Workshop

View Zoo
Previous Table of Contents Next
Finally, when viewing specific packet traces, you’ll want to explore your view options. Most analyzers
have a menagerie of options that allow you to be flexible about which attributes of the trace you’re
viewing at one time. Some of these attributes include the following:
• Hexadecimal representation of packet
• Capture time
• MAC and/or protocol and/or service decodes
• Protocol or MAC address
• Network name (DNS and NetBIOS)
Many network analyzers have a name-gathering feature; that is, they “read” the packets as they go by and
see whether there’s a name identifier in any of them. If there is, the analyzer will make an entry in its
name table, which will allow you to later specify a capture filter or view based on a network name. This,
of course, is a much more “user friendly” way to specify a filter or view data.
Be aware that some analyzers do not capture names automatically; they offer it as a manual operation on
data that you’ve already captured, during the viewing portion of your analysis.
Even with a Windows-based analysis tool, your brain can only process so much input at one time; being
able to specify view options lets you “keep it simple” so as not to overwhelm yourself with too much
information. Accordingly, you can view strip charts that summarize certain aspects of your data, as
shown in Figure 21.5, which divides network traffic by application.
Figure 21.5 Shomiti Surveyor and other analyzers can graph “top talkers” and other statistics, thus
helping you to interpret raw data.
You can also change your packet decode display options—in particular, how time and network names are
displayed. Because a network is a timing-sensitive animal, the time-related options are particularly