% VAX-11 Librarian V04-00$ZՕaZՕst5@fileADD ^addressCLEARHDEFINEDELETE DISPLAY$ Ethernet_port%EXIT&vHELP'<Keypad-LOAD0MAP2MONITOR3 PING6QUERY:SAVE<0SETLSHOW^SPAWN_* SUMMARIZEbTRACEqWAIT+ZՕ1 @fileA Executes an indirect command file containing ETHERMON commands.+ Indirect command files may not be nested. The command format is @filenameww+ZՕ1 ADD> Adds new items to the ETHERMON utility's internal databases. The command format is+ ADD item-name [additional parameters]+ where the item-names are specified below.2 FILTERD Adds a new entry to the message filter database. The filter can beF initia lly enabled or disabled, and can specify protocol type, sourceG address, destination address, or a combination thereof for filtering. The command format is+ ADD FILTER /qualifier [/qualifier...]3 Command_Qualifiers/DISABLEB Specifies that the filter should initially be disabled; it may beA enabled later with the SET FILTER command. The default for a new filter definition is enabled./ENABLEA Specifies that the filter should initially be enabled; it may beA enabled lat er with the SET FILTER command. The default for a new filter definition is enabled.$/EXCLUDE=(field=value[,field=value])B Specifies that messages that match the specified fields should beB filtered out and not used in the analysis. The fields that can be used are: ADDRESS=address! ADDRESS=manufacturer-prefix DESTINATION=address% DESTINATION=manufacturer-prefix6 MULTICAST (all destinations that are multicast)E PROTOCOL=aa-bb (where aa-bb is the hex adecimal protocol type) SOURCE=address SOURCE=manufacturer-prefix!/ONLY=(field=value[,field=value])@ Specifies that messages that do not match the specified fields @ should be filtered out and not used in the analysis. The fields that can be used are: ADDRESS=address! ADDRESS=manufacturer-prefix DESTINATION=address% DESTINATION=manufacturer-prefix6 MULTICAST (all destinations that are multicast)E PROTOCOL=aa-bb (where aa-bb is the hex adecimal protocol type) SOURCE=address SOURCE=manufacturer-prefixww:-ZՕ 1 address2 assignment_conventionsH The conventions for Ethernet addresses are that the least significant G bit of the first byte is clear for a physical address, and set for a ? multicast address. The first three bytes describe a block of F addresses allocated to a particular manufacturer, and the remaining F bytes make up an individual ID code for a single node. A short, veryC incomplete list of known physical address ranges are (longer list5 available with the SHOW MANUFACTURERS/ALL command):D Digital Equipment Corp.: AA-00-03-00-xx-yy (hardware default forG DEUNA network adapters)I AA-00-04-00-xx-yy (DECnet logical addresses)J 08-00-2B-xx-yy-zz (initial hardware addressesK for LANCE-based interfaces,G  used for DECservers and; DECbridges)E Sun Microsystems: 08-00-20-02-xx-yy (hardware default for G 386i workstations; lastG 2 bytes +1 are host ID)D 08-00-20-xx-yy-zz (hardware default forL Ethernet interfaces on otherA  Sun workstations)K Xyplex Corp.: 08-00-87-00-xx-yy (Ethernet CC's, HIU's, etc.;F yyxx is unit serial #)J Ungermann-Bass: 00-DD-00-xx-yy-zz (old-style NET-ONE terminalD network controllers,J where xxyy is box #, zz is8 board #)K  00-DD-01-xx-yy-zz (new terminal network boxes,G xxyyzz is 24-bit box #)K 00-DD-0F-xx-yy-zz (Token Ring terminal networkG boxes, xxyyzz is box #)K CMC: 02-CF-1F-04-xx-yy (UNIBUS Ethernet interfaces)K 02-CF-1F-09-xx-yy (UNIBUS Ethernet interfaces)D 02-CF-1F-70-xx-yy (MULTIBUS II Et hernet; interfaces) 2 formats@ Addresses on the Ethernet can be specified to ETHERMON in fourG different formats. The standard Xerox physical address display formatC is the one always used by ETHERMON on output, and may be used forC input wherever an Ethernet address is required. It is of the formF aa-bb-cc-dd-ee-ff, where each pair of letters is a one- or two-digit? hexadecimal number, and the numbers are separated by hyphens.6 Al ternately, Ethernet addresses can be specified as:J a) DECnet node number, i.e. area.node, where area is a decimal numberF in the range 1 to 63 and node is a decimal number in the range 1 to 1023;E b) Internet physical address, i.e. a.b.c.d, where each letter isE a decimal number in the range 0 to 255, and the total address9 must correspond to an entry in the address table;F c) DECnet node name, i.e. a 1- to 6-character alphanumeric stringE (starting with a letter) which must match the DECnet name of & an entry in the address table.K d) Ungermann-Bass unit serial number in the form UB#nnnnn, where nnnnn$ is the device serial number.ww1ZՕ1 CLEAR? Removes item definitions from the ETHERMON utility's internal databases. The command format is- CLEAR item-name [additional parameters]+ where the item-names are specified below.2 FILTERF Removes entries from the Ethernet message filter database, or clears the entire filter list (/ALL).E If only a single filter is to be removed, the number of the desiredD filter must be specified (obtained with the SHOW FILTERS command). The command format is CLEAR FILTER filter-number or CLEAR FILTER/ALL2 FLAGSH Clears the Internet (IP) flag bits for all address table entries. ThisG is primarily available to allow re-deriving of IP addresses for nodesG when some of the addresses are garbled (generally due to glitchy RIP H type IP routing messages detected on the Ethernet). After entering theG command, automatic IP address derivation will start over from scratchF (although the address table entries themselves will not be deleted). The command format is CLEAR FLAGSww U3ZՕ1 DEFINEF Associates an equivalence string and a set of attributes with a key< on the terminal keyboard. The /KEY qualifier is required. Format:9  DEFINE/KEY [/qualifiers] key-name equivalence-string 2 Parameters key-nameF Specifies the name of the key that you are defining. The followingF table lists the key names in column one. The remaining threeF columns indicate the key designations on the keyboards for the threeF different types of terminals that allow key definitions. AllF definable keys on VT52 terminals are located on the numeric keypad.F On VT100-type terminals, you can define the LEFT and  RIGHT arrowF keys as well as all the keys on the numeric keypad. There are threeF types of keys that can be defined on terminals with LK201 keyboards:F (1) keys on the numeric keypad, (2) keys on the editing keypadF (except the UP and DOWN arrow keys), and (3) keys on the functionF key row across the top of the terminal. (Note that you cannot& define function keys F1 through F5.)< Key-name LK201 VT100-type VT52> PF1 PF1 PF1 [blue]= PF2 PF2 PF2 [red]> PF3 PF3 PF3 [gray]; PF4 PF4 PF4 - -F KP0, KP1, ..., KP9 0, 1, ..., 9 0, 1, ..., 9F 0, 1, ..., 99 PERIOD . . .; COMMA , , n/a; MINUS - - n/a= ENTER Enter ENTER ENTER; Find (E1) Find - - - -; Insert Here (E2) Insert Here - - - -; Remove (E3) Remove - - - -; Select (E4) Select - - - -; Prev Screen (E5) Prev Screen - - - -; Next Screen (E6) Next Screen - -  - -; HELP Help - - - -; DO Do - - - -; F6, F7, ..., F20 F6, F7, ..., F20 - - - -F Some defineable keys are enabled for definition all the time.F Others, including KP0 through KP9, PERIOD, COMMA, and MINUS, need toG be enabled for definition purposes. You must issue SET KEYPAD F APPLICATION command before using these keys (although this is doneG automaticall y at ETHERMON start-up, it may have been cancelled by the SET KEYPAD NUMERIC command).F The LEFT and RIGHT arrow keys and the F6 through F14 VT200 keys areF reserved for command line editing. You must issue the SETF TERMINAL/NOLINE_EDITING command at the DCL level before definingG these keys. You can also press CTRL/V to enable keys F7 through F14.. Note that CTRL/V will not enable the F6 key. equivalence-stringF Specifies the string which is to be processed  when you press theF key. The entire remaining portion of the line after the key nameF is accepted as the equivalence string, as-is, so all qualifiers forF the DEFINE/KEY command (as opposed to the equivalence string) must appear before the key-name.2 Command_Qualifiers/NOECHOF Determines whether the equivalence string is displayed on yourF screen after the key has been pressed. By default, the equivalence4 string is echoed to the screen when it is pressed. /IF_STATE=state-nameH Specifies a state which must be in effect for the key definition to G be in effect. If you omit the /IF_STATE qualifier, the current stateH is used. The state name is an alphanumeric string. States are , established with the /SET_STATE qualifier. /LOCK_STATEF Specifies that the state set by the /SET_STATE qualifier remain inF effect until explicitly changed. If you do not use the /LOCK_STATEF qualifier, the state set by /SET_STATE is in effect only for theF next defineable key that you press or for the next read terminating character that you type.F The /LOCK_STATE qualifier can only be specified with the /SET_STATE qualifier./SET_STATE=state-nameF Causes the specified state-name to be set when the key is pressed.0 The state name can be any alphanumeric string.E If you omit the /SET_STATE qualifier, the current state that was  locked remains in effect. /TERMINATEF Specifies whether the current equivalence string is to be terminatedF (that is, processed) when the key is pressed. Pressing RETURN has& the same effect as using /TERMINATE. 2 ExamplesM ETHERMON> DEFINE/KEY/TERM/NOECHO ENTER TRACE/BINARY/PARAL/INT=:5/OUT=GRABIT ETHERMON>  . . .N %ETHERMON-I-MOPMSG, 11:22:33 08-00-2B-12-34-56 sent MOP DLA msg, t=0508 ln=8" ETHERMON> ? %ETHERMON-I-ASYNTRCBEG, asynchronous TRACE command started...I In the first command l ine, the keypad ENTER key was defined to invoke aH parallel TRACE command. Later, when an event of interest occurred, theG user hit the pre-defined keypad key, and was able to start tracing atA once, without having to type in the lengthy command in a hurry.ww7ZՕ1 DELETEF Deletes key definitions that have been established by the DEFINE/KEY+ command. The /KEY qualifier is required. Format:$ DELETE/KEY [/qualifier] key-name 2 Parameters key-name!D Specifies the name of the key whose definition you want to delete.2 Command_Qualifiers/STATE=state-nameG Specifies the names of states for which the specified key G definitions are to be deleted. State names can be any appropriate  alphanumeric string.B If you omit the /STATE qualifier, key definitions in the default state are deleted.wwo9ZՕ 1 DISPLAYE Generates a dynamically updating status display, similar to the VMSD MONITOR ut"ility. The display updates continuously at the specifiedF update interval (see SET INTERVAL for more details) until any key isG struck on the user terminal; at this time, the display will terminate1 and control will return to the ETHERMON prompt. The command format is& DISPLAY displaytype [/qualifier]8 where displaytype is one of the types specified below.2 DESTINATIONSF Displays the top (up to 15) destination addresses being specified inI the Ethernet traffic. For ad#dresses with known meanings, their symbolic names will also be displayed. 2 PROTOCOLSB Displays the top (up to 8) protocol types being specified in theB Ethernet traffic. For protocol types with known functions, their( symbolic names will also be displayed.2 SIZESE Displays the size distribution of messages being transferred on theD Ethernet for message size groupings from 1-100 to 1401-1500 bytes. 2 SOURCESF Displays the top (up to 15) source addresses being specified i$n the E Ethernet traffic. For addresses with known meanings, their symbolic names will also be displayed. 2 STATISTICS@ Displays the current counter statistics from the Ethernet port9 (averages, minimums, and maximums not yet implemented).2 Command_qualifiers /NOFILTERD Specifies that the DISPLAY command will display all messages beingF processed by ETHERMON, ignoring any filter settings. By default, theA DISPLAY command only displays data that has passed the filters.w %w@:ZՕ1 Ethernet_portF When the ETHERMON program is started, it must be informed as to whatF VAX/VMS device it will use as its interface to the Ethernet. Any DECI standard Ethernet port (DEUNA, DEQNA, DEBNT, etc.) or FDDI port (DEMFA)D may be specified by its VMS device name (XEA0:, ESA0:, etc.) as a H command line parameter at DCL level; if the name is not specified (or J ETHERMON is not invoked as a foreign command), ETHERMON will search the K system for all standard &known ports. If only one port is found, ETHERMON L will use it, else it will display a list of known available ports for the G user to choose from, and prompt for the device name. The unit number 2 is not required, as it will be discarded anyway.F Note that the user must have PHY_IO, NETMBX, and TMPMBX (or SETPRV) G privileges to run this utility; CMKRNL (or SETPRV) privilege is also ( required for VAX/VMS V5.4-3 and above.ww@:ZՕ1 EXITD Terminates the ETHERMON 'utility and returns control to the command; interpreter. Control-Z may also be used for this purpose.ww@:ZՕ1 HELPB The ETHERMON utility provides the ability to dynamically monitorD the state of an Ethernet network connected to a VAX system. It canE generate dynamic displays of the current state of the cable, or can> record events occurring on the cable for analysis by another program.+ For more information on any command, type- HELP command [/qualifier(s] [parameters] at the ETHERMON prompt.ww| protocols using the DEC MOP Remote Console protocol (60-02) 9 type's Request ID and System ID response message types.wwDZՕ1 QUERYJ Issue queries to one or more Ethernet nodes under a particular protocol H and quer8y type. Up to 16777215 nodes may be queried at a time, but theG command tends to run slowly for large numbers of nodes (approximatelyJ 150 nodes/second on a VAX 6000-series), and can cause bridge congestion.J The command will verify its address range if more than 1000 nodes are to be queried at a time. The command format is:; QUERY/querytype[/qualifier] startaddress [endaddress] 2 querytype /DECBRIDGEC Issues a DEC "dump bridge statistics" query using DEC Lan Bridge 9 protocol (80-38)/DECMOPF Issues a DEC MOP "Request ID" query using DEC Maintenance Operations- Protocols' Remote Console protocol (60-02). /UB_BRIDGEG Issues an Ungermann-Bass "dump bridge forwarding table B" query using XNS protocol. 2 qualifier/LITTLE2_ENDIANI Specifies that the address should be scanned in an order where the lastI two address octets are considered to be in little-byte-first order, andF collectively are still the littlest bytes in the 6-octet add :ress; anJ example of such addresses are DECnet addresses. By default, the address J range is scanned by incrementing the addresses in pure big-endian order./LITTLE3_ENDIANI Specifies that the address should be scanned in an order where the lastI two address octets are considered to be in little-byte-first order, andF collectively are still the littlest bytes in the 6-octet address; anI example of such addresses are DEC bridge "serial number" addresses. By I default, the address r;ange is scanned by incrementing the addresses in  pure big-endian order.2 startaddressE The address of the first remote node to query, in any legal format  defined by ETHERMON. 2 endaddressC The address if the last remote node to query, in any legal formatE defined by ETHERMON. If this parameter is not given, it defaults to& the same value as the start address.ww@+GZՕ1 SAVEG Saves files of equivalence name definitions from the address, filter, or pro <tocol name tables. The command format is:& SAVE [/tabletype] [savefilespec]2 savefilespecD The name of the data file to be written from the ETHERMON run-timeC database. If the file specification is missing or incomplete, theB specification SYS$DISK:[]tabletype.ETH is used to supply missingC components. The output files are ASCII data, in a format suitableF for use by the LOAD command; the files may be edited, but the format? should remain the same to ensure that the LOAD= command works. 2 tabletypes /ADDRESSESA Specifies that the addresses table should be saved; this is the( default if no table type is specified./FILTERS3 Specifies that the filters table should be saved. /PROTOCOLS5 Specifies that the protocols table should be saved.wwHZՕ1 SET@ Modifies the attributes of internal data items in the ETHERMON utility. The command format is SET item-name value or SET item-name /qualifier >+ where the item-names are specified below.2 ADDRESS_NAMEE Adds new entries or modifies existing ones in the Ethernet address/E node name table. An Ethernet address (physical or multicast) may beG entered with an arbitrary text string (if the string contains blanks,C lowercase letters, or punctuation marks, it should be enclosed inG double quotes {"}). Note that, when enabled, additional address namesE may be entered automatically as ETHERMON analyzes received Internet8 ARP ?messages and similar node identification messages. The command format is5 SET ADDRESS_NAME physical_etheraddr name_symbol or9 SET ADDRESS_NAME physical_etheraddr "quoted string"3 physical_etheraddrF A standard 48-bit Ethernet address in Xerox standard display format,B i.e., of six 1- or 2-digit hexadecimal numbers, low byte first, F with the bytes separated by hyphens. For example: 12-34-56-87-AB-DD. 3 name_symbolC A name of up to 23 characters, contain @ing only letters, numbers, > dollar sign ($), and/or underscore (_). For example: VAX_10.3 quoted_stringD A string of text, begun and ended with double quote marks ("); theD quote marks are not included in the string itself, and quote marksE may not be used as part of the string. Only the first 23 charactersJ specified will actually be stored. For example: "My MicroVAX on TCP/IP".2 FILTERH Modifies an existing entry in the message filter database. The filter F can be enabled oAr disabled, and can change the protocol type, sourceG address, destination address, or a combination thereof for filtering. The command format is5 SET FILTER filter_num/qualifier [/qualifier...] or2 SET FILTER/SIZE=(sizeoption[,sizeoption...]) 3 filter_numG The identification number the filter was assigned when it was created with the ADD FILTER command.3 Command_Qualifiers/DISABLEA Specifies that the filter should be disabled; it may be enabled @ l Bater with the SET FILTER/ENABLE command. The default for a new filter definition is enabled./ENABLE@ Specifies that the filter should be enabled; it may be disabledA later with the SET FILTER/DISABLE command. The default for a new filter definition is enabled.$/EXCLUDE=(field=value[,field=value])B Specifies that messages that match the specified fields should beB filtered out and not used in the analysis. Any existing EXCLUDE'sB that are not specified here will not be changed. The fiCelds that  can be used are: ADDRESS=address! ADDRESS=manufacturer-prefix DESTINATION=address% DESTINATION=manufacturer-prefix6 MULTICAST (all destinations that are multicast)E PROTOCOL=aa-bb (where aa-bb is the hexadecimal protocol type) SOURCE=address SOURCE=manufacturer-prefix/NODESTINATIOND Clears any previously defined destination address filtering for the3 filter (whether it was EXCLUDE or ONLY filtering). /NOPROTOCOL> Cle Dars any previously defined protocol type filtering for the3 filter (whether it was EXCLUDE or ONLY filtering). /NOSOURCE? Clears any previously defined source address filtering for the3 filter (whether it was EXCLUDE or ONLY filtering).!/ONLY=(field=value[,field=value])@ Specifies that messages that do not match the specified fields B should be filtered out and not used in the analysis. Any existingC ONLY's that are not specified here will not be changed. The fields that can be useEd are: ADDRESS=address! ADDRESS=manufacturer-prefix DESTINATION=address% DESTINATION=manufacturer-prefix6 MULTICAST (all destinations that are multicast)E PROTOCOL=aa-bb (where aa-bb is the hexadecimal protocol type) SOURCE=address SOURCE=manufacturer-prefix"/SIZE=(sizeoption[,sizeoption...])B Specifies the new characteristics of the message size filter. TheE message size filter is independent of the set of message address andF protocoFl filters, and its effects are logically AND'ed with the other' enabled filters. The size options are:= DISABLE disables use of message size filter< ENABLE enables use of message size filter@ MAXIMUM=number sets new maximum message size (must be2 in the range 46 to 1500)@ MINIMUM=number sets new minimum message size (must be2 in the range 46 to 1500) 2 INTERVALD Sets the updatGe rate for the DISPLAY command. The command value isB the number of seconds between updates (initially defaulting to 4> seconds). The value must be in the range of 2 to 60 seconds. The command format is$ SET INTERVAL number-of-seconds2 KEYPADE Sets the functional mode of the terminal's numeric keypad to eitherE numeric or applications mode. By default, ETHERMON switches theF keypad mode to applications on start-up, and restores its state upon exit. The commanHd format is SET KEYPAD APPLICATIONS SET KEYPAD NUMERIC2 MANUFACTURERF Adds new entries or modifies existing ones in the Ethernet interfaceE manufacturer's table. The first three bytes of the Ethernet addressF identify a manufacturer; the manufacturer's name is displayed beforeD any other information that ETHERMON can derive about an address on the Ethernet. The command format is4 SET MANUFACTURER aa-bb-cc short-name long-name or= SET IMANUFACTURER aa-bb-cc short-name "quoted-long-name"0 where aa-bb-cc is the Ethernet address prefix. 3 short-nameI The short name of a manufacturer is a 8-character (max) prefix used for! the real-time DISPLAY commands. 3 long-nameF The long-name of a manufacturer is up to 28 characters in length andJ may be quoted to allow use of lowercase letters, spaces, and punctuation marks in the name. 2 MESSAGESB Enables or disables display of asynchronous "significant event" @ meJssages on the user terminal. By default, asynchronous event B messages can interrupt any output on your screen any time while C ETHERMON is running; they do not affect output redirected with an' ETHERMON command's /OUTPUT qualifier. The command format is SET MESSAGES ON SET MESSAGES OFFA SET MESSAGES DEBUG {to enable additional event messages}2 PROTOCOL_NAMEE Adds new entries or modifies existing ones in the Ethernet protocolA type/node name table. An K Ethernet protocol type may be entered ? with an arbitrary text string (if the string contains blanks,C lowercase letters, or punctuation marks, it should be enclosed in double quotes {"}). The command format is5 SET PROTOCOL_NAME ethernet_protocol name_symbol or9 SET PROTOCOL_NAME ethernet_protocol "quoted string"3 ethernet_protocolA A standard 16-bit Ethernet protocol number of two 1- or 2-digitB hexadecimal numbers, low byte first, with the byte Ls separated by hyphens. For example: 80-5B. 3 name_symbolC A name of up to 24 characters, containing only letters, numbers, @ dollar sign ($), and/or underscore (_). For example: STANFORD.3 quoted_stringD A string of text, begun and ended with double quote marks ("); theD quote marks are not included in the string itself, and quote marksE may not be used as part of the string. Only the first 24 characters$ specified will actually be stored.. For example: "Stanford V Kernel Mexperiment".wwSPZՕ1 SHOWD Displays status of various internal databases used by the ETHERMON utility. The format of the command is SHOW data-item6 where data-item is one of the names specified below.2 ADDRESS_NAMESF Displays the Ethernet address and name association table. This tableG is used to find symbolic meanings of source and destination addressesF specified in Ethernet messages. Addresses that have been seen on theG local Ethernet are m Narked with an 's' (source only), 'd' (destination= only), or 'b' (source and destination). Only addresses thatD are actually used are displayed unless the /ALL qualifier is used. The command format isG SHOW ADDRESS_NAMES [Enet-address] [Inet-address] [/qualifier ...]3 Enet-addressE Optionally, an Ethernet address can be specified (either the entireI address or only the manufacturer prefix) in the form aa-bb-cc-dd-ee-ff.A Any of the 6 (or 3, for manufacturer prefix only O) bytes can be E specified as hexadecimal numbers or wildcarded by an asterisk "*". D If no Ethernet address is specified, an address of *-*-*-*-*-* is assumed.3 Inet-addressB Optionally, an Internet physical address can be specified in theG form a.b.c.d. Any of the 4 bytes can be specified as decimal numbers I or wildcarded by an asterisk "*". If no Internet address is specified, G none is implied. Note that specifying an Internet address means that B only address table entPries that HAVE Internet addresses will be D displayed (since a node without Internet would always fail on the  address matching). 3 qualifiers/ALLE Specifies that all known addresses, not just ones seen as active onF the local cable, will be displayed (subject to restrictions of other parameters and qualifiers)./FULLD Specifies that, for each displayed address, all the protocol typesE spoken by that address will be displayed in addition to the address number and names. Q/OUTPUT[=filespec]F Specifies that the listing should be directed to the specified file.F By default, the listing is sent to SYS$OUTPUT, the user terminal. If@ the filespec is incomplete or missing, the default filespec is$ SYS$DISK:[]ETHERMON_ADDRESSES.LIS./PROTOCOL=aa-bbE Specifies that the listing should only include addresses which haveA used the specified Ethernet or IEEE 802 extended protocol type.B By default, addresses are displayed regardless of protocol types used R./SORT=sort-typeD Specifies the display sorting type. The default is /SORT=ETHERNET,C which sorts by physical Ethernet address; other options availableC include /SORT=INTERNET (sort by IP address; non-IP-speaking nodesK appear in internal storage order after all IP-using nodes) and /SORT=NONEG (also available as /NOSORT; displays addresses in internal hash table order). /TYPE=valueG Specifies that the listing should only include address which have the) attributes speci Sfied. The value can be:J 1) a hexadecimal number in the form %Xnnnn, where the numeric values I correspond to the internal binary flag codes used in the address D table (and seen as the Mxxxx: number in SAVE/ADDRESS files);J 2) one or more symbolic names of the flag bits. if more than one nameG is specified, the names must be separated by commas "," and the1 entire list enclosed in parenthesis "()". The symbolic type names are:< DECBRIDGET (%X00080) identified as DEC LAN Bridge8 DECNET (%X00008) running DECnet protocolsE DECSERVER (%x00100) identified as DEC LAT terminal server; DESTINATION (%X00004) node has been a destination> DNSSERVER (%X10000) node is an Internet DNS serverB IARP (%X20000) node's IP address confirmed by ARPE INETGATEWAY (%X08000) node is an Internet IP gateway/routerI INETNAME (%X00800) node has a symbolic Internet name UdefinedA INTERNET (%X00010) running DoD Internet IP protocolsK LAVC (%X00200) running DEC Local Area VAXcluster protocolsN LINE2ADDR (%X80000) primary address is port 2 on a two-port device; MACNUM (%X02000) running AppleTalk protocolsC MACZONE (%X01000) identified as AppleTalk zone router9 MOP (%X04000) running DEC MOP protocols? OTHERADDR (%X40000) node has two Ethernet addresses6 SOU VRCE (%X00002) node has been a sourceN UB (%X00020) node is running Ungermann-Bass (XNS) protocols= VITALINK (%X00400) identified as Vitalink bridgeE XYPLEX (%X00040) running Xyplex terminal net protocols 2 BRIDGESB Displays a list of all Ethernet bridges that were recognized andF identified by ETHERMON. Optionally, a map of bridge interconnections can be obtained as well. The command format is# SHOW BRIDGES [/qualifier ... W] 3 qualifiers/FULLC Specifies that, for each displayed bridge, all the protocol typesB spoken by that address, and all the adjacent bridges in the mostK recently computed bridge map will be displayed in addition to the addressJ number and names. Note that, if a new bridge has been detected since theE last use of the MAP command, a warning message will be displayed to- alert you that your map may be out of date./MAP[=filespec]J Specifies that a PostScript graphical map of X the bridged network should J be directed to the specified file, instead of generating tabular output.G By default, the listing is sent to the file SYS$DISK:[]BRIDGE_MAP.PS./OUTPUT[=filespec]F Specifies that the listing should be directed to the specified file.F By default, the listing is sent to SYS$OUTPUT, the user terminal. If@ the filespec is incomplete or missing, the default filespec is" SYS$DISK:[]ETHERMON_BRIDGES.LIS. 2 FILTERSE Displays the currently defined Ethernet me Yssage filters; the filterG number (used for SET FILTER and CLEAR FILTER), enable/disable status,H and the protocol type/source address/destination address (if used) and= associated matching state(s) are displayed for each filter. The command format is SHOW FILTERS2 KEYK Displays the current key definitions as defined by the DEFINE/KEY commandH (or predefined by ETHERMON). All defined keys will be displayed. KeysI with an asterisk (*) before their definition are per Zmanently defined byL ETHERMON and cannot be changed with the DEFINE/KEY or DELETE/KEY commands. The command format is SHOW KEY2 MANUFACTURERSG Displays the currently known manufacturer prefix codes and associatedH names. Codes that have been seen on the local Ethernet are marked withC an 's' (source only), 'd' (destination only), or 'b' (source and D destination). Only codes that have actually been used on the local< cable will be displayed unless the /ALL qualifier [is used. The command format is) SHOW MANUFACTURERS [/qualifier ...] 3 qualifiers/ALLI Specifies that all known manufacturers, not just ones seen as active on% the local cable, will be displayed./OUTPUT[=filespec]F Specifies that the listing should be directed to the specified file.F By default, the listing is sent to SYS$OUTPUT, the user terminal. If7 the filespec is incomplete or missing, the default is( SYS$DISK:[]ETHERMON_MANUFACTURERS.LIS. 2 MESSAGESH Di\splays the current setting of the SET MESSAGES command for enabling F or disabling output of asynchronous "significant event" messages to  the user terminal. The command format is SHOW MESSAGES 2 PERFORMANCEC Displays performance statistics of ETHERMON's internal operation. Command format:# SHOW PERFORMANCE [/qualifier] 3 Qualifiers/INTERVAL=delta-timeH Specifies the period of time the command will runs before it stops and C analyzes the data. Days may not] be specified; only hours, minutes,5 seconds, and hundredths of seconds may be specified. 2 PORT_STATUSF Displays the current status of ETHERMON's connection to the Ethernet interface.3 Command_qualifiers/ZEROB Specifies that, after the port counters are read, they should be zeroed.2 PROTOCOL_NAMESF Displays the Ethernet protocol type and name association table. ThisE table is used to find symbolic meanings of protocol types specifiedE in Ethernet messages. Protocol t^ypes specified with a preceding '*'C have been seen on the local Ethernet. Only seen protocols will be. displayed unless the /ALL qualifier is used. The command format is* SHOW PROTOCOL_NAMES [/qualifier ...] 3 qualifiers/ALLH Specifies that all known protocol types, not just ones seen as active ( on the local cable, will be displayed./OUTPUT[=filespec]F Specifies that the listing should be directed to the specified file.F By default, the listing is sent to SYS$OUT_PUT, the user terminal. If7 the filespec is incomplete or missing, the default is$ SYS$DISK:[]ETHERMON_PROTOCOLS.LIS.ww WZՕ1 SPAWNA Spawns a DCL subprocess to execute normal DCL commands, leavingF Ethermon collecting raw address and protocol data in the background. Format: SPAWN [command] 2 commandB A single DCL command may be executed by specifiying it after the@ SPAWN command. If no command is given, the subprocess enters a/ prompting mode unt `il the subprocess logs out.wwzYZՕ 1 SUMMARIZEG Tallies up the total number of messages found on the network for eachC address, protocol type, or whatever is being sorted for, over theH specified sampling interval. Samples are taken for the interval set byG the SET INTERVAL command (unless the /INTERVAL qualifier is used hereG to override), and then a report is generated, displaying the messagesF counts and associated identifiers sorted in decreasing message counta order. The command format is' SUMMARIZE group-type [/qualifier]2 DESTINATIONSB Specifies that the summary should be over destination addresses. 2 INTERNETG Specifies that the summary should be over 2nd level protocols used inE Internet IP (DoD) [06-00] protocol type messages. Additionally, for= TCP and UDP protocols, the active port numbers are counted. 2 PROTOCOLS; Specifies that the summary should be over protocol types.2 SIZES9 Specifies that the sbummary should be over packet sizes. 2 SOURCES= Specifies that the summary should be over source addresses. 2 STATISTICSE Specifies that the summary should be of general interface counters.2 Command_qualifiers/INTERVAL=delta-timeH Specifies the period of time the command will runs before it stops and C analyzes the data. Days may not be specified; only hours, minutes,5 seconds, and hundredths of seconds may be specified./OUTPUT[=filespec]F Specifies that the listing shoul cd be directed to the specified file.F By default, the listing is sent to SYS$OUTPUT, the user terminal. If7 the filespec is incomplete or missing, the default is SYS$DISK:[]ETHERMON.SUM.ww`[ZՕ1 TRACEI Collects messages received from the Ethernet into a file, as restrictedF by the currently enabled filter set. The TRACE command runs for the L period of time specified by the SET INTERVAL command, unless the /INTERVALB qualifier is specified with a different periodd. The file can be J recorded in either binary or printable ASCII format. The trace will only8 record data that passes the currently enabled filters. The command format is$ TRACE [/qualifier[/qualifier]]2 Command_Qualifiers/ABORTK Specifies that any running asynchronous TRACE should be closed immediately (repeating or not)./ANALYZER=imagenameH Specifies that the output data will be sent in real-time to an analyzerJ subprocess running the specified image. A VMS mailbox e created by ETHERMONH will receive the trace data in old ETHERMON binary format, and will be K defined as SYS$INPUT to the subprocess. The imagename is a filename ONLY; A filetype is .EXE, and the device and directory are those of the G ETHERMON.EXE image file currently being run. If not specified, output 4 is written to a file in old ETHERMON binary format./ASCIIJ Specifies that the output file will be in ASCII format. If not specified,+ the default is old ETHERMON binary format./B fINARYJ Specifies that the output file will be in old ETHERMON binary format. If : not specified, the default is old ETHERMON binary format./INTERVAL=delta-timeH Specifies the period of time the trace will run before it stops and theK collection file is closed. Days may not be specified; only hours, minutes,5 seconds, and hundredths of seconds may be specified./OUTPUT=filespecK Specifies the name of the output file; if not specified, the filename willJ be ETHERMON.DAT for old binary gformat, ETHERMON.LIS for ASCII format, andJ ETHERMON.SNIFFER for Sniffer format. If the /ANALYZER qualifier is used, G the filespec is given "as is" as the analyzer subprocess's SYS$OUTPUT K file, and defaults are interpreted by the analyzer image; by default, the F analyzer subprocess gets ETHERMON's SYS$OUTPUT as its own SYS$OUTPUT. /PARALLELL Specifies that an asynchronous trace will be performed, i.e. the trace willJ be started and control will return to the command prompt immediately, h notI waiting for the trace to complete. Messages will be sent to the terminal% when the trace starts and completes. /REPEAT[=n]J Specifies that a repeating asynchronous trace will be performed, i.e. theD trace will be started and control will return to the command promptH immediately, not waiting for the trace to complete. After the specifiedH interval, the trace file will be closed, a new file version opened, andG the trace continued. If the optional number is specified, it specifiesH i a version limit for trace files; versions older than (current - N) willK be deleted automatically as the trace proceeds. /REPEAT implies /PARALLEL.F Repeating is ignored if /ANALYZER is specified (although the parallel aspect is still used).B A repeating trace should be stopped with the TRACE/ABORT command./SNIFFERI Specifies that the output file will be in Sniffer binary format. If not 6 specified, the default is old ETHERMON binary format. /STATISTICSH Specifies that recording jstatistics should be printed at the end of theH TRACE session. Can be specified as /NOSTATISTICS. By default, /PARALLELF sessions report no statistics at completion, and synchronous sessionsI do report statistics. These qualifiers may also be used on a TRACE/ABORT: command to change the previously-chosen reporting option./TRUNCATE=maxlenH Specifies for a binary recording session that only the first N bytes ofJ the packet body should be recorded; all of the header is always recorded.F By de kfault, all of the packet body is recorded for every packet. ThisK option is useful to improve performance and save disk space when recording; large amounts of data where only the headers are required.2 File_formats3 ASCIIH The ASCII file contains three lines for each received and filter-passedE Ethernet message. The first line contains the VMS timestamp when theG message was received, the source and destination addresses in standardF ASCII-hexadecimal format, the protocol type (also A lSCII-hex), and theI message body's length in bytes. The second line is a hexadecimal dump ofG the first 40 bytes of the received message; the third line is the sameJ 40 bytes dumped in ASCII (with a space before each actual character, suchI that the ASCII characters line up under their hexadecimal bytes; periods+ are displayed for unprintable characters).I Preceding the dump lines is a single line reporting when the dump began.E Following the dump lines are three lines reporting when tmhe dump wasF completed, and the quantity of data bytes and messages processed from) the Ethernet before and after filtering.K The file has carriage-return carriage control and variable-length records.3 BinaryE The binary file contains one variable-length record per received andK filter-passed Ethernet message. A set of structure definitions for various languages are listed below. 4 FORTRAN STRUCTURE /BIN_REC/; INTEGER*4 VMS_DATETIME(2) ! quadword system timestampL n BYTE DESTADDR(0:5) ! beginning of XEDRIVER P5 buffer: dest addr9 BYTE SRCADDR(0:5) ! source Ethernet address UNION MAP8 BYTE PROTOCOL(0:1) ! Ethernet protocol type END MAP MAP: BYTE DSAP ! IEEE 802 destination SAP5 BYTE SSAP ! IEEE 802 source SAP UNION MAP6 BYTE CTL(0:1) ! IEEE 802 CTL byte(s) END MAP MAP< BYTE ECTL o ! IEEE extended 802 CTL byteK BYTE PID(0:4) ! IEEE extended 802 Protocol IDentification END MAP END UNION END MAPF END UNION ! end of XEDRIVER P5 buffer (20 bytes)8 INTEGER*2 LENGTH ! length of message bodyI BYTE BODY(4470) ! not all of this array may be sent; onlyG ! part actually used is written to file END STRUCTURE ! /BIN_REC/4 MACRO p $DEFINI REC= $EQU REC$Q_TIME 0 ; VAX/VMS binary timestamp? $EQU REC$B_DESTADDR 8 ; 6-byte destination address: $EQU REC$B_SRCADDR 14 ; 6-byte source addressB $EQU REC$B_PROTOCOL 20 ; 2-byte Ethernet protocol type9 $EQU REC$B_DSAP 20 ; 1-byte IEEE 802 DSAP9 $EQU REC$B_SSAP 21 ; 1-byte IEEE 802 SSAPD $EQU REC$B_CTL 22 ; 1- or 2-byte IEEE 802 CTL fieldG $EQU REC$B_ECTL 22 ; 1-byt qe IEEE extended 802 CTL fieldI $EQU REC$B_PID 23 ; 5-byte IEEE extended 802 protocol ID@ $EQU REC$W_LENGTH 28 ; word length of message body4 $EQU REC$T_BODY 30 ; body of messageB $EQU REC$K_MAXLEN 4500 ; maximum length of file record $DEFEND REC 3 SnifferG Sniffer format recording files are binary variable-length record filesG which are images of the raw network packets (minus the synchronization prologs and CRC trailrers). 3 AnalyzerG The input mailbox for an analyzer process receives its data in the old binary format (see Binary).wwaZՕ1 WAITB Causes ETHERMON to hang for a specified period of time, or untilD re-activated by another process. This is primarily useful in batchB jobs where the repeating mode of the TRACE command is preferred,B but where ETHERMON would exit when no longer given any commands.F The WAIT can be terminated before its specified end time by entering sA any keyboard character (for interactive mode use) or by issuingI a $WAKE service request at the process running ETHERMON. An appropriate= message will be output indicating how the WAIT was aborted. The command format is( WAIT delta-time [optional message]% WAIT FOREVER [optional message] 2 delta-timeE Specifies the period of time the WAIT will hang before it stops and F execution is resumed. Days may not be specified; only hours, minutes,5 seconds, and hundredths of seconds may be specified. 2 FOREVERF Specifies that the WAIT will only be terminated by outside action; if9 no outside abort is entered, the WAIT will last forever.2 optional messageD Specifies an optional string of text which will be displayed on theD standard output device (terminal or batch log file) before the WAITE begins. This is useful for ETHERMON script files, where the commands+ being executed cannot be seen by the user.ww