Workshop

Typical Operation
Previous Table of Contents Next
Most network analyzers have two modes of operation:
• Capture
• Decode
During the capture phase, the analyzer can perform statistic gathering, including number of errors per
station, number of packets transmitted/received by each station, network utilization (how congested the
network is), and so on. The really cool analyzers will show you graphs, let you sort by “most talkative
station,” and so on during the capture phase. The decode phase allows you to sift through the specific
data that the analyzer captured (the equivalent of reading the transcript of a party-line wire tap).
Captive Packet
Capturing everything on a shared network is possible—although it’s resource intensive on your analyzer!
Consider a busy 100Mbps network: At a conservative estimate of 6MBps, that would mean you would
need 360MB of physical memory (virtual memory simply isn’t fast enough to keep up) to capture a
minute’s worth of data.
Token-Ring and 10Mbps Ethernet aren’t this bad, roughly only requiring 90MB and 36MB respectively
of physical memory to keep up with a minute’s worth of data. Still, that’s a lot of stuff to sift through and
store. How do analyzers deal with this?
Most analyzers have a certain “buffer space” they allocate to capture data. When the buffer is full, you
have an option to stop capturing or you can simply discard data at the “end” of the buffer to make room
for new data (see Figure 21.2).
Figure 21.2 An analyzer can either discard the oldest data once the buffer is full or stop capturing
altogether.
Check with the maker of your software analyzer to see what kind of PC hardware you need to keep up
with the network that you’re analyzing. For example, some hardware isn’t able to run fast enough to