ETHLOAD user's guide                         40                                                                                                                                                                                                                                        ETHLOAD 1.04                                                            USER'S GUIDE                                                                                                                                                                                                                                                                                                                                    A simple free                                                   Ethernet load/problems analyzer                         and events tracer                                                                                                                                                                                                                                                                    E. Vyncke                                                          vyncke@csl.sni.be                                                           16 January 1994                                 1. Introduction.              ETHLOAD is a free software running on any MS-DOS PC with  an       Ethernet controller.              Currently,  ETHLOAD  supports  the  following  drivers  (for       Ethernet and Token Ring):         - Digital Equipment Corp. DLL specification;         - Microsoft    3Com    NDIS   (Network   Driver    Interface           Specification);         - packet  driver as issued from PC/TCP, Clarkson  University           or from the Crynwr collection;         - Novell   ODI  (Open  Datalink  Interface)  if  the  driver           supports promiscuous mode;         - ASCII file containing Ethernet frames;         - loopback driver (mainly for debugging purposes).              The purposes of ETHLOAD are  twofold:         - display  very  simply  non  accurate  numbers  about   the           Ethernet load (number of frames/sec, bits/sec, ...);         - display  important parameters, events and  loads  for  the           TCP/IP, DECnet, OSI, XNS, NetWare and Netbeui protocols.              ETHLOAD allows you to:           -  check  simply the load of your Ethernet  (with  error           rate, inter frame gap,...);           - check which host is sending most of frames;           - see which host is sending to which host;           -  see  what  kind  of  protocols are  in  use  in  your           Ethernet;           - ...              In a TCP/IP network, ETHLOAD allows you to:           - see ARP table contents;           - see which host is sending (un)resolved ARP probes;           -  see the IP host which is sending most of the IP,  UDP           or TCP packets;           -  see what kind of protocols are in used (either TCP or           UDP);           -  see which is the mostly used telnet/rlogin server (or           client);           -  see  the boot sequence with important BOOTP and  TFTP           events;           -  see some characteristics of IP hosts (fragments size,           MTU,   IP  retransmission,  options  used  --  including           source routing, ...);           - see main RFC 1001/1002 NetBIOS events and names;           - see the working of DNS;           -    see    important   TCP   events:   start/stop    of           connections,...              In a DECnet network, ETHLOAD allows you to:           -  see  which node are sending/receiving most of  DECnet           packets;           -  see  all  Connect Initiate packets (including  object           number, ...) ;           - see returned packets;           - ...                  In an OSI network, ETHLOAD allows you to:           - see the top transmitter/receiver NSAP;           -  see  what  happens  with TUBA (TCP  &  UDP  with  Big           Addresses);           -  see the exchange of information between ES and IS and           between IS;           -   see   important  events  for  the  transport  layer:           connection/disconnection,   TSAP   are   displayed    in           hexadecimal, ASCII and EBCDIC.                  In a Microsoft NetBEUI network, ETHLOAD allows you to:           - see the main naming events;           - see the connections and the datagrams.                  In a Novell NetWare network, ETHLOAD allows you to:           - see the routers;           - see the different XNS/IPX networks;           - see the advertised services ;           - see who is connected to who.                                          * * *                                * *                                 *2. Miscellaneous and acknowledgements.         2.1. Original copyright.              This  software is based on the very first version of ETHLOAD       I  have  developed while I was working in a  company  called       Network Research Belgium. This version was already free  and       in  the  public  domain  thanks to the  management  of  this       company.              Here  follows the copyright included in the source files  of       about 0,1% of the current version of ETHLOAD.              /*  This  software  and  documentation can  be  copied,  used,       modified freely as long as:       - the source contains this text       -  this  software, documentation is provided  free  of  charge       (but for the cost of media: paper, CD-ROM, ...).       Network  Research Belgium and the individuals who have written       this  software DO NOT ASSUME any responsibilities  in  respect       to the use, (un)expected side -effects of this program.       The  software  and  documentation is provided  as  it  is.  No       maintenance will be given.       Anyway,  we  would  be pleased to hear of  any  use  of  these       softwares by email, fax:               bert@nrb.be               fax: +32.41.48.11.70       Suggestions, modifications are always welcome.       These  softwares have been developed by a special team  called       BERT  in a company called Network Research Belgium located  in       Herstal, Belgium, Europe .       This team includes:               Eric Vyncke, vyncke@nrb.be now vyncke@csl.sni.be               Frederic Blondiau, blondiau@nrb.be               Michel Ghys, now mghys@cisco.com               Marie-Christine Timmermans, timmermans@nrb.be               Jean Hotterbeex, now jhotterb@cisco.com               Manu Khronis,   khronis@nrb.be               Vincent Keunen, keunen@manex.uucp       */         2.2. Current copyright and disclaimer.              Right  now,  all  software developments are  made  home  and       tested  after  working hours in my current company:  Siemens       Nixdorf Informationsystems, SNI. So, here follows the  usual       disclaimer:  Siemens  Nixdorf  and  NRB   are  by  no  means       responsible  for  any good or bad effects of  this  program.       And  by the way, the quality of ETHLOAD does not reflect the       usual quality of NRB or SNI software.              NRB,  Siemens  Nixdorf and the author do  not  support  this       software  and are, in no case, responsible for any  bad  use       or  any bad effect or any false result or anything caused by       any version of ETHLOAD.  2.3. Support.              If  you  have problems to run ETHLOAD, please read carefully       this  manual and also check the common pitfalls in  appendix       A.4.              The  UseNet  comp.protocols.tcp-ip.ibmpc  newsgroup  is  the       right  place to state your problems, to comment on  ETHLOAD,       ...  I'm  reading  this newsgroup every day  (together  with       comp.sys.novell  and the BITNET mailing  list  about  NOVELL       and  PATHWORKS).  This  if the preferred  way  to  get  some       'support'.              Anyway,  you can get some support from the author  since  he       wants  to promote this software... You can reach the  author       through       email:       vyncke@csl.sni.be1,        X.400:       /c=be/admd=rtt/prmd=sni/o=siemens  nixdorf/ou1=liege/ou2=L1/       ou3=D1/ou4=csl/g=eric/s=vyncke/ or by post mail:                Eric Vyncke         Rue Nolden, 25         B-4432 Alleur           Belgium (Europe).              If  you are happy with ETHLOAD, my little son, Pierre, would       appreciate  to receive any postcard (he is still very  young       and still lives with us :-)!              Due  to the large 'success' of ETHLOAD, I'm no more able  to       reply  to  all questions or comments addressed to  my  email       address...   So,  you  are  strongly  urged   to   try   the       comp.protocols.tcp-ip.ibmpc newsgroup.              In  no  case,  shall I answer to phone calls  at  my  office       (except  for those of you who are working for a  company  of       the  Siemens  group)...  Don't forget  that  I  am  paid  by       Siemens Nixdorf and that I have a lot of work to do  at  the       office :-)  2.4. Distribution channel.              I  have no access to internet, so I cannot place ETHLOAD  on       anonymous  FTP  server, if you run  such  a  server  I  will       appreciate that you reserved some place for ETHLOAD on  your       BBS or anon FTP server...              If  you  do so, please warn me by email in order to  keep  a       list of distribution channels.              Normally,   ETHLOAD   is   available   as   package   called       ETHLDvrr.ZIP  (where  vrr are version and  release  numbers)       from   the   Simtel  repository  (aka  oak.oakland.edu)   in       /pub/msdos/lan            and            also             in       ub4b.eunet.be:/pub/ub4b/network/msdos. A  companion  program       called   ETHDUMP  is  generally  available  from  the   same       locations under the name ETHDPvrr.ZIP.              These  servers can be accessed by email via TRICKLE  servers       on   BITNET   for  the  Simtel  repository  or   via   mail-       server@ub4b.eunet.be (commands: help,  reply  <address>  and       get ethld104.zip).  2.5. Thanks to testers.              I would like to thank anyone of you about his/her comments.              I thank especially my beta-testers:           Ralf Buettemeyer, buettemeyer@hagenuk.netuse.de           Michel Dalle, michel@d92.cb.sni.be           Niels Kr. Jensen, msterlje@vm.uni-c.dk           Hans-Joachim Koch, koch@lifra.lif.de           Hans-Michael Pronk, hpronk@fac.fbk.eur.nl           A.A.L. Reijnierse, A.A.L.Reijnierse@research.ptt.nl           Frank Van Uffelen, frankvu@bix.com, fvo@te6.siemens.be                  I thank also for comments, suggestions, ...:           Joe Doupnik, jrd@cc.usu.edu           Knut Eckstein, eckstein@isd.uni-stuttgart.de           Thomas Gasser, thomasg@staff.tc.umn.edu           Derek Johnston, ugcsjj9697@mtvms2.mtech.edu           Ross Lazarus, rossl@westmead.health.su.oz.au           Ted Llellewyn, tsl@panix.com           Jos Minnema, jos.minnema@pagv.agro.nl           Craig Morgan, cmrcm@staffs.ac.uk           Russ Nelson, nelson@crynwr.com           Hugo Philips, zigo@uc.sni.be           Oliver Rehmann, orehmann@itr.ch           Lars Scheffmann, scheffmann@dou.dk           Russell Thamm, rmt@gwd.erl.dsto.gov.au                  And, all of you who have send a postcard :-)  2.6. Changes.          1.01:       - support for packet driver, ODI and NDIS       - support for TCP/IP       - no more load graphics       - dictionaries       - bug correction in the length display       -  porting from large model in Borland C to small  model  in       Borland C++          1.02:       - bug correction in DLL support       - documentation about copyright on packet drivers       - dropped packets percentage in MAC screen       - MAC flow screen       - SMTP, TFTP and BOOTP support       - Telnet/rlogin monitoring       - options in command line       - OSI support       - improved DLL, ODI, NDIS and packet driver routines          1.03:       - use a local stack for all interrupt time routines;       - add file driver;       - support DNS, RFCNBIOS in TCP/IP;       - add NetBEUI and XNS/NetWare supports;       - improved display routines;       -  NumLock  key for switching between numeric  and  symbolic       display;       - improved memory management;       - port to large model C;       - slight changes in DECnet presentation.          1.04:       - consider socket instead of packet types for Novell;       - addition of TUBA       - better OSI support (active network layers)       - slight modifications in packet driver       - add the -b option to specify LAN bandwidth       - add the -f option to allow very trivial filtering       - add the -m option to specify more buffers       -  add  the -o option to allow partial work of ETHLOAD  even       if promiscuous mode is not supported       - remove the old -s (stack) option       -  replace  the old -f (fast) option by a -s (slow)  option,       the default is now fast mode       - some IEEE 802.5 support (MAC frames, ring status, ...)       - decode MSS option in TCP       - decode IP options       - add a dictionary for DNA objects       -  ETHDUMP (the companion) can record short frames  (  <  14       bytes) and can be put in quiet mode       - the key '%' change top display percentage       - length in recorded file now includes all headers and FCS