. Specify logical expressions.


 3.2.2 Starting Capture When Specified Packet Is Detected

You can use a start capture trigger to start capture when a packet with specific features is found. Use the filter editor to configure a start capture trigger.

Procedure

  1. Open filter editor.
  3. Click on the [ [image] Start Capture Trigger] of the target interface.
  4. Specify logical expressions.

Note

  • The packet triggering the start is also captured.


 3.2.3 Pausing Capture When Specified Packet Is Detected

You can use a pause capture trigger to pause capture when a packet with specific features is found. Use the filter editor to configure a pause capture trigger.

Procedure

  1. Open filter editor.
  2. Click on the [ [image] Pause Capture Trigger] of the target interface.
  3. Specify logical expressions.

Note

  • The packet triggering the pause is also captured.


 3.3 Continuous Capture

Continuous capture is to capture packets continuously and save the captured data directly into files. You can use the continuous capture, in order to capture data more than the size the capture buffer allows, Continuous capture data is saved into multiple files.


 3.3.1 Starting Continuous Capture

Procedure

  1. Get configuration privileges, if you don't have them.
  2. Open [Host Properties] dialog box.
  3. Click on [Continuous Capture] tab.
  4. Specify the followings if necessary;
    • the maximum size of output files
    • the directory where the output files will be placed
    • the minimum free of the hard disk to run the continuous capture
    • enable or disable the automatic deletion of output files
  5. Click on a target interface in the [Status] region.
  6. Click [Start] button.

Note

  • The free hard disk space of the PC where ASTEC Eyes or the Remote Module is running will decrease while writing the continuous capture data. If the free hard disk space becomes less than the specified amout, the continuous capture will be automatically stopped and no more data will be written.


 3.3.2 Pausing Continuous Capture

Procedure

  1. Get cconfiguration privileges, if you don't have them.
  2. Open [Host Properties] dialog box.
  3. Click on [Continuous Capture] tab.
  4. Click on a target interface in the [Status] region.
  5. Click [Stop] button.

Note

  • The free hard disk space of the PC where ASTEC Eyes or the Remote Module is running will decrease while writing the continuous capture data. If the free hard disk space becomes less than the specified amout, the continuous capture will be automatically stopped and no more data will be written.


 3.3.3 Specifying the Directory Where Continuous Capture Files Are Placed

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Continuous Capture] tab.
  3. Enter directory name in [Directory] field.

Note

  • The directory path for the continuous capture files has to be relative path of the directory ASTEC Eyes Basic Package or the Remote Module is installed.
  • If this directory does not exist yet, you need to create it in advance by yourself.


 3.3.4 Specifying the Size of Continuous Capture Files

The continuous capture data is saved into multiple files. You can specify the upper limit of the file size in K bytes. When the size of output file exceeds the specified upper limit, a new file will be created.

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Continuous Capture] tab.
  3. Enter file size into [Maximum file size] field.


 3.3.5 Pausing Continuous Capture When Free Hard Disk Space Becomes Less than the Specified Size

When the free hard disk space becomes less than the specific size, the output of the captured data will be automatically stopped. You can specify the free hard disk space to pause continuous capture.

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Continuous Capture] tab.
  3. Enter size into [Automatic stop] field.


 3.3.6 Truncating Packets Stored

You can truncate the packets stored, whereby reducing the volume of continuous capture files. By doing so, you can store more packets for longer period, though you can not see all the details of the packets.

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Continuous Capture] tab.
  3. Select [Truncate packets stored] check box and enter the upper limit of the packet length stored.

Note

  • Specify a value no less than 68 bytes for the upper limit. This is to keep the senders, receivers, and application protocols identifiable.


 3.3.7 Keeping Latest Packets

You can use automatic deletion which keeps the latest packets without pausing continuous capture. When the free hard disk space becomes less, the oldest capture file will be deleted and newly captured data will be saved.

Procedure

  1. Open [Host Properties] dialog box.
  2. Click on [Continuous Capture] tab.
  3. Select [Delete automatically] check box and enter the lower limit of the free hard disk space to start deleting older files into [Disk space] field.

Note

  • Specify a value for [Disk space] larger than the value for [Automatic stop].


 3.3.8 Displaying the Property of Continuous Capture Data

Procedure

  1. Right-click on a continuous capture data entry in the Interface Selector window.
  2. Choose [Properties...].


 3.4 Continuous Capture Filter

Continuous capture filters are the filters for continuous capture. There are three types of them; one specifying data to capture, one specifying the timiming to start capture, and one specifying the timing to stop capture.

  • Continuous capture filter
  • Continuous capture start trigger
  • Continuous capture stop trigger


 3.4.1 Continuously Capturing Specific Data Only

You can use a continuous capture filter to collect only the packets of your interest. Use the filter editor to configure a continuous capture filter.

Procedure

  1. Open the filter editor.
  2. Click on [ [image] Continuous Capture Filter] of the target interface.
  3. Specify logical expressions.


 3.4.2 Starting Continuous Capture When Specified Packet Is Detected

You can use the start continuous capture trigger to start continuous capture when a packet with specific features is found. Use the filter editor to configure a start continuous capture trigger.

Procedure

  1. Open the filter editor.
  2. Click on [ [image] Start Continuous Capture Trigger] of the target interface.
  3. Specify logical expressions.

Note

  • The packet which triggered the start is also captured.


 3.4.3 Pausing Continuous Capture When Specified Packet Is Detected

You can use a pause continuous capture trigger to pause continuous capture when a packet with specific features is found. Use the filter editor to configure a pause continuous capture trigger.

Procedure

  1. Open the filter editor.
  2. Click on [ [image] Pause Continuous Capture Trigger] of the target interface.
  3. Specify logical expressions.

Note

  • The packet which triggered the pause is also captured.


 3.5 Capture Time Synchronization

You can synchronize the capture time, the time each packet is captured, with the system time of the PC where ASTEC Eyes GUI is running.

  • Synchronizing Capture Time
  • Reverting Capture Time
  • Viewing Capture Time


 3.5.1 Synchronizing Capture Time

There are two ways to synchronize the capture time with GUI's system time:

  • Synchronize the capture time of a specific host.
  • Synchronize the capture time of all the hosts with the configuration privileges.

Synchronize the capture time of a specific host

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Synchronize Capture Time].

Note

  • The capture time of "localhost" may differ considerably from the system time. Synchronize the capture time as needed.
  • You cannot choose [Synchronize Capture Time] for the hosts without the configuration privileges. Get configuration privileges beforehand.

Synchronize the capture time of all the hosts with the configuration privileges

Procedure

  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Synchronize Capture Time].
The hosts whose capture time is synchronized will be listed in Message window.


 3.5.2 Reverting Capture Time

There are two ways to revert the capture time:

  • Revert the capture time of a specific host.
  • Revert the capture time of all the hosts with the configuration privileges.

Revert the capture time of a specific host

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Revert Capture Time].

Note

  • You cannot choose [Revert Capture Time] for the hosts without the configuration privileges. Get configuration privileges beforehand.

Revert the capture time of all the hosts with the configuration privileges

Procedure

  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Revert Capture Time].
The hosts whose capture time is reverted will be listed in Message window.


 3.5.3 Viewing Capture Time

There are two ways to view the capture time:

  • View the capture time of a specific host.
  • View the capture time of all the hosts connected.

View the capture time of a specific host

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Get Capture Time].
The results will be shown in Message window.

View the capture time of all the hosts connected

Procedure

  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Get Capture Time].
The results will be listed in Message window.


 4 Decoding

You can analyze the data in a capture buffer, saved in a file, or in continuous capture files.


 4.1.1 Performing Realtime Decoding

Procedure 1

  1. Specify the capture mode to realtime decode.
  2. Select an interface.
  3. Start capturing.
Procedure 2
  1. Select an interface.
  2. Select [Real Time Decode View] from [Capture] menu of Main window.
Procedure 3
  1. Right click on an interface entry in Interface Selector window.
  2. Select [Real Time Decode View].


 4.1.2 Viewing Detailed Analysis of a Packet

realtime decode view shows each packet's summary information. Use decode view to view detailed analysis.

Procedue 1

Click [Show decode view and discard all Packets] button ( [image]) on the toolbar of realtime decode view. decode view will be displayed and the data in realtime decode view will be discarded.

Procedure 2

Click [Show decode view] button ( [image]) on the toolbar of realtime decode view. decode view will be displayed and the data for realtime decode view will be kept.


 4.1.3 Discarding Data for Realtime Decoding

Procedure 1

Click [Discard all packets] button ( [image]) on the toolbar of realtime decode view.
All the data in realtime decode view will be discarded.

Procedure 2

Click [Discard packets up to selected line] button ( [image]) on the toolbar of realtime decode view.
The data up to the row with forcus in realtime decode view will be discarded.

Procedure 3

Click [Show decode view and discard all Packets] button ( [image]) on the toolbar of realtime decode view.
The data in realtime decode view will be discarded and decode view will be displayed.

Note

  • The data including that for the row with forcus will be discarded, when [Discard packets up to selected line] button ( [image]) is clicked.


 4.1.4 Packets Dropped

realtime decode view temporarily captures data in a capture buffer, and decodes them. When the network traffic is too much and the capture buffer is overflowed, realtime decode view cannot capture all the packets.

realtime decode view will highlight in orange the row after the overflow occured. Clicking [Select next drop point] button ( [image]) on the toolbar of realtime decode view will set focus to the next highlighted row.


 4.2.1 Decoding Data in the Capture Buffer

Procedure 1

  1. Select a network interface.
  2. Choose [New Decode View] from the [Capture] menu of the Main window.
Procedure 2
  1. Select a network interface.
  2. Click [New Decode View] button ( [image]) on the Interface toolbar.
Procedure 3
  1. Right-click on the entry of an interface in the Interface Selector window.
  2. Choose [New Decode View].

Note

  • Trying to close a decode view without saving the associated data will display an [ASTEC Eyes] dialog box, prompting you to save the data.
    If you close the decode view while holding down <Shift> key, the [ASTEC Eyes] dialog box will not appear and the data not saved will be lost.


 4.2.2 Supported File Format for Decoding

ASTEC Eyes can load and decode the files of the following formats;
File Format | File Extension
Uncompressed Sniffer format | .enc .cap
Compressed Sniffer format | .enc
.enc file compressed by "bzip2" | .ebz .enc .bz2
Continuous capture output file | .jil
.jil file compressed by "bzip2" | .jil.bz2
Microsoft Network Monitor format | .cap
Wild Packets Ether Peek format | .pkt
Novell LANalyzer format | .tr1
"tcpdump" format | not specified
"snoop" format | not specified


 4.2.3 Decoding Data Saved in a File

Procedure 1

  1. Choose [Open...] from the [File] menu of the Main window.
  2. Specify a file to be decoded.
Procedure 2
  1. Click [Open] button ( [image]) on the Common toolbar of the Main window.
  2. Specify a file to be decoded.
Procedure 3
  1. Press <Ctrl-O> key.
  2. Specify a file to be decoded.
Procedure 4
Use drag and drop.
Drag the icon of a file to be decoded from the Windows Explorer, and drop it on the Main window of ASTEC Eyes.
Procedure 5
Double-click on the icon of a file to be decoded in the Windows Explorer. This is effective only for files with the extensions: .enc, .ebz, .cap, or .jil.


 4.2.4 Using Capture Data Manager

You can decode a part of a capture file, or merge and decode multiple capture files.

Procedure

  1. Choose [Open with Capture Manager...] from the [File] menu of the Main window.
  2. Specify file(s) to be decoded. You can specify multiple files.
  3. Specify the decode range. There are two ways to do so as shown below;
    • Specify the start and end time of decoding.
    • Specify the header attribute based on the statistics.
  4. Click [Decode] button.

Note

Clicking [Statistics] button ( [image]) creates statistical data from the capture data, and displays a chart or table. It will show the information in the decode range.


 4.2.5 Decoding a Part of Capture File

If the capture data saved in a file is large, it will take long time and much memory to decode it. In such a case, you can specify the decode range to decode only a part of a file.

Procedure

Use [Capture Data Manager] dialog box.


 4.2.6 Merging and Decoding Multiple Capture Files

You can merge and decode the capture data saved in multiple files. Moreover, you can specify a decode range by specifying the header attribute of packets or decode period.

Procedure

Use [Capture Data Manager] dialog box.


 4.2.7 Displaying Statistics of Decoded Data in Char or Tabular Form

You can display the statistics of the decoded data in a chart or a table of the Monitor window, just as the statistical data collected from the network.

Procedure 1

  1. Click [Statistics] button ( [image]) on the toolbar of a decode view.
  2. Choose statistics of your interest.

Procedure 2

  1. Open [Capture Data Manager] dialog box.
  2. Click [Statistics] button ( [image]).
  3. Choose statistics of your interest.

Note

  • The statistics of captured data differ from those of monitor or log in the following ways;
    • A peak chart is not displayed in the "MAC Traffic." window.
    • MAC Error Frames is not displayed.
    • You can not change the time span
    • You can change the plotting interval of a line chart


 4.2.8 Decoding Continuous Capture Data

You can decode continuous capture data saved under the directory ASTEC Eyes Basic Package or the Remote Module is installed. .

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [List Continuous Captures].
  3. Right-click on a continuous capture data entry in the Interface Selector window.
  4. Choose [Decode Continuous Capture...].
  5. Specify [From] and [To] in the [Decode] region.
  6. Click [Decode] button to decode whole continuous capture data.
    Or, click [Capture Data Manager...] button if you want to use capture data manager.


 4.2.9 Decoding Continuous Capture Data under Specified Directory

You can decode continuous capture data under the directory you specified.

So, you can decode continuous capture data after you changed the directory where they are saved. You can also decode continuous capture data copied from other hosts running ASTEC Eyes Basic Package or Remote Module.

Procedure 1

  1. Choose [Open Continuous Capture Directory...] from the [File] menu of the Main window.
  2. Right-click on a continuous capture data entry in the Interface Selector window.
  3. Choose [Decode Continuous Capture...].
  4. Specify [From] and [To] in the [Decode] region.
  5. Click [Decode] button to decode whole continuous capture data.
    Or, click [Capture Data Manager...] button if you want to use capture data manager.

Procedure 2

  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Open Continuous Capture Directory...].
  3. Right-click on a continuous capture data entry in the Interface Selector window.
  4. Choose [Decode Continuous Capture...].
  5. Specify [From] and [To] in the [Decode] region.
  6. Click [Decode] button to decode whole continuous capture data.
    Or, click [Capture Data Manager...] button if you want to use capture data manager.

Note

  • You can decode not only a continuous capture file , but multiple continuous capture files merged.


 4.2.10 Decoding Continuous Capture Data of Specified Period on a Log Window

If you have both log data and continuous capture data for the same interface and period, you can decode the continuous capture data, specifying the period on the Log window.

  1. List logs corresponding to the continuous capture data.
  2. Display logs.
  3. Display capture data indicator on the Log window.
  4. Specify the period and decode captured data.
List Logs Corresponding to the Continuous Capture Data

Procedure 1

  1. Right-click on a host entry in the Interface Selector window
  2. Choose [List Logs].
  3. Right-click on a host entry.
  4. Choose [List Continuous Captures].
Procedure 2
  1. Choose [Open Log Directory...] from the [File] menu of the Main window.
  2. Specify the directory where log files are saved.
  3. Choose [Open Continuous Capture Directory...] from the [File] menu of the Main window.
  4. Specify the directory where continuous capture file are saved.
  5. Attach the continuous capture data to log data.
Procedure 3
  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Open Log Directory...].
  3. Specify the directory where log files are saved.
  4. Right-click on an open space in the Interface Selector window.
  5. Choose [Open Continuous Capture Directory...].
  6. Specify the directory where continuous capture files are saved.
  7. Attach the continuous capture data to log data.
Display Capture Data Indicator

Procedure 1

  1. Display a line chart.
  2. Click [Captured Data Indicator] button ( [image]) on the toolbar of the Log window.
Procedure 2
  1. Display a line chart.
  2. Right-click on a window and choose [Capture Data Indicator].

Note

  • Clicking [Captured Data Indicator] button ( [image]) will display capture data indicator. Clicking [Captured Data Indicator] button ( [image]) once again will hide capture data indicator.
Specify the Period and Decode Captured Data

Procedure

  1. Click [Read Values in Chart] button ( [image]) on the toolbar of the Log window.
  2. Click [Vertical Hair Cursor] button ( [image]).
  3. Specify the starting and ending time to decode by dragging the mouse.
  4. Click [New Decode View] button ( [image]).

Note

  • For details about analyzing monitor data, refer to "Read X-axis Value of a Chart".


 4.2.11 Attaching Continuous Capture Data to Log Data

You can associate continuous capture files with log files, by attaching a continuous capture data entry to a log entry. Both of them can be under any directory you specified.

In order to decode continuous capture data for the period specified on a Log window, display the Log window after the corresponding continuous capture data entry is attached.

Attaching Continuous Capture Data to Log Data

Procedure

Drag an icon of continuous capture data entry in the Interface Selector window and drop it on a log entry.

Detaching Continuous Capture Data from Log Data

Procedure

  1. Right-click on a continuous capture data entry.
  2. Choose [Detach Log].

Note

  • You need to attach continuous capture data to log data collected for the same interface. To do so, attach the continuous capture entry to the log entry whose NIC ID displayed on the property window is the same as that for the continuous capture entry.
    For a discussion on displaying log and continuous capture properties, refer to "display the continuous capture property" , and "display the log property".


 4.2.12 Reassembling and Decoding Virtual TCP Stream

Procedure 1

  1. Click on a decode view.
  2. Choose [Stream View] from the [Capture] menu of the Main window.
Procedure 2
Click [Stream View] button ( [image]) on the toolbar of the decode view.
Procedure 3
  1. Right-click on a decode view.
  2. Choose [Stream View].

Note

  • When all of the packets constituting a TCP stream are not captured, record(s) for missing packet(s) will be created and highlighted in blue. Such a record indicates the lack of packet(s), displaying the sequence number of TCP stream and the missing byte count.
    Clicking on the [Stream ID] column and choosing [(Check Marks on Blue Rows)] selects the check boxes on the [Stream ID] column of the highlighted rows. If you do so while pressing <Shift> key, the highlighted rows are shown and other rows are hidden.


 4.2.13 Displaying TCP Stream Session by Session

TCP streams can be reconstructed and displayed session by session. This display mode is called sequence mode.

Procedure 1

Click [Stream View (Sequence Mode)] button ( [image]) on the toolbar of decode view.
Procedure 2
  1. Right click decode view.
  2. Select [Stream View(Sequence Mode)].

Note

  • If any of the packets constituting a stream is missing, the arrow with "Lack of Data" in the red characters will be displayed in Sequence pane.


 4.2.14 Displaying Stream Including Specified Packet

Procedure

  1. Right-click on a packet in the Summary pane of a decode view.
  2. Choose [Stream View for Selected Packet].


 4.3.1 Saving Decoded Data

You can save the captured data displayed on a decode view.

Even if the captured data in a capture buffer are discarded or changed after creating the decode view, you can save the snapshot of the capture buffer at the time of decoding.

Procedure

  1. Click on a decode view.
  2. Choose [Save Capture Data...] from the [File] menu of the Main window, or press <Ctrl-S> key.
  3. Specify the file name and format, and then click [Save] button.

Note

  • You can save the captured data as uncompressed Sniffer format (extension is .enc), or Sniffer format compressed by "bzip2" (extension is .ebz).
  • Trying to close a decode view without saving the decoded data will show an [ASTEC Eyes] dialog box, prompting you to save the data.
    If you close the window holding down <Shift> key, the [ASTEC Eyes] dialog box will not appear and the data will be lost.


 4.3.2 Saving Required Packets Only

Procedure

  1. Click on the decode view which shows the captured data you want to save.
  2. Display only the packets you need, using convenience filter and/or display filter.
  3. Choose [Save Visible Packets...] from the [File] menu of the Main window.


 4.3.3 Saving Decoded Results into a Text File

Procedure

  1. Click on a decode or stream view which shows decoded result you want to save.
  2. Choose [Save Decoded Results...] from the [File] menu of the Main window.
  3. Configure options, such as range written into a file, and so on.

Note

  • You can use the decoded result with other applications, such as Microsoft Notepad, Microsoft WordPad, Microsoft Word, Microsoft Excel, and so on.
  • In Microsoft Excel, a double quotation mark (") and a single quotation mark (') have a special meaning. If you use the decoded result with Microsoft Excel, it is necessary to customize the output format of quotation marks.


 4.3.4 Customizing Saved Text Format

In Microsoft Excel, double quotation marks in a text may be treated as delimiter mark or be displayed in an unexpected way. The single quotation mark at the head of a text may also be treated as having a special meaning. For these reasons, you need to customize the use of quotation marks in the decoded result written in a file with Microsoft Excel.

Procedure

  1. Choose [Save Decoded Results...] from the [File] menu of the Main window.
  2. Click [Advanced...] button.
  3. Configure the delimiter and use of quotation marks.


 4.3.5 Copying Decoded Result to Other Applications

You can copy the decoded result displayed on a realtime decode, decode or stream view to other applications. The decoded data being copied will differ, depending on the pane of the window and/or operation.

Copying the Text in a Cell of the realtime decode view

Procedure

  1. Click on the cell whose data you want to copy.
  2. Choose [Copy] from the [Edit] menu of the Main window, or press <Ctrl-C> key.
  3. Activate the application you want to paste the data on and press <Ctrl-V> key.

Copying the Text in a Cell of the Summary Pane or Packet Detail Pane of the decode or stream view

Procedure

  1. Click on the cell in the Summary or Packet Detail pane whose data you want to copy.
  2. Choose [Copy] from the [Edit] menu of the Main window, or press <Ctrl-C> key.
  3. Activate the application you want to paste the data on and press <Ctrl-V> key.

Copying the Highlighted Data in the Dump Pane

Procedure

  1. Set the focus to the Dump pane.
  2. Choose [Copy] from the [Edit] menu of the Main window, or press <Ctrl-C> key.
  3. Activate the application you want to paste the data on and press <Ctrl-V> key.

Copying Whole Data of the Selected Pane

Procedure

  1. Set the focus to the region (Summary, Packet Detail, or Dump pane) whose data you want to copy.
  2. Right-click on the pane.
  3. Choose [Copy Whole Data].
  4. Activate the application you want to paste the data on and press <Ctrl-V> key.

Note

  • You cannot copy all the contents of realtime decode view at once.
  • You cannot copy all the data of all the pane in a window at once.


 4.3.6 Saving a Part of Packet in a Binary Mode

You can save any part of a packet into a file in binary mode. For example, you can only save the Message Body part of HTTP into a file, and open it with a browser to show the Web page, and so on.

Procedure

  1. Right-click on a decode or stream view.
  2. Choose [Save Part of Packet].
  3. Enter [Start offset] and [End offset] or [Length] to specify the range you want to save.
  4. Click [OK] button and specify the file name.

Note

  • You can not save the data over multiple packets or records.


 4.4.1 Moving the Focus among the Panes

Procedure 1

Click on the pane you want to move the focus to.
Procedure 2
  1. Click on a decode or stream view.
  2. Press <Tab> or <Shift-Tab> key to move the focus.


 4.4.2 Expanding Specified Pane

You can expand one of the Summary, Packet Detail, Dump pane, Session List pane and Sequence pane of the decode or stream view to the full window size.

Procedure 1

Double-click on the pane you want to expand.
Double-clicking on the window once again will show all of the three panes.

Procedure 2

Move a focus to the pane you want to expand, and click [Expand] button ( [image]) on the toolbar.
Clicking it once again will show all of the three panes.

Procedure 3

  1. Move the focus to the pane you want to expand.
  2. Right-click and choose [View].
  3. Choose [Expand].
    Choosing [Expand] once again will show all of the three panes.
Procedure 4
Move the focus to the pane you want to expand, and press <Z> key. Pressing <Z> key once again will show all of the three panes.


 4.4.3 Selecting a Packet or Record

Procedure 1

Click the row on Summary or Sequence pane corresponding to a packet or record of your interest.

Procedure 2

  1. Right-click on a decode or stream view.
  2. Choose [Go to...].
  3. Enter frame ID or stream ID.
    If a stream ID is specified, the first record of the stream will be selected.

Procedure 3

  1. Press <Ctrl-G> key.
  2. If a stream ID is specified, the first record of the stream will be selected.

Procedure 4

  1. Move the focus to Summary or Sequence pane.
  2. Change the selected packet, by pressing < [image] >, < [image] >, <Page Up>, <Page Down>, <Home>, and/or <End> keys.

Procedure 5

Change the selected packet, by pressing <Ctrl- [image] >, <Ctrl- [image] >, <Ctrl-Home>, and/or <Ctrl-End> keys. Moving the focus to Summary pane is not necessary.

Note

  • Procedures 2, 3 and 5 are not available in plain stream view.


 4.4.4 Specifying the Row Displayed on a Packet Detail Pane by Default

When you look through packets or records one by one, you can keep displaying the specific field of a particular protocol in Packet Detail pane.

Procedure

  1. Click the field your want keep displaying in the Packet Detail pane.
  2. Select other packets or records.


 4.4.5 Looking for the Packets Constituting a Record

Procedure 1

  1. Select a record in a stream view.
  2. Click [Decode View] button ( [image]) on the toolbar of the stream view.
  3. Press <Alt- [image] > or <Alt- [image] > key.

Procedure 2

  1. Right-click on a record in a stream view.
  2. Choose [Show Associated Packets].

Note

  • This operation is applicable only to plain stream view.
  • If you select a record in the Summary pane of a stream view, the packets constituting the record will be highlighted in green. When you click the [Frame ID] column header and choose [(Check Marks on Green Rows)], check box of the highlighted rows are selected.
    Choosing [(Check Marks on Green Rows)] with <Shift> key pressed will display only the highlighted rows.


 4.4.6 Displaying Packets Constituting a Stream

Procedure

  1. Click a row of Session List pane.
  2. The rows corresponding to the packets consituting the selected session will be highlighted in orange in decode view.
  3. Clicking [Frame ID] column header and selecting [(Check Marks on Orange Rows)] will put check marks on the rows highlighted. If [(Check Marks on Orange Rows)] is selected with <Shift> key pressed, olny the rows hilighted will be displayed.

Note

  • The procedure above is available only in stream view in sequence mode.


 4.4.7 Searching String (Summary Pane)

You can search a string in each pane of the decode and stream view.

Procedure

  1. Set the forcus to the Summary pane.
  2. Choose [Find...] from the [Edit] menu of the Main window, or press <Ctrl-F> key.
  3. Enter the text you want to search for, and click [Find Next] button.

Note

  • You can use regular expressions for search in Summary pane. Select [Regular Expression] check box and enter regular expressions into [String].


 4.4.8 Searching String (Sequence Pane)

Consider it as the target of search of the record of a session selected by Session List pane now in Sequence pane. It can also be aimed at the decoded result of not only the record currently displayed on Sequence pane but all records.

Procedure

  1. Move a focus to Sequence pane.
  2. Select [Find...] from [Edit] menu of Main window, or press <Ctrl-F> key.
  3. If it searches for all records, select to [Search Through Session] check box.
  4. Enter a text and click [Find Next] button.

Note

  • It can search using a regular expression . Select to [Regular Expression] check box and enter a regular expression into [String].


 4.4.9 Searching String (Packet Detail Pane and Dump Pane)

When the focus is set to the Packet Detail pane, the decoded result of the packet or record selected in the Summary pane will be searched.
When the focus is set to the Dump pane, the hexadecimal dump of the packet or record selected in the Summary pane will be searched.
Furthermore, the decoded results of all packets and records can be searched.

Procedure

  1. Set the focus to the Packet Detail pane or Dump pane.
  2. Choose [Find...] from the [Edit] menu of the Main window, or press <Ctrl-F> key.
  3. If you want search through all packets or records, select [Search Through Packet] check box or [Search Through Session] check box.
  4. Enter the text you want to search, and click [Find Next] button.

Note

  • You can use a regular expression to search Summary pane. Select [Regular Expression] check box and enter a regular expression into [String].
  • The Dump pane is horizontally divided into three regions. The left region is for displaying the addresses of the data starting from 0, and is not searched.
  • The hexadecimal representation of data in the middle region and the character representation in the right regions of Dump pane will be searched. That is, in the Dump pane, you can specify the text to be searched either in hexadecimal numbers or characters.
    When you need to search for data that cannot be expressed in printable characters, enter the data in its hexadecimal representation instead. For example, when searching for the text "Keep", you can enter "Keep", "4b656570", or "4b 65 65 70".


 4.4.10 Displaying Statistics of Decoded Data in a Chart or a Table

You can display the statistics of decoded data in a chart or a table.

Procedure 1

  1. Click [Statistics] button ( [image]) on the toolbar of the decode view.
  2. Choose statistics of your interest.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Statistics].
  3. Choose statistics of your interest.

Note

  • [MAC Error Frames] and [TCP Status Information] are not available for decoded data.
  • If you click [Read Values in Chart] button ( [image]) on a toolbar of a line chart window, and drag the mouse to specify the range, the rows of Summary pane corresponding to the specified range will be highlighted in purplish red.
    Clicking on the [Frame ID] or [Stream ID] column and choosing [(Check Marks on Red Rows)] will select the check boxes in the [Frame ID] or [Stream ID] column of the highlighted rows. If you do so while pressing <Shift> key, the highlighted rows will be shown and other rows hidden.
  • The plotting interval of a line chart can be changed in the Traffic window created from the decode view. Right-click on a window and choose [Plot Interval...].


 4.4.11 Displaying Network Utilization of Decoded Data

You can view the network utilization at the time the data captured, by displaying the statistics of MAC Traffic with utilization as unit.

It is necessary to know the link speed for calculating the utilization. If the default link speed is not set yet, [Link Speed] dialog box will appear.

Procedure 1

  1. Right-click on a decode view.
  2. Choose [Statistics].
  3. Choose [1 MAC Traffic].
  4. Right-click on the window.
  5. Choose [Unit].
  6. Choose [Utilization].
  7. If the link speed is not yet set, [Link Speed] dialog box will appear. Specify the link speed.

Procedure 2

  1. Click [Statistics] button ( [image]) on the toolbar of a decode view.
  2. Choose [1 MAC Traffic].
  3. Right-click on the window.
  4. Choose [Unit].
  5. Choose [Utilization].
  6. If the link speed is not set yet, [Link Speed] dialog box will appear. Specify the link speed.

Specifying Link Speed

If the default link speed is set, the network utilization chart will be displayed for a capture file, using the default link speed in calculation.

Procedure 1

  1. Open [Options] dialog box.
  2. Click [Decode] in the tree view in the left of the dialog box.
  3. Enter the link speed into [Default link] field.

Procedure 2

  1. Right-click on a statistics window displayed from the decode view.
  2. Choose [Properties...].
  3. Click [Information] tab.
  4. Enter the link speed into [Link speed] field.

Note

  • [Link Speed] dialog box will not appear in the following cases;
    • Link speed is set using [Advanced] dialog box.
    • The data is captured using the NIC which provide the system with the link speed.
  • Selecting [Reset to default] check box of [Link Speed] dialog box will set link speed to the default link speed.
  • You cannot acquire the accurate network utilization from the filtered capture data.


 4.4.12 Displaying Host Names instead of IP Addresses (Decoding)

You can display host names instead of IP addresses in the decode and stream views. ASTEC Eyes searches for a host name using the name services: DNS, WINS (NetBIOS), and/or NIS.

Procedure

  1. Right-click a row of the Summary pane which contains an IP address in the address column, in a decode or stream view.
  2. Choose [Search Host Name].
  3. Choose [DNS], [NetBIOS], or [NIS (domain name)].

Note

  • You need to specify the NIS domain name before choosing [NIS (domain name)].


 4.4.13 Displaying Newly Found Host Names

If you search a host name after displaying a decode or stream view, or change the order of the name services preference, you can update the host names displayed on the decode or stream view.

Procedure 1

Click [Update Host Names] button ( [image]) on the toolbar of the decode or stream view.

Procedure 2

  1. Right-click on a decode or stream view.
  2. Choose [Update Host Names].


 4.5.1 Convenience Filter

The convenience filter allows the user to screen packets or records easily through GUI in the realtime decode, decode and stream view, without specifying logical expressions.

Three types of convenience filters are available;

  • caption filter
  • header attribute filter
    • , and
  • decode result filter
    • .


 4.5.2 Caption Filter (Convenience Filter)

The caption filter is one of the convenience filters. It allows you to select from the values shown in the pull-down menu to screen packets or records, for each column of Summary pane of the decode or stream view, or Sequence pane of frealtime decode view.


 4.5.2.1 Displaying Packets or Records Containing the Specified Value

Procedure

  1. Click on any column header with [image] mark in the Summary pane of the decode or stream view, or in the Sequence pane of realtime decode view.
  2. Choose the menu item you want to use to screen packets or records.


 4.5.2.2 Displaying Packets or Records Containing One of the Specified Value

Procedure

  1. Click on any column header with [image] mark in the Summary pane of the decode or stream view.
  2. Choose [(Options...)].
  3. Select [Multiple selections]
  4. Select the items from the list which you want to use to screen packets or records.

    5. Entering a text and clicking [Find] button will search the list of items for the text.


 4.5.2.3 Displaying Packets or Records Containing the Value within the Specified Range

You can display only the packets or records containing the value within the specified range.
This operation is available for the following columns;

  • Frame ID
  • Stream ID
  • Length
  • Source Port
  • Destination Port
  • Port 1
  • Port 2

Procedure

  1. Click on any of the column headers listed above.
  2. Choose [(Options...)].
  3. Select [Range] and specify the range.


 4.5.2.4 Displaying Packets or Records Containing the Specified Text

You can display the packets or records containing a specific text.
This operation is available for the following columns;

  • Source Addr
  • Destination Addr
  • Protocol
  • Summary
  • Address 1
  • Address 2
  • Address<=>Address... (sequence mode of the stream view)

Procedure

  1. Click on any of the column header listed above.
  2. Choose [(Options...)].
  3. Select [Substring match] and enter a text.


 4.5.2.5 Finding Required Item When There Are Too Many Menu Items (Caption Filter)

If there are too many items for a caption filter menu, all of them will not be the target value will not be displayed on the menu. In such a case, use the [Candidate List] dialog box.

Procedure

  1. Click on any column header with [image] mark in the Summary pane of the decode or stream view.
  2. Choose [(Candidate List...)], if there is one in the menu.
  3. Select the item from the list you want to use screen packets or records.
    Entering a text and clicking [Find] button will search the list of items for the text.

Note

  • If the number of menu items are less than or equal to 16, [(Candidate List...)] will not appear.


 4.5.2.6 Canceling Caption Filter

Canceling a Specific Caption Filter
This operation cancels only the specified caption filter. Other caption and convenience filters will remain.

Procedure

  1. Click on any column header with [image] mark in the Summary pane of the decode or stream view.
  2. Choose [(All)].

Canceling all the Convenience Filters
This operation cancels all the convenience filters for a decode or stream view.

Procedure 1

Click [Discard Filter] button ( [image]) on the toolbar of a decode or stream view.

Procedure 2

Right-click on a decode view, point [Filter], and choose [Discard Filter].

Procedure 3

Right-click on a stream view and choose [Discard Filter].


 4.5.3 Header Attribute Filter (Convenience Filter)

You can screen packets in a decode view based upon the attributes of packet headers, like a Monitor window displaying traffic based upon various attributes of packet headers. This function is called the header attribute filter.


 4.5.3.1 Displaying Packets with the Specified Header Attribute

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose a header attribute.
  3. Choose the menu item you want to use to screen packets.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose a header attribute type.
  5. Choose the menu item you want to use to screen packets.


 4.5.3.2 Displaying Packets with One of the Specified Header Attribute

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose a header attribute type.
  3. Choose [Option...]
  4. Choose [Multiple selections].
  5. Select the item from the list you want to use to screen packets.
    Entering a text and clicking [Find] button will search the list of items for the text.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose a header attribute type.
  5. Choose [Option...]
  6. Choose [Multiple selections].
  7. Select the item from the list you want to use to screen packets. Entering a text and clicking [Find] button will search the list of items for the text.


 4.5.3.3 Displaying Packets Containing the Specified Text in the Header Attribute

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose a header attribute type.
  3. Choose [Option...]
  4. Choose [Substring match] and enter a text.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose a header attribute type.
  5. Choose [Option...]
  6. Choose [Substring match] and enter a text.


 4.5.3.4 Finding Required Item When There Are Too Many Menu Items (Header Attribute Filter)

If there are too many items for a caption filter menu, all of them will not be the target value will not be displayed on the menu. In such a case, use the [Candidate List] dialog box.

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose a header attribute type.
  3. Choose [Lists...].
  4. Select the item from the list you want to use screen packets.
    Entering a text and clicking [Find] button will search the list of items for the text.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose a header attribute type.
  5. Choose [Lists...].
  6. Select the item from the list you want to use screen packets.

    Entering a text and clicking [Find] button will search the list of items for the text.

Note

  • If the number of menu items are less than or equal to 16, [(Candidate List...)] will not appear.


 4.5.3.5 Canceling Header Attribute Filter

Canceling a Specific Header Attribute Filter
This operation cancels only the specified header attribute filter. Other header attribute and convenience filters will remain.

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose a header attribute type.
  3. Choose [All].

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose a header attribute type.
  5. Choose [All].

Canceling all the Convenience Filters
This operation cancels all the convenience filters of a decode view.

Procedure 1

Click [Discard Filter] button ( [image]) on the toolbar of a decode view.

Procedure 2

Right-click on a decode view, point [Filter], and choose [Discard Filter].


 4.5.3.6 Displaying Packets Transmitted between Two Hosts

You can display the packets transmitted between two hosts using a header attribute filter.

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose [3 MAC Host Pairs] or [7 IP Host Pairs].
  3. Choose the host pair you want to use to screen packets.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose [3 MAC Host Pairs] or [7 IP Host Pairs].
  5. Choose the host pair you want to use to screen packets.


 4.5.3.7 Displaying All Packets Related to the Specific Protocol over TCP

The communication of a TCP application proceeds as follows;

  1. Establish the TCP connection.
  2. Transfer the data of the application.
  3. Close the TCP connection.
The protocol name of an application is displayed in the Protocol column of the Summary pane of the decode view, for the packets containing the application data, On the other hand, for the packets of establishing or closing the connection, TCP is used as protocol name.
You can display both of these packets using a single header attribute filter.

Procedure 1

  1. Click [Header Attribute Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose [8 IP Protocols].
  3. Choose the application protocol you want to use to screen packets.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Header Attribute Filter].
  4. Choose [8 IP Protocols].
  5. Choose the application protocol you want to use to screen packets.


 4.5.4 Decode Result Filter (Convenience Filter)

The decode result filter is one of the convenience filters. It allows you to screen packets in a decode view based upon the contents displayed in Packet Detail pane.

The decode result filter is available only in decode view and plain stream view. It is not available in realtime decode view and stream view of Sequence mode.


 4.5.4.1 Displaying Packets or Records Containing the Specified Text in Decode Result

You can display the packets or records containing a specific text in the Packet Detail pane.

Procedure 1

  1. Click [Decode Result Filter] button ( [image]) on the toolbar of a decode or stream view.
  2. Select [Include].
  3. Enter a text into the drop down combo box, and click [OK] button.

Procedure 2

  1. Right-click on a decode or stream view.
  2. Choose [Filter].
  3. Choose [Decode Result Filter...].
  4. Select [Include].
  5. Enter a text into the drop down combo box, and click [OK] button.

Note

  • Select [Protocol restriction] check box and click [Select...] button. The [Candidate List (Multiple selections)] dialog box will appear. When you select a protocol from the list of the dialog box, the decoded result of the selected protocol will be displayed.
  • It may take long, depending on the decode data to filter. Click [Cancel] button of [ASTEC Eyes] dialog box to stop the filtering process.


 4.5.4.2 Displaying Packets or Records with the Specified Field Value

You can display the packets or records including a specific value in the specified field of the Packet Detail pane.

Procedure 1

  1. Click [Decode Result Filter] button ( [image]) on the toolbar of a decode or stream view.
  2. Select [Field and value].
  3. Enter [Field] and [Value], and click [OK] button.

Procedure 2

  1. Right-click on a decode or stream view.
  2. Choose [Filter].
  3. Choose [Decode Result Filter...].
  4. Select [Field and value].
  5. Enter [Field] and [Value], and click [OK] button.

Note

  • Select [Protocol restriction] check box and click [Select...] button. The [Candidate List (Multiple selections)] dialog box will appear. When you select a protocol from the list of the dialog box, the decoded result of the selected protocol will be displayed.
  • It may take long, depending on the decode data to filter. Click [Cancel] button of [ASTEC Eyes] dialog box to stop the filtering process.


 4.5.4.3 Canceling Decode Result Filter

Canceling Decode Result Filter Only
This operation cancels the decode result filter only. Other convenience filters will remain.

Procedure 1

  1. Click [Decode Result Filter] button ( [image]) on the toolbar of a decode or stream view.
  2. Click [Reset] button.

Procedure 2

  1. Right-click on a decode or stream view.
  2. Choose [Filter].
  3. Choose [Decode Result Filter...].
  4. Click [Reset] button.

Canceling all the Convenience Filters
This operation cancels all the convenience filters of a decode or stream view.

Procedure 1

Click [Discard Filter] button ( [image]) on the toolbar of a decode or stream view.

Procedure 2

Right-click on a decode view, point [Filter], and choose [Discard Filter].

Procedure 3

Right-click on a stream view and choose [Discard Filter].


 4.5.5 Using Combining Convenience Filter

A convenience filter is applied for the packets or records currently displayed on a decode or stream view. Therefore, you can apply an additional convenience filter to the result of any convenience filter, getting the result of the conditions combined by logical AND operation.

You can use the check boxes of [Frame ID] column of decode view or [Stream ID] column of stream view, to get the result of the conditions combined by logical OR operation.

Procedure

  1. Apply a first filter.
  2. Click on the column header of [Frame ID] or [Stream ID].
  3. Choose [(Set Check Marks)].
  4. Click [Discard Filter] button ( [image]) on a toolbar.
  5. Apply a second filter.
  6. Click on the column header of [Frame ID] or [Stream ID].
  7. Choose [(Set Check Marks)].
  8. Click [Discard Filter] button ( [image]) on a toolbar.
  9. Click on the column header of [Frame ID] or [Stream ID].
  10. Choose [image] (check mark).


 4.5.6 Display Filter

If you want to use complex conditions that are hard or impossible to configure by the convenience filter, use the display filter. You can use the filter editor to configure the display filter.

The display filter is available only in decode view.


 4.5.6.1 Displaying Packets with Specified Condition

In order to use a display filter, create a display filter using filter editor first. Next, apply the display filter to a decode view.

Applying a Display Filter

Procedure 1

  1. Click [Display Filter] button ( [image]) on the toolbar of a decode view.
  2. Choose the name of the filter you want to apply from the menu.

Procedure 2

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Display Filter].
  4. Choose the name of the filter you want to apply from the menu.

Note

  • A new decode view will appear showing only the packets matching the display filter. In this decode view, numbers in the Frame ID column will be shown in green.
  • You cannot use a display filter in a stream view. Create a stream view from the decode view to which the display filter is applied.


 4.5.6.2 Generating Display Filter from a Packet Data

You can generate a logical expression to use in the filter editor, based of the

  • connection
    • ,
  • host pair
    • ,
  • protocol
    • ,
  • frame ID
    • , or
  • date
of the specified packet using drag and drop or popup menu operation.

Procedure 1

  1. Right-click on a decode view.
  2. Choose [Filter].
  3. Choose [Generate Filter].
  4. Choose [Send to Filter Editor].
  5. Choose the condition you want to apply from the menu.
  6. Click [Apply] button of the filter editor.
Procedure 2
  1. Open the filter editor.
  2. Drag a packet from a decode view and drop it on the [ [image] Display Filter] of the filter editor.
  3. Click [Apply] button of the filter editor.


 4.5.6.3 Displaying Packets Using a Temporary Display Filter

You can generate a logical expression from the

  • connection
  • host pair
  • protocol
  • frame ID
  • date
of the specified packet using drag and drop or popup menu operation, and apply it to decode view temporarily.

Procedure

  1. Right-click on a packet of the decode view.
  2. Choose [Filter].
  3. Choose [Generate Filter].
  4. Choose [Make and Apply Temporarily].
  5. Choose the condition you want to apply from the menu items

Note

  • The logical expression generated by this operation is not set to filter editor.


 4.6.1 Changing the Order of the Columns of Summary Pane

You can change the order of the columns in decode view, and Summary and Sequence pane of stream view. You can also revert the order of the columns in Summary pane to default.

Changing the Order of Columns

Procedure 1

  1. Drag a column header of the Summary or Sequence pane to right or left.
  2. Drop it where you want to place it.

Procedure 2

  1. Right-click on a column header of the Summary pane.
  2. Choose [Columns...].
  3. Click an item in the list.
  4. Change its position in the list, clicking [Up] or [Down] button.

Note

  • When you drag a column header, a border between two column headers will change into blue. When you drop the column header, it will be inserted at the position of the blue border.
  • Drag the center of a column header by the mouse cursor. If you place the mouse cursor at the end of a column, it will change to the cursor for changing the column width.

Restore to the Initial Order

Procedure

  1. Right-click on a column of the Summary pane.
  2. Choose [Columns...].
  3. Click [Default] button.
    This operation also restores the column width and the state of the columns, shown and hidden, to the initial status.

Note

  • When the column width is 0 pixel, or greater than the width of a decode view or stream view, it is difficult to place a mouse cursor at an end of the column. In such cases, you can change the column width using [Width] of the [Configure Columns] dialog box.


 4.6.2 Toggling the Column of Summary Pane between Shown and Hidden

Procedure 1

  1. Right-click on a column header of the Summary pane.
  2. Hide or show a column by selecting or clearing the corresponding menu item.

Procedure 2

  1. Right-click on a column header of the Summary pane.
  2. Choose [Columns...].
  3. Select or clear the check box corresponding to a column.

Note

  • You can not hide the Frame ID and Stream ID columns.


 4.6.3 Toggling the Toolbar of Decode or Summary View between Shown and Hidden

Procedure

  1. Right-click on a decode or stream view.
  2. Choose [Display Toolbar].


 4.7.1 Decoding Protocols Transmitted through Other than the Well-known Ports

ASTEC Eyes identify the application layer protocols using the TCP or UDP ports. ASTEC Eyes cannot always identify the protocols transmitted using the ports other than the well-known ports, e.g., when a proxy server or an ephemeral port is used.
In such a case, configure a decoding hint.

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode Hints] in the tree view in the left of the dialog box.
  3. Configure a decoding hint.

Note

  • If you configure a wrong decode hint, an error may occur while decoding.
  • In order to reflect decode hint in the decode or stream view already displayed, update decode view.


 4.7.2 Identifying Protocols ASTEC Eyes does not Support

You can prevent ASTEC Eyes from trying to interpret the application layer protocols it does not support, by configuring such protocols in decode hint.

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode Hints] in the tree view in the left of the dialog box.
  3. Specify an IP address, transport protocol, and port number, and enter arbitrary text as protocol name.

Note

  • A packet in a decode view will be displayed as follows;
    • The protocol name configured with the decode hint is displayed on the protocol column of the Summary pane.
    • "Maybe a packet of protocol name protocol" is displayed on the summary column of the Summary pane.
    • "Unknown Data" is displayed on the application layer field of the Packet Detail pane.
  • The packet in the stream view will be displayed as follows;
    • The protocol name configured with the decode hint is displayed on the protocol column of the Summary pane.
    • "Maybe a record of protocol name protocol" is displayed on the summary column of the Summary pane.
    • "Unknown Data" is displayed on the application layer field of the Packet Detail pane.


 4.7.3 Verifying Checksum Value

ASTEC Eyes will verify the checksum value of IPv4, UDP, and TCP when decoding, if configured so. If the checksum value in a packet is wrong, decoding for the packet will be stopped.

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode] in the tree view in the left of the dialog box.
  3. Select to [Detect checksum error] check box.

Note

  • If you are using the NIC (Network Interface Card) with checksum offload, it is not recommended to verify checksum values.
  • The configuration of checksum verification will not be reflected in the decode view already displayed. In order to reflect it, you need to update decode view.


 4.7.4 Updating Decode View

You need to update decode view in order to reflect the following changes to a decode or stream view.

  • adding, deleting, or changing the decode hint
  • configuring the checksum verification
  • changing order of records in the stream view (time order or stream ID order)

Procedure 1

  1. Click [Update Decode View] button ( [image]) on the toolbar of the decode or stream view.
Procedure 2
  1. Right-click on a decode or stream view.
  2. Choose [Update Decode View].


 4.7.5 Updating Decode View with Specified Japanese Encoding

For the capture data containing Japanese text, you can specify encoding and update the decode view.

Changing the Encoding of a Packet or Record

  1. Right-click on a decode or stream view.
  2. Choose [Japanese encoding].
  3. Choose one of the encodings;
    • JIS
      • ,
    • EUC
      • ,
    • SJIS
      • , or
    • Unicode (UCS-2 and UTF-8)
      • .
Changing the Encoding of the Data Currently Displayed

You can change the configuration for the encoding of not only the selected packet or record but all the data currently displayed all at once.

  1. Right-click on a decode or stream view.
  2. Choose [Japanese encoding].
  3. Choose [Apply to All Packets].
  4. Choose one of the encodings;
    • JIS
      • ,
    • EUC
      • ,
    • SJIS
      • , or
    • Unicode (UCS-2 and UTF-8)
      • .

Note

  • Right-click the row you want to change the encoding when clicking Summary pane, since the right-click will also select a row.
  • This operation does not change the encoding of packets or records not shown, e.g., by applying a filter.
  • The encoding selected by the protocol specification will not change. This operation does not affect a decoded result.


 4.7.6 Error in Decoding Data

If you try to decode data with an incorrect decode hint, or the data itself is erroneous, decoding might fail. In such a case, the decode and stream views will be shown as follows;

  • In a decode or stream view, the color of the check box for the packet or record that could not be decoded in the Summary pane will be shown in red.
  • A message including the frame ID or stream ID of the packet/record that could not be decoded and its protocol name are printed in the Message window of the Main window.
When an error massage is printed, you are recommended to save necessary data and exit ASTEC Eyes.
If an error occurs with correct decode hints, please contact ASTEC Eyes support.


 5 Traffic Generator

It is the function to transmit the created packet and the captured packet.


 5.1.1 Creating and Sending Packets

  1. Open Packet Transmission Window.
  2. Add a packet.
  3. Click [Append...] menu.
  4. Edit a packet.
  5. Click [Send...] button.
  6. Transmit packet(s) from [Send Packet] dialog box.

Opening Packet Transmission Window

Procedure

Select [Packet Generation...] from [Tool] menu of Main window.

Adding a packet

Procedure

  1. Click [Append...] menu.
  2. Select the type of a packet to add.

Editing a packet

Procedure 1

  1. Click a packet to edit.
  2. Click data you want to edit in [Packet] region with the mouse.
  3. Enter the new value in hexadecimal numbers.

Procedure 2

  1. Selecting ICMP as type from [Append...] menu will display [Parameters of generated packet] dialog box.
  2. Specify [Length] in [Data] region.
  3. Click data to edit with the mouse.
  4. Enter the new value in hexadecimal numbers.


 5.1.2 Creating ICMP Packets

You can create an ICMP Echo Request packet easily, by selecting [2 ICMP Echo Request] from [Append...] menu of Send Packet window.

Procedure

  1. Click [Append...] menu and select [2 ICMP Echo Request]. [Parameters of generated packet] dialog box will appear.
  2. Enter the source and destination MAC addresses into [Source] and [Destination] fields of [MAC Address] region, respectively.
  3. Enter the source and destination IP addresses into [Source] and [Destination] fields of [IP Address] region, respectively.
  4. Enter the length of data (excluding the ICMP header) of ICMP packet into [Length] field of [Data] region.
  5. Edit the data in [Data] region.
  6. Click [OK] button.


 5.2.1 Sending Captured Packets

  1. Click [Packet Edit Window] button ( [image]) on the toolbar of the decode view showing the data to transmit. Packet Edit window will appear.
  2. Edit packets.
  3. Click [Send Packets] button ( [image]) on the toolbar.
  4. Transmit packets from [Packet Generation] dialog box.

Editing packets

Procedure

  1. Click the packet you want to edit in Summary pane with the mouse.
  2. Click the data you want to edit in Dump pane with the mouse.
  3. Enter the new value in hexadecimal numbers.

Transmitting packets

Procedure

  1. Customize the transmission procedure of packets, if necessary .
  2. Click [Apply] button.
  3. Click [Start] button.

Note

  • Editing a packet will display * mark in [Frame ID] column of Summary pane.
  • Click [Update Decode View] button ( [image]) on the toolbar, to update Packet Detail pane to show the result of the edition.
  • You need to click [Apply] button, even when you do not change the transmission procedure.


 5.2.2 Undoing and Redoing Packet Modification

Changes made on Packet Edit window can be canceled or once canceled changes can be made effective again.

Canceling a change

Click [Undo] button ( [image]) on the toolbar of Packet Edit window.

Making a canceled change effective again

Click [Redo] button ( [image]) on the toolbar of Packet Edit window.

Note

  • If [Undo] button ( [image]) is clicked twice or more, two or more changes made will be canceled in reverse order.
  • If [Redo] button ( [image]) is clicked twice or more, two or more changes once canceled will be made effective again.


 5.2.3 Using Filter

You can narrow down packets to edit through GUI in Packet Edit window, using convenience filter.

There are three kinds of convenience filter;

  • caption filter
  • header attribute filter
  • decode result filter


 5.2.4 Replacing Addresses over Packets

You can change addresses in multiple packets by one operation. The MAC and IP addresses contained in packet headers need to correspond to the following addresses correctly;

  • MAC and IP addresses of the computer sending packets
  • MAC and IP addresses of the computer receiving packets
  • IP address of the network in the transmission path
Otherwise packets will not be delivered as intended.

Procedure

  1. Click [Packet Edit Tool] button ( [image]) on the toolbar of Packet Edit window.
  2. Open [Address] page and specify the range of the packets to change, the type of address, and the new address.


 5.2.5 Replacing Data over Packets

You can change data in multiple packets by one operation.

Procedure

  1. Click [Packet Edit Tool] button ( [image]) on the toolbar of Packet Edit window.
  2. Open [By range] or [By field] page and specify the substitution of data.


 5.3 Sending Packets

Procedure

  1. Open [Packet Generation] dialog box.
  2. Specify parameters in [Settings] region.
  3. Click [Apply] button.
  4. Click [Start] button.

Opening [Send Packet] dialog box

Procedure 1

Click [Send...] button in [Send Packet] dialog box.

Procedure 2

Click [Send Packets] button ( [image]) on the toolbar of Packet Edit window.

Note

  • The transmission status is displayed in [Status] region.


 5.3.1 Stopping Packet Transmission

Procedure

Click [Stop] button in [Packet Generation] dialog box.

Note

  • The transmission status is displayed in [Status] region.


 5.3.2 Customizing How Packets Are Sent

You can make checksums re-calculated, change transmission intervals, and specify how many times one packet should be transmitted, using [Packet Generation] dialog box before transmission.

Making checksums re-calculated

When the content of a packet is modified, it is necessary to re-calculate its checksums using the new content.

Procedure

Click [Recalculate] button in [Packet Generation] dialog box.

Changing the transmission intervals

Procedure

  1. Select [Fix] check box in [Interval] region.
  2. Select the unit of time interval; millisecond or second.
  3. Enter a time interval.

Note

  • 0 millisecond or 0 second will send packets as fast as possible.

Specifying transmission count

Specify how many times one packet should be transmitted.

Procedure

  1. Enter [Times repeated].

Note

  • The checksum re-calculation is performed on checksums contained in IP header, TCP header, UDP header,and ICMP header.
  • The captured data will be transmitted by the time intervals when they are captured, unless the transmission intervals are specified.


 6 Managing Addresses and Host Names

You can use host names instead of IP or MAC addresses to identify hosts in a monitor window, decode view, and so on. The search results of DNS, NetBIOS and NIS are available for a host name. The user-defined name is also available for a host name. The address book can be used, in order to confirm the correspondence of an address and a host name, or to manage it.


 6.1.1 Choosing the Host Name Used to Identify the Host

You can use host names registered through the name services or user-defined names as well as IP and MAC addresses to identify hosts in the monitor window, decode view, and stream view.

  • NetBIOS names found while decoding and user-defined names are available for a MAC address.
  • DNS names, NetBIOS names, NIS names, and user-defined names are available for an IP address. If more than one host name is registered through different name services for one IP address, you can specify the host name to be used for display.
  • More than one user-defined name can be assigned to an IP or a MAC address. In addition, more than one name might be assigned to an IP address by a name service. In such cases, you can choose a name using the address book. Refer to "Selecting Host Name to Be Displayed Using Address Book".

Specifying a Host Name to Be Displayed and Preference

Procedure 1

  1. Open [Options] dialog box.
  2. Click [Display Host Name] in the tree view in the left of a dialog box.
  3. Select the check boxes of the name services to be used, in the [Name to display] region.
  4. Click the name service whose preference you want to change.
  5. Click [Up] button or [Down] button.

Procedure 2

  1. Choose [Search Host Name...] from the [Tool] menu of the Main window, or press <Ctrl-L> key.
  2. Click [Set Display Preference...] button.
  3. Select the check boxes of the name services to be used.
  4. Click the name service whose preference you want to change.
  5. Click [Up] button or [Down] button.

Procedure 3

  1. Choose [MAC Address Book] or [IP Address Book] from the [Edit] menu of the Main window.
  2. Right-click on an address book.
  3. Select [Set Display Preference...].
  4. Select the check boxes of the name services to be used.
  5. Click the name service whose preference you want to change.
  6. Click [Up] button or [Down] button.

Note

  • You cannot use WINS (NetBIOS name) to search IPv6 addresses.


 6.1.2 Specifying NIS Domain Name and NIS Server

Procedure 1

  1. Choose [Search Host Name...] from the [Tool] menu of the Main window or press <Ctrl-L> key.
  2. Select [NIS] check box.
  3. Enter NIS domain name into [NIS domain name], and NIS server address or host name into [NIS server address].

Procedure 2

  1. Open [Options] dialog box.
  2. Click [Display Host Name] in the tree view in the left of a dialog box.
  3. Enter NIS domain name into [NIS domain name], and NIS server address or host name into [NIS server address].


 6.1.3 Selecting Host Name to Be Displayed Using Address Book

If more than one host name is registered by multiple name services for one IP address, you can specify the host name to be used.

Procedure 1

  1. Choose [MAC Address Book] or [IP Address Book] from the [Edit] menu of the Main window.
  2. Double-click on a cell you want to configure.
  3. Select a name from the drop down list.

Procedure 2

  1. Choose [MAC Address Book] or [IP Address Book] from the [Edit] menu of the Main window.
  2. Move the white frame to a cell you want to configure by < [image] >, < [image] >, < [image] >, and < [image] > key.
  3. Press <F2> key.
  4. Select a name by < [image] > or < [image] > key, and press <Enter> key.

Note

  • If more than one host name is registered by one name service, or more than one user-defined name is registered, the number of candidates will be shown in parentheses on the right-hand side of the cell, and the host names are listed in the tool tip.


 6.1.4 Searching Host Names

You can search for host names corresponding to IP address found while monitoring or decoding. DNS, WINS (NetBIOS), and NIS are available for searching host names.

Procedure

  1. Choose [Search Host Name...] from the [Tool] menu of the Main window, or press <Ctrl-L> key.
  2. Specify an IP address range to search and name service to use.
  3. Click [Find] button.

Note

  • You need to specify a NIS domain name when you use NIS.
  • You cannot use WINS (NetBIOS name) to search IPv6 addresses.


 6.2.1 Whois Tool

You can search Whois data in ASTEC Eyes as follows;

  1. Open [Whois] dialog box.
  2. Specify Parameters and search Whois data.

Opening Whois Dialog Box

Procedure 1 (searching a specified host name)

Choose [Whois Tool...] from the [Tool] menu of the Main window.

Procedure 2 (searching with a Traffic window)

  1. Click a Graph Item or row for which you want to search a host name, in the Traffic window displaying IP addresses.
  2. Right-click on the window.
  3. Choose [Network Tools].
  4. Choose [Whois]. If more than one item is displayed, choose the host name or domain name you want to search.

Procedure 3 (searching with the Address Table or Address Book)

  1. Right-click on the row of the host you want to search in the IP Address Table, MAC - IP Address Table, or IP Address Book.
  2. Choose [Network Tools].
  3. Choose [Whois]. If more than one item is displayed, choose the host name or domain name you want to search.

Procedure 4 (search with the decode or stream view)

  1. Right-click on a packet or record containing an IP address in a decode or stream view.
  2. Choose [Network Tools].
  3. Choose [Whois]. If more than one item is displayed, choose the host name or domain name you want to search.

Configuring Whois Server, etc. and Searching

Procedure

  1. Enter a text into [Key] field of the [Whois] dialog box.
    If you open the [Whois] dialog box from a decode view, and so on, [Key] field is specified.
  2. Select a Whois server from the [Whois server] drop down combo box. In order to use a Whois server not in the list, enter the name into [Whois server] field.
  3. If you want connect to a Whois server through SOCKS server, select [Use SOCKS] check box and choose a SOCKS server.
    If there is not a SOCKS server you want to use in the list, click [Advanced...] button and     configure a SOCKS server.
  4. Click [Run] button.
    Selecting [Print results on message window] will display the search results in the Message window of the Main window instead of [Result] region.


 6.2.2 Ping Tool

You can run ping in ASTEC Eyes as follows;

  1. Open [Ping] dialog box.
  2. Specify parameters and run ping.

Opening Ping Dialog Box

Procedure 1 (running ping to the specified host)

Choose [Ping Tool...] from the [Tool] menu of the Main window.

Procedure 2 (running ping to a host in a Traffic window)

  1. Select a Graph Item in a Traffic window displaying traffic by IP addresses.
  2. Right-click on the window.
  3. Choose [Network Tools].
  4. Choose [Ping]. If more than one item is displayed, choose the host you want to ping to.

Procedure 3 (running ping to a host in the Address Table or Address Book)

  1. Right-click on the row of the host you want to search in the IP Address Table, MAC - IP Address Table, or IP Address Book.
  2. Choose [Network Tools].
  3. Choose [Ping]. If more than one item is displayed, choose the host you want to ping to.

Procedure 4 (running ping to a host in a decode or stream view)

  1. Right-click on a packet or record containing an IP address in a decode or stream view.
  2. Choose [Network Tools].
  3. Choose [Ping]. If more than one item is displayed, choose the host you want to ping to.

Specifying Parameters and Running Ping

Procedure

  1. Enter an IP address or host name to be pinged into [Host] field.
    If you open the [Ping] dialog box from a decode view, and so on, [Host] field is specified.
  2. Specify the size and transmission count of packets to be sent by ping.
  3. If you want to ping to the host outside of LAN using SOCKS server, select [Use SOCKS] check box and choose a SOCKS server.
    If there is not a SOCKS server you want to use in the list, click [Advanced...] button and     configure a SOCKS server.
  4. Click [Run] button.
    Selecting [Print results on message window] will display the search results in the Message window of the Main window instead of [Result] region.


 6.2.3 Traceroute Tool

You can run traceroute in ASTEC Eyes as follows;

  1. Open [Traceroute] dialog box.
  2. Specify parameters and run traceroute.

Opening Traceroute Dialog Box

Procedure 1 (running traceroute to the specified host)

Choose [Traceroute Tool...] from the [Tool] menu of the Main window.

Procedure 2 (running traceroute to a host in a Traffic window)

  1. Select a Graph Item in a Traffic window displaying traffic by IP addresses.
  2. Right-click on the window.
  3. Choose [Network Tools].
  4. Choose [Traceroute]. If more than one item is displayed, choose the host you want to traceroute to.

Procedure 3 (running traceroute to a host in the Address Table or Address Book)

  1. Right-click on the row of the host you want to search in the IP Address Table, MAC - IP Address Table, or IP Address Book.
  2. Choose [Network Tools].
  3. Choose [Traceroute]. If more than one item is displayed, choose the host you want to traceroute to.

Procedure 4 (running traceroute to a host in a decode or stream view)

  1. Right-click on a packet or record containing an IP address in a decode or stream view.
  2. Choose [Network Tools].
  3. Choose [Traceroute]. If more than one item is displayed, choose the host you want to traceroute to.

Specifying Parameters and Running Traceroute

Procedure

  1. Enter an IP address or host name to be tracerouted into [Host] field.
    If you open the [Traceroute] dialog box from a decode view, and so on, [Host] field is specified.
  2. Specify the maximum hop count and timeout of the packets to be sent by traceroute.
  3. If you want to traceroute to the host outside of LAN using a SOCKS server, select [Use SOCKS] check box and choose a SOCKS server.
    If there is not a SOCKS server you want to use in the list, click [Advanced...] button and     configure a SOCKS server.
  4. Click [Run] button.
    Selecting [Print results on message window] will display the search results in the Message window of the Main window instead of [Result] region.


 6.3 Address Book

In ASTEC Eyes, you can use host names as well as IP and MAC addresses to identify hosts. It is possible as follows using address book;

  • Searching for host names corresponding to an IP addresses.
  • Specify the user defined name to an MAC and IP address.
  • If more than one name is assigned to an IP address in a name service, or more than one user defined names is assigned, select which name to use.
There are two types of address books; one for the IP layer and the other for the MAC layer. The former is an MAC address book and the latter is an IP address book. There is no address book dedicated to an individual network interface. All the IP and MAC addresses found will be shown in the IP and MAC address book, respectively.

Note

  • You can assign a desired host name (user defined name) to an IP or MAC address.


 6.3.1 Displaying MAC Address Book

Procedure

Choose [MAC Address Book] from the [Edit] menu of the Main window.

Note

  • The MAC address book contains;
    • Data found by decoding captured data.
    • Data loaded from an address book file.


 6.3.2 Displaying IP Address Book

Procedure

Choose [IP Address Book] from the [Edit] menu of the Main window.

Note

  • The IP address book contains;
    • Data found by monitoring.
    • Data loaded from log files.
    • Data found by decoding captured data.
    • Data loaded from an address book file.


 6.3.3 Searching for Host Names with the IP Address Book

Procedure

  1. Right-click on the row containing an address whose host name you want to search in the edit window of the IP address book.
  2. Choose [Search Host Name].
  3. Choose [DNS], [NetBIOS], or [NIS (domain name)].

Note

  • You need to specify a NIS domain name, before using [NIS (domain name)].


 6.3.4 Entering User-Defined Names

Procedure 1

  1. Click on the row of the address you want to assign a user defined name to.
  2. Click on the User Defined Name cell.
  3. Enter a text and press <Enter> key.

Procedure 2

  1. Right-click on the User Defined Name cell you want to edit.
  2. Choose [Edit].
  3. Enter a user defined name and press <Enter> key.
Procedure 3
  1. Select the target row using the < [image] > and < [image] > key.
  2. Move a white frame to the User Defined Name cell you want to edit using the < [image] > or < [image] > key.
  3. Press <F2> key.
  4. Enter a text and press <Enter> key.

Note

  • If you assign more than one user-defined name, the number of candidates will be shown in parentheses on the right-hand side of the cell.


 6.3.5 Deleting a User Defined Name

Procedure 1

  1. If there is more than one user-defined name, select the name you want to delete.
  2. Right-click on the User Defined Name cell you want to delete.
  3. Choose [Delete Host Name].

Procedure 2

  1. Right-click on the User Defined Name cell you want to delete.
  2. Choose [Edit].
  3. If there is more than one user-defined name, select the name you want to delete.
  4. Delete the user-defined name using <Delete> or <Backspace> key, and press <Enter> key.

Procedure 3

  1. Click on the row whose user-defined name you want to delete.
  2. Click the User Defined Name cell.
  3. If there is more than one user-defined name, select the name you want to delete.
  4. Delete the user-defined name using <Delete> or <Backspace> key, and press <Enter> key.

Procedure 4

  1. Move the white frame to the User Defined Name cell you want to delete using the < [image] >, < [image] >, < [image] >, and < [image] > key.
  2. Press <F2> key.
  3. If there is more than one user-defined name, select the name you want to delete.
  4. Delete the user-defined name using <Delete> or <Backspace> key, and press <Enter> key.


 6.3.6 Sorting Records in the Address Book

Procedure 1

Clicking on the column header will sort records by the contents of this column. Clicking once will sort records in ascending order. Clicking once again in descending order.
Procedure 2
  1. Right-click on an address book.
  2. Choose [Arrange].
  3. Choosing an item in the submenu will sort records by the contents of the selected item. Choosing once will sort records in ascending order. Choosing once again in descending order.


 6.3.7 Searching an Address Book for Text

Procedure

  1. Click on an address book.
  2. Choose [Find...] from the [Edit] menu of the Main window, or press <Ctrl-F> key.
  3. Enter a text into [String] field, and click [Find Next] button.

Note

  • To use the regular exppression, select [Regular Expression] check box.


 6.3.8 Updating Address Book

The information in an address book is updated periodically. Use this function to update the information immediately.

Procedure

  1. Right-click on an address book.
  2. Choose [Update].


 6.3.9 Columns Shown in an Address Book

The columns corresponding to the host name types selected in the [Display Host Name] pane of the [Options] dialog box will be shown in an address book. The order of the names (columns) is determined by the display preference of the host names.
Refer to "Choosing the Host Name Used to Identify the Host", for the configuration of host names to be displayed and their preferences using [Options] dialog box.


 6.3.10 Displaying the Number of Host Names and the Method They Are Obtained

You can display the number of host names registered and how they were obtained for each name service; user defined name, DNS, WINS, and NIS.

Procedure

  1. Right-click on an address book.
  2. Choose [View].
  3. Choose [Details].

Note

  • Choose [Summaries] in step 3 above to restore to the default display.


 6.3.11 Aligning Dots Vertically of IP Address

If IP addresses are set to align dots, the dots will be vertically aligned and the digits will be right-adjusted as follows.

IPv4 address
not aligned
192.168.11.1
192.168.100.22
aligned
192. | 168. | 11. | 1.
192. | 168. | 100. | 22.
For IPv6 address, an address "2002:3d79:c191:c::1" in abbreviated notation will be shown as "2002:3d79:c191:000c:0000:0000:0000:0001".

Procedure

  1. Right-click on an address book.
  2. Choose [View].
  3. Choose [Arrange]. Selecting once again will restore the default display.


 6.3.12 Saving and Loading Address Book Data in a File

Saving Address Book Data into a File

Procedure

  1. Choose [Save Address Book...] from the [Edit] menu of the Main window.
  2. Specify the file name to save into.

Loading Address Book Data from a File

Procedure

  1. Choose [Load Address Book...] from the [Edit] menu of the Main window.
  2. Specify the file name to read from.


 6.3.13 Loading Address Book Data Automatically at Startup

Procedure

At its startup, ASTEC Eyes will automatically load, as address book data, default-address.txt in the directory where the ASTEC Eyes executable (EYE.exe) is. Save the address book you want to use as default, accordingly.


 6.4 Notes of Using DHCP

If an IP address is assigned to a computer dynamically, with DHCP for example, it is not guaranteed that the same IP address as before is assigned when you restart the computer. Therefore, the mapping of an IP address and a host name may differ from that in an address book file saved before.


 7 Remote Watching

The Remote Module has the same functionalities as those of ASTEC Eyes in the followings; watching the network, collecting the statistics, capturing the packets and writing the logs.

You can monitor a remote network as you monitor the local network, through ASTEC Eyes or the Remote Module running on a remote host connected to ASTEC Eyes at hand.


 7.1 Connecting to Remote Module

There are two ways to connect to a Remote Module.

  • Connect to the host not displayed in the Interface Selector window.
  • Connect to the host displayed in the Interface Selector window.

Connecting to the Host not Displayed in the Interface Selector Window

Procedure 1

  1. Choose [Connect...] from the [File] menu of the Main window.
  2. Enter the name or IP address of the host running a Remote Module into [Connect host] field.
  3. Click [Connect] button.
Procedure 2
  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Connect...].
  3. Enter the name or IP address of the host running a Remote Module into [Connect host] field.
  4. Click [Connect] button.

Connecting to the Host Displayed in the Interface Selector window

Procedure

  1. Right-click on the disconnectied host entry ( [image]).
  2. Choose [Connect].

Note

  • In the [Connect host] field, specify the host by the way the local PC can recognize such as an IP address, a DNS name, a NetBIOS name, and so on.
  • If you want to connect to a Remote Module with IPv6 (IP version 6), select IPv6 from the drop down list in the right of [Connect host].
  • ASTEC Eyes connects to a Remote Module using port 8887 of TCP protocol.


 7.2 Changing Connection Port Number

ASTEC Eyes connects to a Remote Module using port 8887 of TCP protocol as default.
You can also use another port number to connect ASTEC Eyes to a Remote Module, e.g., for SSH port forwarding.

Procedure 1

  1. Choose [Connect...] from the [File] menu of the Main window.
  2. Enter a target host name or IP address into [Connect host].
  3. Select [Port] check box.
  4. Enter the port number to connect to.
  5. Click [Connect] button.
Procedure 2
  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Connect...].
  3. Enter a target host name or IP address into [Connect host].
  4. Select [Port] check box.
  5. Enter the port number to connect to.
  6. Click [Connect] button.

Note

  • In the [Connect host] field, specify the host by the name the local PC can recognize such as an IP address, a DNS name, a NetBIOS name, and so on.
  • If you want to connect to a Remote Module with IPv6 (IP version 6), select IPv6 from the drop down list in the right of [Connect host].
  • Click [Default Port] button in order to restore the port number to the default port number.


 7.3 Connecting to Remote Module Using SOCKS

ASTEC Eyes can connect to a Remote Module via SOCKS as follows;

  1. Open [Connect] dialog box.
  2. Specify a SOCKS server and connect to it.

Opening Connect Dialog Box

Procedure 1

Choose [Connect...] of the [File] menu of the Main window.
Procedure 2
  1. Right-click on an open space in the Interface Selector window.
  2. Choose [Connect...].

Specifying SOCKS Server and Connect to It

Procedure

  1. Select [Use SOCKS] check box.
  2. Select the SOCKS configuration from a drop down list. If there is not configuration you want to use, click [Advanced...] button and configure a SOCKS server information.
  3. Click [Connect] button.

Note

  • In the [Connect host] field, specify the host by the way the local PC can recognize such as an IP address, a DNS name, a NetBIOS name, and so on.
  • If both [Port] and [Use SOCKS] check box are selected, ASTEC Eyes connects to the specified port number via SOCKS server.


 7.4 Configuring SOCKS Server Information

Procedure

  1. Click on the uppermost row with no SOCKS data.
  2. Enter a text to identify the configuration into [ID name] field.
  3. Enter the host and port number running a SOCKS server into [Server] and [Port] fields.
  4. Select the version of SOCKS server. Enter the user ID and password to connect to the SOCKS server if necessary.
  5. Repeat the steps 1 through 4 as necessary.
  6. Click [OK] button.


 7.5 Disconnecting from a Remote Module

Procedure

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Disconnect].

Note

  • The [image] mark will be overlaid with the icon of the host and its interfaces ( [image], [image]).


 7.6 Deleting a Host Entry

Procedure

  1. Disconnect from the Remote Module of the host you want to delete.
  2. Right-click on the host entry in the Interface Selector window.
  3. Choose [Delete Entry].


 7.7 Obtaining and Releasing the Privileges

Configuration privileges are required to perform the following actions;

  • Register an interface entry label.
  • Enable or disable interfaces.
  • Reset monitoring.
  • Configuring, starting and stopping logging.
  • Configuring, starting and stopping continuous capture.
  • Applying a continuous capture filter, start continuous capture trigger, and pause continuous capture trigger.
  • Configuring monitor expert events.
  • Configuring the notification of expert events.
  • Configuring SNMP.
Obtaining a Configuration Privilege

Procedure 1

  1. Open [Host Properties] dialog box .
  2. Click [Get] button.

Procedure 2

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Get Privilege].
Releasing a Configuration Privilege

Procedure 1

  1. Open [Host Properties] dialog box.
  2. Click [Release] button.

Procedure 2

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Release Privilege].

Note

  • You can obtain the privileges only when any other currently-running ASTEC Eyes has not yet obtained them.
  • The star mark is overlaid with the icon of the host ( [image]) with a configuration privilege.


 8.1 Opening Filter Editor

Procedure 1

Choose [Filter Editor...] from the [Edit] menu of the Main window.
Procedure 2
Press <Ctrl-E> key.


 8.2 Creating a Filter

You can create a complex filter using the filter editor. In the filter editor, you can edit conditions used in the following filters;

  • display filter
  • monitor filter
  • event filter
  • capture filter
  • start capture trigger
  • pause capture trigger
  • continuous capture filter
  • start continuous capture trigger
  • pause continuous capture trigger

Create a filter as follows;

  1. Select the type of the filter to create.
  2. Enter logical expressions.

Selecting the Type of a Filter to Create

Procedure

  1. Open filter editor.
  2. Click on a filter name displayed in the tree view in the [Filter viewer] region.

Entering Logical Expressions

Procedure 1

  1. Click [New Expression] button or [New Group] button.
  2. Specify a condition group, a logical expression type, conditions, values, and so on.

Procedure 2

  1. Right-click a filter name.
  2. Choose [New Expression] or [New Group].
  3. Specify a condition group, a logical expression type, conditions, values, and so on.

Note

  • You need to have configuration privilege to create a continuous capture filter, start continuous capture trigger, and pause continuous capture trigger
  • Depending on the filter type, the number of filters or the structure of logical expressions may be restricted.


 8.3 Saving Filters

Procedure

  1. Click [Save...] button of the filter editor. [Save As] dialog box will appear.
  2. Enter a file name and click [Save] button.

Note

  • In [Save As] dialog box, you can specify the filters saved in a file:
    • Save all filters into one file.
    • Save the filters for one interface into one file.
    • Save one filter into one file.


 8.4 Loading Filters

Procedure

  1. Click [Load...] button of the filter editor.
  2. Select the file to load and click [Open] button.


 8.5 Loading Filters Automatically at Startup

Procedure

At its startup, ASTEC Eyes will automatically load, as filter data, default-filters.fts in the directory where the ASTEC Eyes executable (EYE.exe) is. Save the address book you want to use as default, accordingly. The following filters will be automatically loaded;
  • monitor filter
  • display filter
  • event filter
  • capture filter of the localhost
  • start capture trigger of the localhost
  • pause capture trigger of the localhost


 9 Reporting Expert Events

There are two expert functions in ASTEC Eyes; monitor expert events and decode expert events.

Monitor expert events detect the symptoms of network trouble while monitoring, and display them in the Event Viewer or notify them via e-mail or SNMP trap.

Decode expert events are generated while the capture data is analyzed (decoded), and warn about possible network troubles. Those events suggests the possibility of inappropriate configuration of network equipments or the transmissions which might cause network troubles.


 9.1.1 Displaying Monitor Events

Procedure 1

  1. Select a network interface .
  2. Start monitoring, if it is not yet started.
  3. Choose [Event Viewer] from the [Monitor] menu of the Main window.
Procedure 2
  1. Right-click on the entry of an interface in the Interface Selector window.
  2. Start monitoring, if it is not yet started.
  3. Choose [Monitor].
  4. Choose [Event Viewer].

Note

  • The events may be collapsed into a row, whose contents, shown below, are the same, aside from the time it took place.
    • event type
    • source address
    • source port
    • destination address
    • destination port
  • The number of collapsed events is shown in parentheses in the right of the Event column.
  • For the discussion of expanding events, please refer to "Expanding Events".
  • Frame ID's are not shown for monitor events.


 9.1.2 Displaying Decoder Events

Procedure 1

  1. Decode captured data.
  2. Click [Event Viewer] button ( [image]) on the toolbar of the decode view.

Procedure 2

  1. Decode captured data.
  2. Right-click on a decode view and choose [Event Viewer].


 9.1.3 Unfolding Events

In an Event Viewer, The events may be collapsed into a row, whose type, source, and destination are the same, aside from the time it took place. You can expand the collapsed events.

Expanding All Events

  1. Right-click on an Event Viewer.
  2. Choose [Collapse same events].
  3. Choose [Collapse same events] once again to collapse the rows of all events as much as possible.
Expanding a Specific Event
  1. Double-click on a row you want to expand.
  2. Double-click on an expanded row again to collapse it.


 9.1.4 Displaying the Latest Event

With the monitor expert view, a newly reported event is added at the end of an Event Viewer. You can always display the latest event, if you select the bottom row (the row of [image] icon).


 9.1.5 Changing the Display Format of the Event Viewer

You can display an Event Viewer in the tabular or line chart format.

Procedure 1

Click either one of the two buttons on the toolbar of the Event Viewer:
  • [Line Chart (History)] button ( [image])
  • [Table (Detail)] button ( [image])

Procedure 2

  1. Right-click on an Event Viewer.
  2. Choose [View].
  3. Select one of the followings:
    • [Line Chart (History)]
    • [Table (Detail)]


 9.1.6 Toggling the Legend between Shown and Hidden (Event Viewer)

Procedure 1

Click [Legend] button ( [image]) on the toolbar of an Event Viewer (line chart format).

Procedure 2

  1. Right-click on an Event Viewer (line chart format).
  2. Choose [Legend].


 9.1.7 Displaying Events History

In an Event Viewer for monitor expert events, the default period used for the line chart is a short time span. You can also use a longer time span.

Procedure

  1. Right-click on an Event Viewer.
  2. Choose [History].

Note

  • The maximum number of events displayed on an Event Viewer is 1000 except for the case of displaying the events saved in log files.


 9.1.8 Saving Event Data

The event data can be saved into a file in comma separated value (CSV), bmp, metafile, or enhanced metafile format.

Procedure

  1. Click on the Event Viewer whose data you want to save.
  2. Choose [Save Monitor...] from the [File] menu of the Main window.
  3. Specify the file name and file format.

Note

  • The data in an Event Viewer of tabular format can be saved only in the CSV format.
  • You can use the saved data with other applications. For example, you can insert bmp image in Microsoft Word, or import CSV file into Microsoft Excel.


 9.2.1 Displaying Events Containing the Specified Value

In the Event Viewer of tabular form, you can hide the events other than those containing a specific value using the caption filter. The caption filter is used in the column of [Event], [Source Address], [Source Port], [Destination Address], [Destination Port], and [Information]. For the details on the operations, refer to "Displaying Packets or Records Containing the Specified Value".


 9.2.2 Displaying Events Containing One of the Specified Value

Procedure

  1. Click on a column header of Event Viewer with [image] mark.
  2. Choose [(Options...)].
  3. Select [Multiple selections]
  4. Select the items you want to display from the list. You can select multiple values.
    Entering a text and clicking [Find] button will search the list for the text.


 9.2.3 Finding Required Item When There Are Too Many Menu Items (Event Viewer)

If there are too many items, the target value may not be displayed on the menu shown by clicking the column header. In such a case, use the [Candidate List] dialog box.

Procedure

  1. Click on a column header of the Event Viewer with [image] mark.
  2. Choose [(Candidate List...)].
  3. Select the item you want to display from the list.
    Entering a text and clicking [Find] button will search the list for the text.

Note

  • If the number of menu items are less than or equal to 16, [(Candidate List...)] will not appear.


 9.2.4 Canceling Caption Filter (Event Viewer)

Canceling a Specific Caption Filter

Click on the column header with which a filter is applied, and choose [(All)].

Canceling All Filters

Click [Discard Filter] button ( [image]) on the toolbar of the Event Viewer.


 9.3.1 Configuring the Monitor Events to Detect

You can specify events you need to detect, and specify threshold values, using [Host Properties] dialog box. The configuration should be done for each interface.

Procedure

  1. Get configuration privileges, if you don't have these privileges.
  2. Open [Host Properties] dialog box.
  3. Click [Expert] tab.
  4. Click on a target interface.
  5. Select the check boxes of [Detect] column in the [Event detection and alerting] region, for the events you want to be detected.
  6. Enter threshold values if you want to detect the following events:
    • TCP window frozen
    • TCP long ack time
    • TCP connection table threshold over
    • MAC traffic under threshold

Create and apply an event filter, if you want to add further conditions to detect events.

Procedure

  1. Open the filter editor by right clicking on [Event] column and selecting [Filter Editor...].
  2. Create [ [image] Event Filter].
  3. Right click on [Event] column of the event you want to add further conditon(s) to, and select the filter just created.


 9.3.2 Creating User-Defined Events

A monitor event can be generated, when the data meeting the conditions specified by the user is captured or the situation specified by the user occurs. Such an event is called user defined event.

Procedure

  1. Open the filter editor.
  2. Create an [ [image] Event Filter].
  3. Acquire configuration privileges, if you do not have them yet.
  4. Open [Host Properties] dialog box.
  5. Click [Expert] tab.
  6. Click the interface you want to apply the event filter to.
  7. Right click on the [event] column of [NIC user filter].
  8. Select an event filter.
  9. Select in [Detect] column.


 9.3.3 Notifying Events by Mail and SNMP

You can get the notification of monitor events via e-mail and SNMP trap as alert. Configure the events to be notified for each interface and configure the notification method for each ASTEC Eyes or Remote Module.

Notifyin by mail

  1. Get configuration privileges, if you don't have these privileges.
  2. Open [Host Properties] dialog box.
  3. Click [E-mail Alert] tab.
  4. Configure e-mail; e-mail address, SMTP server, and so on.
  5. Click [Expert] tab.
  6. Select the [Notification] check box of the interface you want to enable the alerting feature for.
  7. Select the check boxes of [Notification] column for the events you want to be notified of by e-mail.
  8. Select the check boxes of [e-mail immediately] column, only if you want to be notified of those events immediately.

Notifying by SNMP

    Get configuration privileges, if you don't have these privileges.
  1. Open [Host Properties] dialog box
    2. .
  2. Click [SNMP trap] tab.
  3. Configure SNMP.
  4. Click [Expert] tab.
  5. Select the [Notification] check box of the interface you want to enable the alerting feature for.
  6. Select the check boxes of [SNMP] column for the events you want to be notified of by SNMP.

Note

  • When you select the check box of [Notification], [e-mail immediately], or [SNMP] column, you need to select the check box of [Detect] column, too.


 9.3.4 Configuring the Decoder Events to Detect

Procedure

  1. Open [Options] dialog box.
  2. Click [Decode Expert] in the tree view in the left of the dialog box.
  3. Select [Enable Decode Expert] check box.
  4. Select the events to be reported, and clear the events to be ignored.

Note

  • No decode event is detected by default.


 10 Operations in the Interface Selector Window

You can do the various operations for a network interface in the Interface Selector window.


 10.1 Selecting the Network Interface

Procedure 1

Click on the entry of an interface in the Interface Selector window.

Procedure 2

  1. Set focus to the Interface Selector window by pressing <Alt-1> key.
  2. Select an interface by pressing < [image] > and < [image] > key, and then press <Enter> key.

Procedure 3

Choose an interface from the Select Interface listbox ( [image]) on the Interface toolbar of the Main window.

Note

  • The icon for the selected interface is green ( [image]) and the icon for an unselected interface is gray ( [image]).


 10.2 Changing a Label of Host Entry

Procedure

  1. Open [Host Properties] dialog box.
  2. Click [Information] tab.
  3. Enter the label text of a host entry into [Label] field.


 10.3 Changing a Label of Interface Entry

Procedure

  1. Right-click on the entry of an interface in the Interface Selector window.
  2. Choose [Properties...].
  3. Click [Information] tab.
  4. Enter the label text of an interface entry into [Label] field.
  5. Click [Register Label to Remote Module] button to register a label for an interface of a Remote Module.

Note

  • You need to have the configuration privileges to register an interface label into a Remote Module.
  • If you do not register a label for an interface of a Remote Module, the former label will be used again when ASTEC Eyes is invoked next.
  • If you register a label for an interface of a Remote Module, the registered label will be displayed on ASTEC Eyes running under another PC, too.
  • You can save an interface label of the localhost into a configuration file.


 10.4 Enabling or Disabling Network Interface

Procedure

  1. Get configuration privileges, if you don't have these privileges.
  2. Right-click on the entry of an interface in the Interface Selector window.
  3. Choose [Detach] or [Attach].

Note

  • The [image] mark is overlaid with the icon of a disabled interface ( [image]). The [image] mark will disappear when it is enabled ( [image] or [image]).


 10.5 Opening Host Properties Dialog Box

Procedure 1

  1. Choose an item you want to configure from the [Option] menu of the Main window:
    • [Log Settings]
    • [Continuous Capture Settings]
    • [Expert Settings]
    • [E-Mail Alert]
    • [SNMP Settings]
  2. Choose a host.

Procedure 2

  1. Right-click on a host entry in the Interface Selector window.
  2. Choose [Properties...].

Procedure 3

  1. Add a [Show Host Properties] button ( [image]) on the Interface toolbar, if it is not displayed.
  2. Click [Show Host Properties] button ( [image]).

Note

  • The target host for [Show Host Properties] button ( [image]) is the host of currently selected interface.


 11 Workspace

Workspaces are useful for organizing windows.

You can create more than one workspace and move windows from one to another. When you open windows in ASTEC Eyes, all the new windows except the dialog boxes appear in the currently selected workspace.


 11.1 Setting Focus to a Workspace

Procedure 1

Click on a workspace.
Procedure 2
Press <Alt-0> key.


 11.2 Selecting a Workspace

Procedure 1

Choose a target workspace from the [View] menu of the Main window.
Procedure 2
Click on the tab of a target workspace.
Procedure 3
  1. Right-click on the tab of a workspace.
  2. Choose the target workspace from the menu displayed.
Procedure 4
  1. Right-click on the open space of a workspace.
  2. Choose a target workspace from the menu displayed..

Procedure 5

Press <Ctrl-Alt- [image] >, <Ctrl-Alt- [image] >, <Ctrl-Page Up>, or <Ctrl-Page Down> key.


 11.3 Creating a Workspace

Procedure 1

Choose [New Workspace] from the [View] menu of the Main window.
Procedure 2
  1. Right-click on the tab of a workspace.
  2. Choose [New Workspace].
Procedure 3
  1. Right-click on the open space of a workspace.
  2. Choose [New Workspace].
Procedure 4
  1. Right-click on the title bar of a window in a workspace.
  2. Choose [New Workspace].
    The window whose title bar you clicked will be moved into the newly created workspace


 11.4 Deleting a Workspace

Procedure 1

  1. Select the workspace you want to delete.
  2. Choose [Delete Workspace] from the [View] menu of the Main window.

Procedure 2

  2. Right-click on the tab of the workspace you want to delete.
  3. Choose [Delete Workspace].
Procedure 3
  1. Select the workspace you want to delete.
  2. Right-click on the open space of a workspace.
  3. Choose [Delete Workspace].

Note

  • If there are any windows placed in the workspace to be deleted, an [ASTEC Eyes] dialog box will be displayed, confirming if you want to delete those windows, too.
  • You cannot delete the first (left most) workspace.


 11.5 Changing a Label of Workspace

Procedure 1

  1. Right-click on the tab of a workspace.
  2. Choose [Properties...].
  3. Enter a label text into [Label] field.

Procedure 2

  1. Right-click on the open space of a workspace.
  2. Choose [Properties...].
  3. Enter a label text into [Label] field.


 11.6 Binding an Network Interface to a Workspace

You can bind an interface to a workspace, so that the interface will be automatically selected by activating the corresponding workspace.

Procedure

  1. Right-click on the tab or the open space of a workspace.
  2. Choose [Properties...].
  3. Select [Bind to interface] check box.
  4. Select an interface from the drop down list box.


 11.7 Moving a Window to Another Workspace

Procedure 1

  1. Right-click on the title bar of a window in a workspace.
  2. Choose the target workspace from the menu displayed.

Procedure 2

  1. Click on a window you want to move.
  2. Choose [Move Window] from the [Window] of the Main window.
  3. Choose a target workspace from the menu.


 11.8 Activating a Window Begin Hidden

Procedure

  1. Open the [Window] menu of the Main window.
  2. Choose the window you want to activate from the menu.


 11.9 Arranging Windows

Procedure

  1. Open the [Window] menu of the Main window.
  2. Choose an alignment type:
    • [Cascade]
    • [Tile Vertical]
    • [Tile Horizontal]
    • [Arrange Icon]


 11.10 Changing the Position of Workspace Tab

Procedure

  1. Open [Options] dialog box.
  2. Click [Other] in the tree view in the left of the dialog box.
  3. Select [Show workspace tabs above] or [Show workspace tabs below].


 12 Reports

You can generate reports consisted of the charts and tables of monitoring. The reports are written in HTML format, which can be printed or viewed through web browsers.


 12.1 Configuring Reports by Wizard

Procedure

  1. Select [Report Setting Wizard...] from [Option] menu of Main window.
  2. Select the workspace for which you want generate reports and click [Next >] button.
  3. Specify the size of windows and click [Next >] button.
  4. Select the output timing of reports and click [Next >] button.
  5. Specify the output directory for reports.
  6. Copy style sheets and image files to the output directory by clicking [Copy] button, unless those files are already there.
  7. Click [Next >] button.

Note

  • A report will be generated shortly after the wizard is terminated, if you select [Generate report now] check box in the wizard's last page.


 12.2 Configuring Reports Associated with Workspace

The exsiting Monitor windows in a workspace can be outputted as report.

Procedure

  1. Right click on the tab of a workspace whose Monitor windows you want to output as report.
  2. Select [Report settings...].
  3. Specify the output timing in [Report] page.
  4. Specify the output directory, the template file and the order of charts in [Detail] page.


 12.3 Generating Reports

You can generate reports immediately or periodically.

Generating reports immediately

Procedure 1

  1. Select [Report Setting Wizard...] from [Option] of Main window.
  2. Select [Generate report now] check box in the wizard's last page.

Procedure 2

  1. Right-click on the tab of a workspace.
  2. Select [Report settings...].
  3. Click [Generate] button in [Generate report now] region of [Report] page.

Generating reports periodically

Procedure 1

  1. Select [Report Setting Wizard...] from [Option] of Main window.
  2. Specify the output timing of reports on the wizard's [Report time] page.

Procedure 2

  1. Right-click on the tab of a workspace.
  2. Select [Report settings...].
  3. Select [Update report page] or [Generate new report page regularly] check box in [Report] page.

Note

  • You can view the report with a web browser;
    right-click on the tab of a workspace, select a report page from [Report pages] in [Display] page. and click [Display report] button.


 12.4 Changing Report Output Directory

Procedure

  1. Right-click on the tab of a workspace.
  2. Select [Report settings...].
  3. Click [Detail] tab.
  4. Specify the output directory for reports in [Report directory].

Note

  • When the output directory is changed, you need to copy style sheets and image files to new output directory; open [Manage] page and click [Copy] button in [Files] region.


 12.5 Changing the Size of Charts in Reports

Procedure 1

Change the window size by dragging the frame of a window in a workspace with the left mouse button.

Procedure 2

  1. Select [Graph size...] from [Window] menu of Main window.
  2. Enter the width and height of charts into [Chart Size] dialog box.


 12.6 Customizing Rerport Layouts

Procedure

  1. Create the HTML template file corresponding to the new layout.
  2. Right-click on the tab of a workspace.
  3. Select [Report settings...].
  4. Specify the new template file in [Detail] page.


 12.7 Deleting Old Reports

Procedure

  1. Right-click on the tab of a workspace.
  2. Select [Report settings...].
  3. Click [Manage] tab.
  4. Specify the dates of the reports to be deleted in [Date] of [Delete report] region.
  5. Click [Delete] button.

Note

  • Clicking [Rebuild] button of [Rebuild links] region will reconstruct reports so that deleted report pages will not be referenced.


 13 Printing

You can print the data in the windows shown below. You can print directly or after confirming the printing image by preview.

  • Monitor window
  • Log window
  • Decode and Stream view
  • IP and MAC address books
  • Event Viewer
  • VoIP Quality window
  • Sequence View


 13.1 Printing Monitoring Data

You can print charts and tables of the Monitor window.

Procedure 1

  1. Click on the Monitor window you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the printer, copy count, and print range.

Procedure 2

  1. Click on the Monitor window you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.2 Printing Log Data

You can print charts and tables of the Log window.

Procedure 1

  1. Click on the Log window you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the printer, copy count, and print range.
Procedure 2
  1. Click on the Log window you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.3 Printing Decoded Results

Printing from a decode view or a plain stream view

Procedure 1

  1. Click on the decode or stream view you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the frames or streams range, the data to be printed, and magnifications.

Procedure 2

  1. Click on the decode or stream view you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Specify the frames/streams range, the data to be printed, and magnifications, and then click [OK] button.
  4. Browse the printing image for confirmation, and then click [Print...] button.
  5. Specify the printer, copy count, and print range.

Printing from a stream view in sequence mode

Procedure 1

  1. Click on stream view you want to print from.
  2. Click on the session you want to print.
  3. Select [Print...] from [File] of Main window, or press <Ctrl-P> key.
  4. Specify the printer, the number of copies, and printing region.

Procedure 2

  1. Click on stream view you want to print from.
  2. Click on the session you want to print.
  3. Select [Print Preview] from [File] of Main window.
  4. Review the printing image, and click [Print...] button if it is OK.
  5. Specify the printer, the number of copies, and printing region.

Note

  • Applying a filter to the decoded results will only print the packets currently displayed. For details on filters, see the section of convenience filter or display filter of Decoding.


 13.4 Printing Voice Quality Data

You can print charts and tables of the VoIP Quality window.

Procedure 1

  1. Click on the VoIP Quality window you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the printer, copy count, and print range.
Procedure 2
  1. Click on the VoIP Quality window you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.5 Printing VoIP Sequence View

You can print the calling sequence in the Sequence View. If there is more than one sequence, select the sequence and print it.

Procedure 1

  2. Click the session you want to print in the Sequence View.
  3. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  4. Specify the printer, copy count, and print range.

Procedure 2

  1. Click the session you want to print in the Sequence View.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.6 Printing Address Book

Procedure 1

  1. Click on the address book you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the printer, copy count, and print range.

Procedure 2

  1. Click on the address book you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.7 Printing Event Viewer

You can print the events in an Event Viewer.

Procedure 1

  1. Click on the Event Viewer you want to print.
  2. Choose [Print...] from the [File] menu of the Main window, or press <Ctrl-P> key.
  3. Specify the printer, copy count, and print range.

Procedure 2

  1. Click on the Event Viewer you want to print.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. Browse the printing image for confirmation, and then click [Print...] button.
  4. Specify the printer, copy count, and print range.


 13.8 Displaying Print Preview

You can browse the printing image before printing.

Procedure

  1. Click on the window whose printing image you want to preview.
  2. Choose [Print Preview] from the [File] menu of the Main window.
  3. For the preview of a decode or stream view, specify the frames/streams range, the data to be printed, and magnifications.
  4. Click [Print...] button to print it.


 14 Configuration

The configuration is the information about how workspaces, Monitor windows, options, and so on are set up. By loading a saved configuration file when you invoke ASTEC Eyes again, you will have the same look and feel as before, and you need not configure such items as decode hints again.


 14.1 Opening Options Dialog Box

You can change the configurations of ASTEC Eyes using [Options] dialog box.

Procedure 1

Click [Configure] button ( [image]) on the toolbar of the Main window.

Procedure 2

Choose [Configure...] from the [Option] menu of the Main window.


 14.2 Configuring Decode Hints

You can configure a decode hint using [Options] dialog box.

Procedure 1

  1. Open [Options] dialog box.
  2. Click [Decode Hints] in the tree view in the left of a dialog box.
  3. Click on the uppermost row with no decode hint set.
  4. Click on the cell you want to edit.
  5. Enter a value. You can choose a value from each drop down list for [IP address], [Transport], and [Protocol].
  6. Repeat steps 2 and 3 until you finish entering all the values.

Procedure 2

  1. Open [Options] dialog box.
  2. Click [Decode Hints] in the tree view in the left of a dialog box.
  3. Select the row with no decode hint set using < [image] > or < [image] > key.
  4. Move to the cell you want edit, using < [image] > or < [image] > key, and then press <F2> key.
  5. Enter a value. You can choose a value from each drop down list for [IP address], [Transport], and [Protocol].
  6. Press <Enter> or <F2> key.
  7. Repeat steps 2 and 3 until you finish entering all the values.

Note

  • You can choose one of the application protocols displayed in the protocol information dialog box or enter an arbitrary name you want to use.
  • If the current cell is in edit mode, move the focus in edit mode using <Tab> or <Shift-Tab> key.
  • The preference is in descending order of rows in decode hints. If you want to change the order of the preference, select a decode hint row and click [Up] button or [Down] button.
  • Click [Update Decode View] button ( [image]) on the toolbar of a decode or stream view to apply the new decode hints to the decode or stream view.


 14.3 Changing Fonts

You can change the font used in the following windows:

  • decode view
  • stream view
  • Monitor window in table format
  • Event Viewer in table format
  • Address book
  • Sequence View

Procedure

  1. Open [Options] dialog box.
  2. Click [Other] in the tree view in the left of a dialog box.
  3. Click [Change...] button.
  4. Configure a font.

Note

  • Choose a Japanese font when you use Japanese OS. If you choose an English font, Japanese texts, e.g., the title of decode view will not be displayed correctly.


 14.4 Customizing Common Toolbar and Interface Toolbar

You can arrange buttons and separators displayed on the Common and Interface toolbar.

Procedure

  1. Open [Customize Toolbar] dialog box.
  2. Customize a toolbar.

Opening Customize Toolbar Dialog Box

Procedure 1

Choose [Common Toolbar Settings...] or [Interface Toolbar Settings...] from the [Option] menu of the Main window.

Procedure 2

  1. Right-click on the Common or Interface toolbar.
  2. Choose [Customize Toolbar...] or [Customize Interface Toolbar...].

Customizing a Toolbar

Adding buttons and Separators on a Toolbar

  1. Click a button or separator you want to add in the [Available toolbar buttons].
  2. Click [Add->] button.

Deleting buttons and Separators on a Toolbar

  1. Click a button or separator you want to delete in the [Current toolbar buttons].
  2. Click [<-Remove] button.

Changing the Order of Buttons and Separators on a Toolbar

  1. Click a button or separator you want to move in the [Current toolbar buttons].
  2. Click [Move Up] button or [Move Down] button to move the button or separator to the target location.

Restoring Buttons and Separators on a Toolbar to Default

Click [Reset] button.


 14.5 Customizing Main Window

You can make the following windows and toolbars shown or hidden:

  • Interface Selector window
  • Message window
  • Status bar
  • Common toolbar
  • Interface toolbar

Procedure 1

  1. Right-click on a grip handle, drag bar, or toolbar.
  2. Choose the menu item corresponding to a window or toolbar to shown or hidden.
    The windows and toolbars with check mark ( [image]) will be displayed in the Main window.

Procedure 2

  1. Open the [View] menu of the Main window.
  2. Choose the menu item corresponding to a window or a toolbar to shown or hidden.
    The windows and toolbars with check mark ( [image]) will be displayed in the Main window.

Note

  • There is no menu item which toggles the state of the status bar between shown and hidden in the popup menu displayed from the drag bar or grip handle.


 14.6 Saving Configuration

Procedure 1

Choose [Save Configuration...] from the [Option] menu of the Main window.
Procedure 2
Click [Save Configuration] button ( [image]) on the Common toolbar of the Main window.


 14.7 Loading Configuration

Procedure 1

Choose [Load Configuration...] from the [Option] menu of the Main window.
Procedure 2
Click [Load Configuration] button ( [image]) on the Common toolbar of the Main window.


 14.8 Loading Configuration Automatically at Startup

Procedure

At its startup, ASTEC Eyes will automatically load, as configuration, default-workspace.wsi in the directory where the ASTEC Eyes executable (EYE.exe) is. Save the configuration you want to use as default, accordingly.


 14.9 Information Saved in a Configuration File

You can save the following configuration information into a file.

  • Workspace information
    • Organization and properties of workspaces
    • Report settings
  • Traffic window information
    • Type and display format of Traffic windows
    • Whether the legend is visible or invisible, and the region size of legend
    • Geometry information
    • time span
  • Geometry information of the TCP Status Information windows
  • Event Viewer information
    • Display format of Event Viewer
    • Whether the legend is visible or invisible, and the region size of legend
    • Geometry information
    • Period of a line chart (short time span, or history)
  • Settings using [Options] dialog box
    • Capture options
      • Capture buffer size
      • Actions when capture buffer is full
      • Compress data from the Remote Module or not
      • Whether realtime decode is performed or not
      • Capture buffer size for realtime decode
      • Behavior when the capture buffer for realtime decode is full
    • Decode options
      • Whether checksum values of IPv4, UDP, TCP are verified or not while decoding
      • Order of records in the stream view (by time or stream ID)
      • Time precision of the time columns in the Summary pane (milliseconds or 100 nanoseconds)
      • Whether the background color in the Dump pane is changed for protocols or not
      • Default link speed
    • Decode hints
    • Decoding expert
      • Whether decode events are detected while decoding or not
      • Event type to be detected
    • Host name options
      • Host name types to be displayed and their preference
      • NIS domain name
      • NIS server address
    • Monitor options
      • Periods for each time span
      • Refresh interval for short time span
      • Refresh interval for TCP Status Information window
    • Default options for charts
      • Y axis units, upper limit, and lower limit
      • Number of items shown in host and host pair charts
      • How the top N is interpreted for host and host pair line charts
      • Whether the legend is visible or invisible
      • Whether the toolbar is visible or invisible
    • Chart color options
      • Foreground and background color of Monitor window, Event Viewer, and VoIP Quality window
      • The color of each Graph Item displayed on a window
    • SOCKS options
      • SOCKS server settings
    • Other options
      • Font information
      • Tab position of workspaces
      • The number of recently used files
      • Log file recording report outputs
    • Parameter values for calculating R value
    • Parameter values depending on the CODEC for R value
    • VoIP Player options
      • Whether RTP timestamp is ignored or not while playing sound
      • Display format for sound (wave, decibel sound pressure, linear sound pressure, octave band)
      • Refresh interval for sound
      • Periods for sound
      • Device of playing sound
      • Sound volume when mixing sound data
  • Interface Selector window information
    • Label for a host
    • Labels for interfaces of a host

Note

  • The information of Remote Module has made to be saved since ASTEC Eyes on the net version 5.0.


 14.10 Information Saved in the Registry

The following information is automatically saved in the registry and loaded automatically when ASTEC Eyes is invoked.

  • History of connected hosts
  • History of opened capture files
  • The geometry information of the Main window
  • The geometry information of the Message window
  • The geometry information of the Interface Selector window
  • The column information of the Summary pane of decode or stream views.
    • Columns to display
    • Column width
    • The order of columns
  • The geometry information of buttons on the Common or Interface toolbar.
  • Folder information of [Open] dialog box and [Save As] dialog box.
  • Whois options
    • History of texts used as the key of Whois command
    • History of Whois servers
    • SOCKS server to be selected
  • Whether the status bar is visible or invisible


 14.11 Information Saved in the Capture Module

The following information is saved in the Capture Module. You need configuration privileges to save or change the information in the Capture Module.

  • Labels for Interfaces
  • Log output options
    • Whether log data is written into files or not
    • Interface whose log data is written
    • Output interval of log data
    • The number of entries in a log file
    • Directory where log files are saved
    • Whether log files are compressed or not
    • Whether log files are deleted automatically or not, and the number of days before they are deleted
  • Continuous capture options
      Interface(s) of running continuous capture
    • Whether continuous capture is started automatically or not when Capture Module is invoked
    • The maximum file size of continuous capture
    • Directory where continuous capture files are saved
    • Lower limit of the disk space to stop continuous capture
    • Whether continuous capture files are deleted automatically or not, and lower limit of the disk space to delete files automatically
  • Expert options
    • Interface(s) where monitor events are detected
    • Monitor event types to be detected
    • Whether monitor events are notified via e-mail or not
    • Whether monitor events are notified immediately or not
    • Whether monitor events are notified by SNMP trap or not
    • Filter(s) set for monitor events
  • E-mail alert options
    • Whether e-mail alerting is enabled or disabled
    • SMTP server
    • Receiver e-mail address (To header)
    • Sender e-mail address (From header)
    • Message body format
    • Message subject type
    • Message sending interval
    • Whether e-mail alerting is stopped or not when mail delivery is failed
  • SNMP options
    • Whether SNMP trap is enabled or not
    • Host(s) SNMP trap is sent to
    • SNMP community
    • Whether SNMP trap is stopped or not when SNMP trap transmission fails


 15.1 Regular Expressions for Text Search

You can use regular expressions for text search in the [Find] dialog box, [Option] dialog box, and Decode Result Filter.

ASTEC Eyes supports following regular expressions:
Patterns | Explanations
Character | One character is the most fundamental pattern in a regular expression. An ordinary character except for metacharacters matches the character itself. For example, the pattern "A" matches the character "A". The metacharacter (having special meaning in a regular expression) preceded by [image] (backslash) is treated as an ordinary character. For example, if you want to search for a character * (asterisk), you must specify [image] * as a pattern since * is a metacharacter. metacharacters for ASTEC Eyes regular expression There are 16 metacharacters for ASTEC Eyes regular expression. (backslash) ^ $ ( ) | . [ - ] * + ? { , } You can also use a Japanese character (Shift JIS encoding, 2 byte character) as ordinary character with Japanese Windows.
Text (concatenation) | You can specify the concatenation of characters as a pattern. For example, the pattern flags matches the character sequence of 'f', 'l', 'a', 'g', 's'. Not only a character but a pattern can be concatenated similarly. The pattern RS concatenating pattern R and S matches R followed by S.
| (alternative) | Pattern R|S matches either pattern R or S. foo|bar matches the text foo or bar.
* (closure) | A pattern followed by * matches 0 or more occurrences of the pattern. For example, ab* matches a, ab, abb, abbb, abbb ... b, and so on.
'(' and ')' (grouping) | Parentheses mean the grouping of patterns. For example, a(bc)* matches a, abc, abcbc, abcbcbc, abcbcbc--bc, and so on. foo(bar|baz) matches both foobar and foobaz.

You can use the following metacharacters with ASTEC Eyes.
Metacharacters | Functions
. | . (period) matches any one character. It is equivalent to the pattern that all the characters are concatenated and enclosed in the parentheses: (a|b|c| [image] |0|1|2| [image] | [image] | [image] | [image] | [image] )
[ and ] | A non-empty string of characters enclosed in square brackets matches any one character in that string. The pattern [abc] matches a, b, or c. It is equivalent to the pattern (a|b|c). The - (minus) is used to indicate a range of consecutive characters. [A-Za-z] matches one of the alphabets in capital or small letter. The order of characters is based on the ASCII code. [ followed by ^ (circumflex) matches one character except the characters after circumflex. [^0-9] matches any characters other than a number. [ and ] make a group of 1 byte ASCII characters. You can not make a group of Japanese characters (Shift JIS encoding, 2 byte character). Metacharacters other than [image] , ^, - and ] are treated as an ordinary character. In addition, ^ has the special meaning only if it occurs immediately after [. It is not necessary to escape the metacharacters except the above four with [image] .
{m ,n } | This pattern matches any number of occurrences between m and n inclusive of the preceding pattern. Where m ≥ 0, n ≥ 1, and m ≤ n. {m,} matches at least m occurrences. {,n} is equivalent to {0, n}. {n} is equivalent to {n, n}, and matches exactly n occurrences.
? | ? matches zero or one occurrence of the preceding pattern. R? is equivalent to R{0,1}.
+ | + matches one or more occurrences of the previous pattern. R+ is equivalent to RR* and R{1,}.
^ | A ^ (circumflex) at the beginning of an entire pattern matches the beginning of the target text. ^foo matches foobar, but does not match barfoo.
$ | A $ (dollar) at the end of an entire pattern matches the end of the target text. foo$ matches barfoo, but does not match foobar.

Following four characters (in the table below) are treated as metacharacters only in specific patterns.
Characters | Patterns treated as metacharacters
^ | It is at the beginning of an entire pattern, or immediately after [.
$ | It is at the end of an entire pattern.
- | It is enclosed by [ and ].
, | It is enclosed by { and }.
These metacharacters are treated as ordinary characters in the pattern other than above table. It is not necessary to escape by [image] (backslash).

(backslash) followed by a specific character may have special meanings. The sequence of [image] (backslash) and the character is called an escape sequence.
ASTEC Eyes supports the following escape sequences.
Escape sequences | Meanings
a | 0x07 (BEL,Alert)
b | 0x08 (BS, Back Space)
d | number (equivalent to [0-9])
D | other than number (equivalent to [^0-9])
f | 0x0c (FF, Form Feed)
n | 0x0a (NL, New Line)
r | 0x0d (CR, Carriage Return)
s | white space character (equivalent to [ [image] t [image] r [image] n [image] f])
S | other than white space character (equivalent to [^ [image] t [image] r [image] n [image] f])
t | 0x09 (HT, Horizontal Tab)
w | alphabet and number (equivalent to [0-9 a-zA-Z])
W | other than alphabet and number (equivalent to [^0-9 a-zA-Z])
xhh, [image] Xhh | hh is hexadecimal of single or double digits (0-9, a-f, A-F)


 15.2 Displaying Protocol Information

You can view the protocol information such as protocol variations, official names, well-known ports, of the protocols ASTEC Eyes supports.

Procedure

Choose [Protocol Information...] from the [Tool] menu of the Main window.

Note

  • You can search for a text in [Protocol Information] dialog box.


 15.3 Emergency Message

The memory of your PC may runs short or a fatal error may occur while using ASTEC Eyes. In such a case, ASTEC Eyes displays an error message and writes error information into the Emergency.log under the directory where ASTEC Eyes is installed.

If ASTEC Eyes writes the Emergency.log file, please contact the support with this file.


 15.4 Displaying User's Guide

Procedure

Choose [Users Guide] from the [Help] menu of the Main window.

Note

  • Adobe Systems Acrobat Reader needs to be installed to view the User's Guide.
  • Only the Japanese version of User's Guide is currently available.


 15.5 Displaying Quick Reference

Procedure

Choose [Quick Reference] from the [Help] menu of the Main window.


 15.6 Displaying Version Information

Procedure

  1. Choose [About ASTEC Eyes...] from the [Help] menu of the Main window.
  2. Click the tab of version information you wants to see:
    • ASTEC Eyes,
    • ASTEC Eyes for VoIP, or
    • VoIP Player.


 16 Keyboard Operations

In ASTEC Eyes, you can perform various operations using a keyboard as well as a mouse. The keyboard operations will be detailed in this section.


 16.1 Keyboard Operations within the Interface Selector Window

< [image] > < [image] > | Moves the selected position one row up or down.
< [image] > < [image] > | Expands or collapses the entries under the current entry if any.
<Enter> | Select a network interface.


 16.2 Keyboard Operations within a Monitor Window

Normal Mode
< [image] > < [image] > | Choose a Graph Item.
< [image] > < [image] > | Moves the focus one cell left or right.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown in the table format, scrolls up or down.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown in the table format, scrolls left or right.
<Ctrl-Space> | Toggles a Graph Item between selected and unselected.
<Ctrl-C> | Copies the traffic statistics to the clipboard from the chart format window. Copies the content of the selected cell of the table format window to the clipboard.
<Backspace> | Displays the previous chart when the breakdown is displayed or certain Graph Item(s) are hidden.

Chart Analysis Mode (Shown Vertical Cursor)
Key | After clicking a chart | After dragging in a chart
< [image] > | Moves the solid line 5 plotting points left. | Moves the end point of dragging 5 plotting points left.
< [image] > | Moves the solid line 5 plotting points right. | Moves the end point of dragging 5 plotting points right.
<Ctrl- [image] > | Moves the solid line 1 plotting point left. | Moves the end point of dragging 1 plotting point left.
<Ctrl- [image] > | Moves the solid line 1 plotting point right. | Moves the end point of dragging 1 plotting point right.
<Shift- [image] > | Works in the same way as < [image] >. | Moves the start point of dragging 5 plotting points left.
<Shift- [image] > | Works in the same way as < [image] >. | Moves the start point of dragging 5 plotting points right.
<Shift-Ctrl- [image] > | Works in the same way as <Ctrl- [image] >. | Moves the start point of dragging 1 plotting point left.
<Shift-Ctrl- [image] > | Works in the same way as <Ctrl- [image] >. | Moves the start point of dragging 1 plotting point right.

Chart Analysis Mode (Shown Horizontal Cursor without Selecting Graph Item)
Key | After clicking a chart |  | After dragging in a chart
< [image] > | Moves the solid line 1/100 of Y axis range up. |  | Moves the end point of dragging 1/100 of Y axis range up.
< [image] > | Moves the solid line 1/100 of Y axis range down. |  | Moves the end point of dragging 1/100 of Y axis range down.
<Ctrl- [image] > | short time span | other time spans | short time span | other time spans
 | Moves the solid line 1 byte/second (frame/second) up. | Moves the solid line 0.1 byte/second (frame/second) up. | Moves the end point of dragging 1 byte/second (frame/second) up. | Moves the end point of dragging 0.1 byte/second (frame/second) up.
<Ctrl- [image] > | short time span | other time spans | short time span | other time spans
 | Moves the solid line 1 byte/second (frame/second) down. | Moves the solid line 0.1 byte/second (frame/second) down. | Moves the end point of dragging 1 byte/second (frame/second) down. | Moves the end point of dragging 0.1 byte/second (frame/second) down.
<Shift- [image] > | Works in the same way as < [image] >. |  | Moves the start point of dragging 1/100 of Y axis range up.
<Shift- [image] > | Works in the same way as < [image] > |  | Moves the start point of dragging 1/100 of Y axis range down.
<Shift-Ctrl- [image] > | Works in the same way as <Ctrl- [image] > |  | short time span | other time spans
 |  |  | Moves the start point of dragging 1 byte/second (frame/second) up. | Moves the start point of dragging 0.1 byte/second (frame/second) up.
<Shift-Ctrl- [image] > | Works in the same way as <Ctrl- [image] >. |  | short time span | other time spans
 |  |  | Moves the start point of dragging 1 byte/second (frame/second) down. | Moves the start point of dragging 0.1 byte/second (frame/second) down.

Chart Analysis Mode (Shown Horizontal Cursor with Selecting Graph Item)
Key | After clicking a chart | After dragging in a chart
< [image] > <Ctrl- [image] > | Moves the solid line to the next higher plotted value of the Graph Item. | Moves the end point of dragging to the next higher plotted value of the Graph Item.
< [image] > <Ctrl- [image] > | Moves the solid line to the next lower plotted value of the Graph Item. | Moves the end point of dragging to the next lower plotted value of the Graph Item.
<Shift- [image] > <Shift-Ctrl- [image] > | Works in the same way as < [image] >. | Moves the start point of dragging to the next higher plotted value of the Graph Item.
<Shift- [image] > <Ctrl- [image] > | Works in the same way as < [image] >. | Moves the start point of dragging to the next lower plotted value of the Graph Item.


 16.3 Keyboard Operations within an Address Book

< [image] > < [image] > | Moves the focus one row up or down.
< [image] > < [image] > | Moves the focus one cell left or right.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown, scrolls up or down.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown, scrolls left or right.
<F2> | Toggles between the edit mode and the non-editable mode for user-defined name.
<Enter> | Wraps up editing a text.
<Ctrl-C> | Copies the content of the selected cell to the clipboard.


 16.4 Keyboard Operations within a TCP Status Information Window

< [image] > < [image] > | Moves the focus one row up or down.
< [image] > < [image] > | Moves the focus one cell left or right.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown, scrolls up or down.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown, scrolls left or right.
<Ctrl-C> | Copies the content of the selected cell to the clipboard.


 16.5 Keyboard Operations within an Event Viewer

< [image] > < [image] > | Moves the focus one row up or down in the table format.
< [image] > < [image] > | Moves the focus one cell left or right in the table format.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown, scrolls up or down.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown, scrolls left or right.
<Ctrl-Space> | Toggles the Graph Item between selected and unselected.
<Ctrl-C> | Copies the displayed events to the clipboard from the line chart format window. Copies the content of the selected cell of the table format window to the clipboard.


 16.6 Keyboard Operations within a Decode or Stream View

Key | Summary pane | Packet Detail pane | Dump pane
<Tab> <Shift-Tab> | Moves the focus on the decode view or the stream view among the Summary, Packet Detail, and Dump panes.
< [image] > < [image] > | Moves the focus one row up or down. |  | Moves toward a lower or higher address.
< [image] > < [image] > | Moves the focus one cell left or right. |  | Moves toward a lower or higher address.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown, scrolls up or down. |  | Works in the same way as < [image] > or < [image] >.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown, scrolls left or right. |  | Works in the same way as < [image] > or < [image] >.
<Alt- [image] > <Alt- [image] > | Effective only in the decode view. The packets that correspond to the currently selected record in the stream view are highlighted. You can jump back and forth among the highlighted packet with these keys.
<Page Up> <Page Down> | Moves the focus position one page up or down. |  | Moves the displayed area one page up or down.
<Home> | Selects the first row. |  | Scrolls up to show the lowest address.
<End> | Selects the last row. |  | Scrolls down to show the highest address.
<Z> | If all of the three panes are displayed, the pane with the focus will be expanded to the full window size. Conversely, if only one pane is displayed, all of the three panes will be shown.
<Ctrl- [image] > <Ctrl- [image] > <Ctrl-Home> <Ctrl-End> | Whichever pane the focus is set to, these keys work as < [image] >, < [image] >, <Home>, and <End> keys do respectively for the Summary pane with the focus set.
<Shift-Ctrl- [image] > <Shift-Ctrl- [image] > | When a vertical scroll bar is shown in the Summary pane, scrolls up or down, whichever pane the focus is set to.
<Shift-Ctrl- [image] > <Shift-Ctrl- [image] > | When a horizontal scroll bar is shown in the Summary pane, scrolls left or right, whichever pane the focus is set to.
<Ctrl-C> | Copies the content of the selected cell to the clipboard. |  | Copies the contents of the reversed area to the clipboard.
<Space> | Toggles the check box between selected or cleared. |  |
<Ctrl-G> | Moves to the row specified by the frame id.
<Ctrl-S> | Saves the decoded capture data into a file.
<Ctrl-T> | Toggles Summary pane between shown and hidden.
<Ctrl-M> | Toggles Packet Detail pane between shown and hidden.
<Ctrl-B> | Toggles Dump pane between shown and hidden.


 16.7 Keyboard Operations within a Decode Hints Dialog Box

< [image] > < [image] > | Moves the focus one row up or down.
< [image] > < [image] > | Moves the focus one cell left or right.
<Shift- [image] > <Shift- [image] > | When a vertical scroll bar is shown, scrolls up or down.
<Shift- [image] > <Shift- [image] > | When a horizontal scroll bar is shown, scrolls left or right.
<F2> | Toggles between the edit mode and the non-editable mode for the current cell.
<Tab> <Shift-Tab> | Moves the focus one cell forward or backward in the edit mode.


 16.8 Shortcuts

<Alt-0> | Moves the focus to the workspace.
<Alt-1> | Moves the focus to the Interface Selector window.
<Alt-2> | Moves the focus to the Message window.
<Ctrl-O> | Loads and decodes the capture data saved in a file.
<Ctrl-Alt- [image] > <Ctrl-Page Up> | Moves the focus to the previous workspace.
<Ctrl-Alt- [image] > <Ctrl-Page Down> | Moves the focus to the next workspace.
<Ctrl-S> | Saves the decoded capture data in the decode view into a file.
<Ctrl-L> | Opens [Search Host Name] dialog box.
<Ctrl-E> | Opens filter editor.
<Ctrl-P> | Prints.
<Ctrl-F4> | Closes the window with the focus in a workspace.
<Ctrl-Tab> <Shift-Ctrl-Tab> <Ctrl-F6> <Shift-Ctrl-F6> | Moves the focus among the windows in a workspace.
<Ctrl-C> | Copies the traffic statistics or events to the clipboard from the chart format window. Copies the content of the selected cell of the table format window to the clipboard.
<Ctrl-F> | Open Find dialog box.
<Ctrl-G> | Moves to the row of the Summary pane specified by the frame id or stream id, in a decode or stream view.


 17 VoIP (Voice over IP)

You can measure the voice quality, display the VoIP session sequence, and replay the voice (sound) with ASTEC Eyes for VoIP.

  • Displaying Voice Quarity
    Calculates voice quality scores based on the data of RTP and RTCP packets in the capture data and displays it. There are nine kinds of voice quality scores.
    • Network R value
    • Network MOS value
    • Network MOS-j value
    • User R value
    • User MOS value
    • User MOS-j value
    • Round trip delay
    • Jitter
    • Packet loss rate
  • Measuring Voice Quality
    Transmits and receives sound data using Call Simulation Module installed on two hosts, and then display voice quality from the capture data.
  • Displaying the Voice Session Sequence
    Finds the VoIP session in the capture data, and displays graphically the sequence of call initiation, audio data transmission, and session end.
  • Replaying Audio Data
    Replays the audio data in RTP packets. ASTEC Eyes for VoIP supports G.711 and G.723 CODEC's. The VoIP Player option is required for this function.


 17.1 Calculating Voice Quality from a Capture File
  1. Decode a capture file.
  2. Click [VoIP Quality] button ( [image]) on the toolbar of the decode view.
  3. Choose a type of voice quality scores.


 17.2 Measuring Voice Quality Using Call Simulation Module

You can measure the voice quality using two hosts, one of them with Call Simulation Module installed. A Call Simulation Module is contained in ASTEC Eyes for VoIP.

  1. Install ASTEC Eyes Basic Package, VoIP library, and Call Simulation Module on one host (named host A).
  2. Install Call Simulation Module on the other host (named host B).
  3. Run the Call Receiver of the Call Simulation Module on host B.
  4. Run ASTEC Eyes for VoIP on host A to measure voice quality.
Running Call Receiver
  1. Logon the host to run the Call Simulation Module as user with Administrator privileges.
  2. Click the Windows [start] menu.
  3. Choose [All Programs] ([Programs] for Windows 2000) -> [ASTEC Eyes for VoIP] -> [Start Receiver].
Invoking ASTEC Eyes for VoIP and Measuring Voice Quality
  1. Invoke ASTEC Eyes.
  2. Select an interface used for sound transmission.
  3. Click [Transmit Sound] button ( [image]) on the Common toolbar of the Main window.
  4. Specify a sound file, destination host, CODEC, and the repeat count of transmission.
  5. Click [Send...] button.

Note

  • There are sample sound files, sample1.wav and sample2.wav, under the directory where ASTEC Eyes for VoIP is installed.
  • You can also send audio data from the Call Receiver of Call Simulation Module.
    1. Click the Windows [start] menu.
    2. Choose [All Programs] ([Programs] for Windows 2000) -> [ASTEC Eyes for VoIP] -> [Setup Receiver].
    3. Select [Bidirectional] and specify a sound file.
  • To measure voice quality over IPv6, you need to set the Call Receiver accordingly before invoking it.
    1. Click the Windows [start] menu.
    2. Choose [All Programs] ([Programs] for Windows 2000) -> [ASTEC Eyes for VoIP] -> [Setup Receiver] -> [Detail].
    3. Select [IPv6].


 17.3 Changing Voice Quality Calculation Mode

There are following three modes for calculating voice quality.

  • RTCP mode: calculates voice quality based on informatin from RTCP protocol
  • RTP mode: calculates voice quality based on informatin from RTP protocol
  • Automatic mode: uses RTCP protocol if possible and RTP otherwise.
Calculation of voice quality is done in [automatic mode] by default. You can choose from the three modes shown above.

Changing the mode of voice quality calculation for charts and tables

Procedure

Click [Switch Calculation Mode] button ( [image] [image] [image]) on the toolbar of a chart or a table displaying voice quality. Clicking one of those buttons will change the mode for calculating voice quality.

Configuring the table displaying voice quality

In [VoIP Quality(Detail)] table, the values in some columns are calcuated differently according to voice quality calculation mode. The values in the other columns are calculated based on the information from certain pre-determined protocol.
The columns whose values are calcuated differently according to voice quality calculation mode are shown by default. The columns calculated from RTCP or RTP can be displayed, too.

Procedure

  1. Right click on one of the column headers of [VoIP Quality(Detail)] table.
  2. Select [Columns...].
  3. Select or clear the check box corresponding to the column you want to show or hide.


 17.4 Displaying VoIP Session Sequence

You can find the VoIP session from the capture data and display it graphically.

  1. Decode a capture file.
  2. Click [Sequence View] button ( [image]) on the toolbar of the decode view.
  3. Select a session in the Sequence View.
Searching for Error

If the selected session contains errors, you can move the focus to an error or warning row and select it by any of the following three ways:

  • Click [Next Error] button ( [image]) or [Previous Error] button ( [image]) on the toolbar of the Sequence View.
  • Press <Alt- [image] > or <Alt- [image] > key.
  • Right-click on the lower pane (Sequence View pane) of the Sequence View, and choose [Next Error] or [Previous Error].


 17.5 Merging VoIP Session

The session of VoIP can be merged and displayed.

RTP and RTCP packets in the same sequence may be recognized as in different sequences, e.g, due to the lack in the captured data.
You can merge sessions into one and display them as one session, in such cases.

  1. Display VoIP session sequences.
  2. Select the check boxes of the sessions you want to merge, in [ID] columns in Session List pane.
  3. Click [Merge sessions] button ( [image]) on the toolbar.

Note

  • The voice quality of the merged sequence will also be displayed in the charts and tables of voice quality.
  • When multiple calls are included in the merged session, the voice quality of the call corresponding to the first RTP or RTCP packet in the session will be shown.


 17.6 Saving VoIP Data

Voice quality information and the content of Sequence View can be saved in CSV (comma separated values) format, bmp format, or PNG format.

Procedure

  1. Click on VoIP Quality window or Sequence View.
  2. Select [Save Monitor...] from [File] menu of Main window.
  3. Specify the file name and file format.

Note

  • VoIP Quality window of tabular form and Sequence View can be saved only in CSV format.
  • You can use the saved data with other applications. For example, you can insert bmp image in Microsoft Word, or import CSV file into Microsoft Excel.


 17.7 Copying VoIP Data

The information in VoIP Quality window and Sequence View can be copied to other applications.

Procedure (charts)

  1. Click on VoIP Quality window containing the data you want to copy.
  2. Select [Copy] from [Edit] menu of Main window, or press <Ctrl-C> key.
  3. Activate the target application and press <Ctrl-V> key.

Procedure (tables)

  1. Right click on VoIP Quality window containing the data you want to copy.
  2. Select [Copy Whole Data].
    Pressing <Ctrl-C> key in the tabular format window will copy only the text in the selected cell (surrounded by a white frame).
  3. Activate the target application and press <Ctrl-V> key.

Procedure (Sequence View)

  1. Click on Sequence View containing the data you want to copy.
  2. Click on the field you want to copy.
  3. Select [Copy] from [Edit] menu of Main window, or press <Ctrl-C> key.
  4. Activate the target application and press <Ctrl-V> key.

Note

  • You can choose [Paste Special...] of the [Edit] menu instead of pressing the <Ctrl-V> key, with such applications as Microsoft Word and Microsoft Excel.


 17.8 Replying Audio Data

You can replay the voice (sound) from the capture data.

  1. Decode a capture file.
  2. Click [VoIP Player] button ( [image]) on the toolbar of the decode view.
  3. Select an entry in the VoIP Player window.
  4. Click [Start Reply] button ( [image]) on the toolbar of the VoIP Player window.

Note

  • In order to replay audio data, the VoIP Player option is required.
  • There may be an entry whose audio data cannot be replayed. Select one of the entries with [image] displayed in the left of the [VoIP ID] column.


 17.9 Saving Audio Data

You can save the audio data displayed in the VoIP Player window into a file.

  1. Click an entry you want to save in the VoIP Player window.
  2. Click [Save Sound] button ( [image]) on the toolbar of the VoIP Player window.

Note

  • In order to save the audio data, the VoIP Player option is required.
  • Audio data is saved into a file of WAVE format (8 kHz sampling frequencies, 16 bit, a monophonic recording, and extension is .wav).
  • There may be an entry whose audio data cannot be saved. Select one of the entries with [image] displayed in the left of the [VoIP ID] column.


 17.10 Mixing Audio Data

You can mix multiple audio data displayed in the VoIP Player window.

  1. Select [Mixing] check boxes of the entries in the VoIP Player window whose audio data you want to mix.
  2. Click [Mix] button ( [image]) on the toolbar of the VoIP Player window.
  3. In order to replay or save the audio data, click [Start Reply] button ( [image]) or [Save Sound] button ( [image]) on the toolbar respectively.

Note

  • In order to mix audio data, the VoIP Player option is required.
  • There may be an entry whose audio data cannot be replayed or saved. Select the entries with [image] displayed in the left of the [VoIP ID] column.


 18 Glossary

A-E

Caption Filter

Allows you to select from the values shown in the pull-down menu for each column. You can use this filter for the columns with [image] mark of the Summary pane of a decode or stream view.

Capture buffer

The buffer keeping capture data. Capture buffer is allocated on the memory of the host which ASTEC Eyes or Remote Module is installed. You can configure the capture buffer size and the action when the capture buffer is full.

Capture data

The data captured or continuously captured for a longer period.

Capture data indicator

Displays the period the continuously captured data exists on the Log window.

Capture data manager
Decodes a part of a capture file, or merges and decodes multiple capture files. You can specify the decode range by period or header attribute filter.
Capture filter
The filter to collects only the packets of your interest. Configure logical expressions using filter editor.
Common toolbar
The toolbar of the Main window. There are buttons for the operations independent of selected interface, such as opening a capture file, saving and loading configuration, and so on. User can customize buttons on the toolbar.

Configuration privilege

It is required in order to change the configuration of an interface or host, such as writing log, writing continuous capture, changing interface label, and so on. Refer to Obtaining and Releasing the Privileges.

Continuous capture

Captures packets continuously and save the captured data directly into files. Refer here for the operation.

Convenience Filter

Allows the user to screen packets or records easily by GUI operations in a decode and stream view.
There are three kinds of convenience filters:
  • caption filter
  • header attribute filter
  • decode result filter

Decode hints

Associates TCP/UDP port to a protocol. It is also possible to associate port number with a specific IP address to a protocol. For example, when a proxy server uses the port other than well-known port, configure decode hints with this information.

Decode result filter

Allows you to screen packets in the decode view based upon the contents of Packet Detail pane.

Decode view

Shows the decoded result of capture data or capture file.

Display filter

Allows you to screen packets or records in a decode view or stream view. Use the filter editor to configure a display filter.

Dump pane

The Dump pane shows the hexadecimal dump of the packet or record content in a decode view or stream view. It is the bottom area of a decode or stream view.

Entry

Means the icon and label of the host, interface, log, capture data, and directory of the log or capture data displayed in the Interface Selector window.

Event filter

A filter created by the filter editor. It is used to specify the conditions of user defined event and monitor event.

Expert function

There are two types of expert events in ASTEC Eyes; monitor expert events and decode expert events.
Monitor expert events detect the symptoms of network trouble while monitoring, and display them. You can configure the event to be detected.
Decode expert events detect the symptoms of network trouble while decoding the capture data, and display them. You can configure the event to be detected.
F-J

Filter editor

Defines the logical expressions for the filters of display filter , monitor filter , capture filter , start capture trigger , pause capture trigger , continuous capture filter , start continuous capture trigger , pause continuous capture trigger .
Graph Item
The elements displayed in a chart, such as line, bar, and pie. A Graph Item may be a host, host pair, protocol and so on.
Grip handle and drag bar
They are the components placed in the top or left side of the docking toolbar and window. Right-clicking on the grip handle or drag bar makes the toolbar and window shown or hidden. Dragging the grip handle or drag bar moves the toolbar or window.

Header attribute filter

Allows you to screen packets in the decode view based upon the values in packet headers.

Horizontal cursor

It is used to read the value of a chart. This cursor is appeared when you click [Horizontal Hair Cursor] button ( [image]) in the chart analysis mode of the Traffic window. It is shown as dashed line.

Interface
Same as a network interface.

Interface Selector window

The window used for the operations about interfaces such as selecting an interface, connecting to the Remote Module, and so on.

Interface toolbar

The toolbar of the Main window. There are buttons for the operation of the selected interface, such as starting or pausing monitoring, starting or pausing capturing, and so on. You can customize buttons on the toolbar.

K-O

Log

Periodically outputs statistics of network traffic and monitor events except for TCP Status Information into a file. The data saved into a file is called log, and the files saved is called log files. The following 17 kinds of data are saved as log;

  • MAC Traffic
  • MAC Traffic by Source
  • MAC Traffic by Destination
  • MAC Traffic by Host Pair
  • MAC Traffic by Protocol
  • IP Traffic
  • IP Traffic by Source
  • IP Traffic by Destination
  • IP Traffic by Host Pair
  • IP Traffic by Protocol
  • MAC Traffic by Address Type
  • MAC Frame Numbers by Frame Size
  • MAC Error Frames
  • MAC Address Table
  • IP Address Table
  • MAC - IP Address Table
  • Event
Refer here for the operation about a log.

Message window

Displays important messages from ASTEC Eyes. For example, it displays the value read using the Chart Analysis function , the frame ID, stream ID and protocol name of packets or records that ASTEC Eyes could not decode.

Monitor data

It is the information collected while monitoring, such as the traffic statistics displayed on a Monitor window, IP addresses, MAC addresses, TCP connection information, and so on.

Monitor filter

Selects the traffic to be displayed on a Monitor window. The filter conditions are configured using the filter editor.

Monitor window

Displays the data (traffic statistics, MAC addresses, IP addresses, connection status of TCP) collected while monitoring in a chart or table format. There are 17 kinds of Monitor windows shown below. Monitor window is classified into three kinds, a Traffic window , an address table, and TCP status information.
  • MAC Traffic
  • MAC Traffic by Source
  • MAC Traffic by Destination
  • MAC Traffic by Host Pair
  • MAC Traffic by Protocol
  • IP Traffic
  • IP Traffic by Source
  • IP Traffic by Destination
  • IP Traffic by Host Pair
  • IP Traffic by Protocol
  • MAC Traffic by Address Type
  • MAC Frame Numbers by Frame Size/LI>
  • MAC Error Frames
  • MAC Address Table
  • IP Address Table
  • MAC - IP Address Table
  • TCP Status Information

Network interface

It is a Network Interface Card (NIC) installed on a host. If multiple network interface cards are installed in one host, you need to select the target network interface before monitoring or capturing.
P-T

Pause capture trigger

It is a filter to pause capture when a packet with specific features is found. Use the filter editor to configure a pause capture trigger.

Pause continuous capture trigger

Pauses continuous capture when a packet with specific features is found. The filter conditions are configured using the filter editor.

Period range bar

It is used to specify the period range in the [Displaying Log] dialog box, [Capture Data Manager] dialog box, and [Continuous Capture] dialog box. You can specify the start and end time of the period by mouse operation.

realtime decode capture
Captures packets and shows their summary information in realtime decode view simultaneously.
realtime decode view
Shows the summary information of caputed packets in realtime. You can view the detailed analysis of each packet by displaying decode view from realtime decode view.
Refresh interval
It is the interval between updating chart or table in the Traffic window.

Remote Module

Has the same functionalities of collecting data as these of ASTEC Eyes Basic Package. Remote Modules can be connected from multiple ASTEC Eyes and send the collected data.
You can monitor a remote network as you monitor the local network, through the Remote Module installed on a remote host.

Packet Detail pane

Shows the analysis of the packet or record in the decode view or stream view. It shows protocol fields and their values. It is the center area of decode or stream view.

RFC (Request for Comments)

The documents which define the technical know-how, specification, standard process, and so on about Internet. IETF (Internet Engineering Task Force), the organization defining the Internet technology standards, publishes and manages the documents. You can view these documents in the "Unsupported" directory of the ASTEC Eyes installation CD.

Port Analysis dialog box

Displays TCP and UDP ports status of the host shown in a Traffic window or address book. It shows the succeeded connection count, refused count, and timeout count.

Selected cell

It is the target cell for the operation in the Monitor window of the table format, Summary pane of a decode or stream view, Decode Hints page of [Option] dialog box, and so on. Selected cell is surrounded by a white frame.

Sequence mode of stream view

Reassembles TCP stream and displays the decoded result by session.

Start capture trigger

Starts capture when a packet with specific features is found. Use the filter editor to configure a start capture trigger.

Start continuous capture trigger

Starts continuous capture when a packet with specific features is found. The filter conditions are configured using the filter editor.

Status bar

Displays the status of ASTEC Eyes or Graph Item name selected in the Traffic window.

Stream view

Reassembles TCP stream and displays the decoded result.

Summary pane

The pane to show the summary of packets or records in a decode view or stream view. It is the top area of decode or stream view.

TCP status information

TCP connection status displayed in a Monitor window.

Time span

The period of displaying the traffic statistics. There are three time spans; short, middle and long time span. You can choose one of these time spans. The intervals generating the traffic statistics differ for every time span; they are 1 second, 10 seconds, and 5 minutes, respectively.

Traffic window

Displays the statistical data of traffic, in line chart, bar chart, pie chart, and table format. There are thirteen kinds of Traffic window:
  • MAC Traffic
  • MAC Traffic by Source
  • MAC Traffic by Destination
  • MAC Traffic by Host Pair
  • MAC Traffic by Protocol
  • IP Traffic
  • IP Traffic by Source
  • IP Traffic by Destination
  • IP Traffic by Host Pair
  • IP Traffic by Protocol
  • MAC Traffic by Address Type
  • MAC Frame Numbers by Frame Size
  • MAC Error Frames
U-Z

User defined event

An event detected when the conditions defined by user are met. The conditions for user defined event are specified in an event filter using filter editor.
Vertical cursor
It is used to read the value of a chart. This cursor is appeared when you click [Vertical Hair Cursor] button ( [image]) in the chart analysis mode of the Traffic window. It is shown as dashed line.

Voice quality information
Indicates voice quality. It includes R value, MOS value, round trip time, jitter, and packet loss rate.

Workspace

The area to display windows, such as Monitor window, decode view, stream view, and so on, except for dialog boxes. You can use multiple workspaces for organizing windows in ASTEC Eyes.


 ASTEC Eyes on the net Version 7.2 Quick Reference