Windows sysinternals

Chapter 13 Network and Communication Utilities 373
FIGURE 13-4 Portmon port selection.
The Result column shows the result of the request.
Finally, the Other column shows additional relevant data about the request. For example, for
a “set baud rate” IOCTL, Portmon shows the requested baud rate in the Other column. For
read and write operations, Portmon displays the data length and then at least some of the
data. By default, Portmon displays up to 64 bytes of data in ASCII form, using “.” to represent
nonprintable characters. You can change the amount of data that is shown by choosing Max
Output Bytes from the Options menu and setting a different number in the Max Bytes dialog
box. You can also choose to show the data in hexadecimal form instead of ASCII by selecting
Show Hex from the Options menu. Both of these options take effect on subsequently
captured data. Portmon doesn’t change the display of data that has already been captured.
Portmon monitors system memory usage and suspends its data capture if it detects that
memory is running low, resuming capture only when the low-memory condition has eased.
One way to limit Portmon’s own memory consumption is to set the History Depth to a nonzero
value. This setting, on the Options menu, limits the number of events Portmon displays,
discarding older events.
You can increase the display space for output by selecting Hide Toolbar on the Options
menu. You can also increase the number of visible rows by selecting a smaller font size.
Choose Font from the Options menu to change the font.
Unlike most Sysinternals utilities, which store their settings under HKCU\Software\
Sysinternals, Portmon’s settings are stored in HKCU\Software\Systems Internals\Portmon,
except the EulaAccepted flag, which is in HKCU\Software\Sysinternals\Portmon.
Searching, Filtering, and Highlighting
If you want to search for a line containing text of interest, press Ctrl+F to display the Find
dialog box. If the text you specify matches text in the output window, Portmon selects the
next matching line and turns off the Autoscroll feature to keep the line in the window. Press
F3 to repeat a successful search.
Another way to isolate output that you are interested in is to use Portmon’s filtering
capability. Click the Filter button in the Portmon toolbar to display the Filter dialog box,
shown in Figure 13-5. Filter and Highlight rules are automatically saved on exit and can be
reapplied the next time you run Portmon.
www.it-ebooks.info