Windows sysinternals

372 Part II Usage Guide
FIGURE 13-3 Portmon.
You can toggle data capture on and off by pressing Ctrl+E or clicking the Capture icon in the
toolbar, and you can enable Autoscroll to scroll new events into the display as they arrive.
Each event appears in the Portmon window as a separate row with resizable columns. If data
in a particular column is wider than that column can accommodate, hover the cursor over the
displayed text and Portmon will display the full column text in a tooltip.
The first column is a Portmon-assigned event counter that gets reset to zero when you
clear the display. Gaps in this sequence can occur if the amount of incoming data exceeds
Portmon’s ability to keep up, or if filters (described later) exclude events from the display.
The Time column shows how long the request took to complete. You can have this column
display the time of day of the event instead by selecting Clock Time on the Options menu.
Note that this change affects the display only for subsequently captured data. You can also
hide the Time column by deselecting Show Time Column on the Options menu.
The Process column identifies the name of the process that made the request.
The Request column shows the symbolic name of the control code sent to the port. The
names are mostly self-explanatory (assuming you know something about port communications).
IOCTL stands for input/output control, and IRP stands for input/output request packet,
with MJ used to define major functions. IOCTLs are for configuring the device’s behavior,
while IRPs typically request or contain data.
The Port column identifies the name of the port to which the request was sent. By default,
Portmon monitors all serial ports listed in HKLM\Hardware\DeviceMap\SerialComm and all
parallel ports listed in HKLM\Hardware\DeviceMap\Parallel Ports. You can selectively disable
the monitoring of specific ports via the Ports submenu of the Capture menu, as shown in
Figure 13-4. Portmon remembers your selections and reapplies them the next time it runs.
www.it-ebooks.info