% VAX-11 Librarian V04-0010@;0]^5 PROBE@;01 PROBEK Probe is a network monitoring tool which allows the capture and/or displayJ of Ethernet traffic activity in real-time or the formatting of previouslyI collected data. Various filter combinaisons can be enabled to select theK traffic of interest for presentation. Sampling can be performed unattendedI (in batch for example) by setting a series of alternating collection and sleep cycles. Format: PROBE [adapter]G At least one of /DISPLAY, /RECORD o r /STATISTICS must be specified for network monitoring to occur.F Use /PLAYBACK to display a previously recorded network activity file.H Refer to the V22_RELEASE_NOTES topic for a summary of updated features. 2 ParameterH Specifies the name of the Ethernet adapter on the machine. If omitted,G Probe checks for the presence of the 'ETHERNET' logical name and usesG its equivalence string as the parameter value. Otherwise, Probe scansD the system configuration for one of the follow ing default devices:# ESA0 (Vaxstation inbedded class) ETA0 (BI class) EXA0 (XMI class) EZA0 (SGEC class) XEA0 (Unibus class) XQA0 (Qbus class)8 No parameters are allowed when /PLAYBACK is specified. 2 Qualifiers/ANALYZE /ANALYZE[=(attribute[,...])]I With /PLAYBACK only, specifies that a formatted dump of the sample fileH is required. The use of this qualifier makes it possible to process in. batch a previously recorded network session.H Optional attri butes specify the information to be interpreted from the3 recording file and a possible output redirection. CLASS=(class_type[,...])G Used to indicate which information within the recordingF file is of interest and should be interpreted. TypicalF use of these classes are for building reports intendedC for further external treatment (e.g. spreadsheets).& Available options are:F ALL Formats all recorded information.G If present, this option is treated+ first.H [NO]COLLISION Formats or skips recorded collision1 information.G [NO]CONTROLS Expands or bypasses control fields@ within significant records.D [NO]CYCLE_BREAK Formats or skips cycle boundary1 information.I [NO]DATA Formats or skips frame data contentsG if present in recording. The FRAME: class must be active.D [NO]FRAME Formats or skips ethernet frame; (envelop) information.F [NO]HEADER Formats or skips recording origin1 information.G [NO]TABLE Formats or skips recorded protocol: and node definitions.8 The default selected set of options are:% ALL,NOCONTROLS,NODATA OUTPUT=filespecF Used to redirect the output from the standard terminalF device to a file. The type .PRB_ANALYSIS is defaulted.G This qualifier is mutually exclusive with /DISPLAY. ! and /INTERFACE./DISPLAY /DISPLAY[=(attrib ute[,...])]D In record mode (see /RECORD), specifies that traffic data is to beF graphically displayed on a VT100 (or upward compatible) type screen.G The resulting histogram consists of global and node information which; reflects the traffic matrix of the local network segment.E The display area adapts to the actual terminal setting. The minimumD number of output lines required is dynamically determined based on7 the command given (the absolute minimum is 15 lines).C The fo llowing attributes can be specified to limit or enhance the& display of different network events.C INTERVAL=sec Specifies a display refresh interval in seconds. ByC default, the interval is 0.5 second (2 hz refresh).A Specifying larger values will lessen the CPU load@ on the host at the risk of overflowing the frameB and events input queues between updates, resultingC in statistics errors or lost information. Th e lowerA legend area shows to indicate the refresh interval.1 See also the /SCHEDULE qualifier.E PEAK Indicates that the peak measured load of a node is toE be displayed in subdued brightness behind the currentD node load value bar. The corresponding numeric valueC is shown in the right %LOAD column, below the 'max'E indication. Upon omitting this attribute, the defaultD behavior is to display the average load data and the! 'ave' indication.F The background segment load values displayed are basedF on the network peak activity regardless of the setting" of this attribute. SCALE=FULL HALF (default) LOGARITHMICB Specifies the load display scale. By default, HALFC is used, which yields a resolution of 1% over a 50%C  scale. A FULL scale yields a 2% resolution over theB full 100% load scale. This is useful under extremeE loads or when a strong asymetry exists between nodes.E A logarithmic scale is useful to better differentiateB nodes in small load conditions. Only one attribute! can be specified.D SMOOTHING[=%] Indicates that a given current node load value is toD be smoothed (filtered) prior to been displayed. ThisE can be used to reduce the effect of transient trafficD and make the display more stable/readable. The rangeE for this attribute is 1 to 99 with 1 corresponding toD the least amount of smoothing (most dynamic display)B and 99 making the display essentially static. WhenD this attribute is selected but the value is omitted,D the default smoothing value is 20%. The upper lege ndE area shows to indicate the level of smoothing being performed.D When this attribute is omitted entirely, raw data isD displayed (equivalent to 0% smoothing) and no legendF indication appears. Average or peak value computationsG are never affected by this attribute. Similarly, globalF load values are not smoothed. See the /TABLE qualifierC for information on h ow specific nodes can be set toC bypass this attribute so that their load values are always volatile.E THRESHOLD=% Specifies a load display activation level. This levelE is used for node display selection, based on the nodeF current (smoothed) value being greater or equal to theE specified relative setting. The higher the level, theD least likely a given node is to be displayable. ThisE  can be viewed as setting an activity "warning" level.@ A value from 1 to 50 must be specified with thisC attribute. See the /TABLE qualifier for information? on how specific nodes can be set to bypass this9 attribute in order to remain displayable.!F! In playback mode (see /PLAYBACK), the /DISPLAY qualifier is implied"! and all attributes are ignored.2 This qualifier cannot be issued from batch mode.; The merit of each node for display selection is based on: 1. Relative load:D The highest (smoothed) load is displayed first (on top). SmoothingE can be controlled on a node basis via the BYPASS attribute (see theG /TABLE qualifier) but instantaneous loading is always the first basis for comparison between nodes. 2. Threshold setting:G All nodes with loads under the given threshold level are rejected forH display unless the appropriate BYPASS attribute is set (see the /TABLE qualifier). 3. Priority:E The remaining nodes are ordered starting with those marked with theD PRIORITY attribute (see the /TABLE qualifier). Within the priorityF list, nodes are ordered based on instantaneous load. The 'multicast'A collection is permanently set with PRIORITY enabled by default.D The qualifiers /FILTER=DESTINATION and /FILTER=SOURCE also have anC effect on the display. Please consult the appropriate help topic./EXTRACT /EXTRACT=(criteria[,...)]C With /PLAYBA CK only, specifies conditions governing the selectionF of recorded data. This qualifier is used to scope down the amount ofG information which is to be processed, thereby optimizing manipulation performance. Possible criteria are: CYCLE=(identifier[,...])C Specifies a series of cycle numbers of interest forD analysis or display. Cycle numbering starts at 1 andE must be positive. Data within cycles not specified isD ignored. Similarly, requested cycles falling outside; of the recording actual bounds are ignored.!H! This qualifier is analogous to the EXTRACT command which can be givenH! during an interactive playback session from the PROBE> prompt or from0! the initialisation file PRB$PLAYBACK_INITIAL./FILTER /FILTER=(filter_class[,...])E Specifies conditions under which a given incoming frame is acceptedG or rejected for display or statistical cumulation. No filters are set F by default, which means that all traffic is collected and processed.F Setting a filter in a given class means that corresponding frames orA data are accepted and, implicitely, that frames or data falling4 outside the specified class boundary are rejected.E Note that file logging (see /RECORD) is independant of filter stateG i.e. all traffic is recorded for eventual analysis regardless of thisH qualifier. Moreover, global (minimum/maximum frame size...) values are/ always updated before any frame is discarded.$ The various filtering classes are: DESTINATION_ONLYG Destination-related data is collected. In display mode,G the most active destination nodes are shown and source-3 specific traffic data is discarded.F This class is mutually exclusive with the source class described below. FORMAT=frame_typeF Accepts frames based on their type. Either ETHERNET or8  IEEE_802_3 may be specified as keywords.G During execution, typing 'I' dynamically sets or resetsF the IEEE filter. Typing 'H' dynamically sets or resets$ the ETHERNET filter.G In display mode, filtering is shown as 'Ieee' or 'etHr'F beside the frame counter . Immediately below, opposite> symbology is shown beside the reject counter. C MULTICAST Accepts only multicast (broadcast) t ype frames. All; specifically addressed frames are rejected.D During execution, typing 'M' or '.' dynamically sets& or resets this filter.C In display mode, this filter is shown as the letterD 'M' (active) or the symbol '.' (inactive) beside the& protocol filter state. NODE=(name[,...])C Accepts frames based on their source or destinationD (restricted with the S OURCE_ONLY or DESTINATION_ONLYE classes) being within the defined name set. All other0 nodes are implicitely discarded.D Nodes are defined by name and address via the /TABLEC qualifier. Consult that topic for information about@ creating symbolic groupings or modifying display priority. PROTOCOL=(number[,...])E Accepts Ethernet frames based on their protocol. EachC ! frame matching one of possibly many active protocolD filters is kept. Other Ethernet frames are rejected.E IEEE frames are accepted unless specifically rejected* through the FORMAT clause.C The /TABLE qualifier is used to define all protocolC attributes, of which a unique numeric identifier isC used for filter association. Identifier notation is& assumed to be decimal.C " During execution, typing a single-digit hexadecimalE identifier number (1 through F) dynamically deselectsF an active or inhibited filter or selects a defined butF inactive filter. Typing '0' toggles protocol filteringE activity as a whole. This is useful when a new set ofD filtering conditions is to be prepared and activatedE at once. For filtering to resume, at least one filter/ #must be inhibited (on standby).G In display mode, defined protocol identifiers are shownE in the lower legend area. The corresponding number ofE all active filters are displayed immediately above onF the filter status line. Inhibited filters are shown as$ '-' (strikethrough).B SOURCE_ONLY Source-related data is collected. In display mode,G the most active source nodes are shown and destination- $3 specific traffic data is discarded.E This class is mutually exclusive with the destination& class described above.E In order to use keypad keys ('.' and kp1-kp9) during execution, theD keypad must be set to numeric mode. Illegal characters result in aE (series of) terminal bell. The inputs are discarded with no further' impact. In summary, valid inputs are:+ 0 collective protocol filters* 1-9 and A-F individual pro %tocol filter& H Ethernet format filter" I IEEE format filter M or . multicast filter/! X protocol filter logic reversalE Filters can be viewed as a way of imposing increasingly restrictiveD and overlapping selection criteria. By carefully choosing a filterF set, the user can view a small or more global portion of the networkF activity. In decreasing order of importance, filter class precedence is:+ 1. Format filter [ETHERNET | IEE&E_802_3]. 2. Multicast filter. 3. Protocol filter.- 4. Direction filter [SOURCE | DESTINATION]. 5. Node filter.D This qualifier is mutually exclusive with the /PLAYBACK qualifier.B! Refer to the FILTER command within the playback functional helpB! module, available during an interactive playback session at the@! PROBE> prompt. It is also possible to specify filters via the+! initilisation file PRB$PLAYBACK_INITIAL. !/INTERFACE! /INTERFACE=type!E! With /PLA 'YBACK only, specifies the terminal type. Valid types are:!! CHARACTER_CELLC! For standard VT100+/ANSI terminals or compatibles.C! This is the default. Subsequent commands are given/! via a DCL-like line interface.!B! XWINDOWS For Xterminals or workstations supporting the 'X'@! display protocol. This interface uses pull-down@! menus and other advanced facilities to simplify0! the user's (command-giving task. /PLAYBACK /PLAYBACK[=filespec]H Specifies that previously recorded traffic information is to be loadedH and, optionally, the file name that contains this data. The network is8 not accessed. The file name RECORDED.PRB is defaulted.K This qualifier cannot be invoked in batch mode unless used with /ANALYZE.G This qualifier is also mutually exclusive with /RECORD, /SCHEDULE andH /STATISTICS. Some other qualifiers or options are limited when used inJ the playba)ck context. No special privileges are required; file access is assumed.!F! Additional help information is available within the playback module! at the PROBE> prompt./RECORD /RECORD[=(attribute[,...])]I Specifies that sampled traffic information is to be saved to a file for1 later analysis. The following attributes exist:G DATA[=number] Used to indicate that each frame's data bytes are to beI recorded. This is useful with protocol analyzing softwareI * to track and decode messages. The quantity of significantG data bytes to record is a number between 1 and 1500, upF to the actual frame size. If omitted, 16 is defaulted. OUTPUT=filespecH Used to specify the file to contain the recorded, binaryH format, activity. When omitted, the file RECORDED.PRB is defaulted.I For network traffic sampling, the privileges ALTPRI, PHY_IO, PSWAPM andG CMKNRL are r +equired. Process quotas such as ast_limit, byte_limit andB buffered_IO may require a boost to cover for network peak loads.D This qualifier is mutually exclusive with the /PLAYBACK qualifier. /SCHEDULE /SCHEDULE=(attribute[,...])H Specifies an automatic monitoring schedule composed of one or multipleH repetitive cycles. A cycle begins by a standby (sleep) interval and isG followed by an active (monitoring) interval. The active interval mustE always be specified. A standby interva ,l must be specified when manyE cycles are required, it can be omitted or zero when a unique activeF interval is desired. If no schedule is specified, network monitoringF is performed continuously until externally stopped or until internalD counters overflow. To halt execution in interactive mode, enter ^ZG (generic exit) or press the space bar. This will override outstanding- cycles and immediately rundown the program. ACTIVE_INTERVAL=timespec@ Specifies a VMS delt -a time during which EthernetB activity is monitored. This attribute is mandatory@ and must evaluate to between 1 and 9999 seconds.> When in display mode (see /DISPLAY), the value? of this attribute is adjusted to the next valid@ multiple of the specified or implied "interval". CYCLE_COUNT[=number]> Specifies the number of cycle repetitions. TheA value can range from 1 to 32767 inclusiv .ely. WhenA omitted, the default value is 1, corresponding toB a single cycle. When specified, a standby interval' must also be specified. STANDBY_INTERVAL=timespecA Specifies a VMS delta time during which all ProbeC monitoring activities are suspended. The value mustA evaluate to a minimum of 1 and a maximum of 32767C seconds. An internal synchronization timeout periodA / is computed from this attribute and results in anA error condition when reached. Consequently, underB heavy network loads or when large statistics filesB are produced, it may be necessary to increase thisD value to allow for all outstanding internal activity to wind down.D This qualifier is mutually exclusive with the /PLAYBACK qualifier. /STATISTICS /STATISTICS[=(attribute[,...])]D Specifies that a 0 statistics report is to be computed at the end ofC each cycle (see the /SCHEDULE qualifier) or at execution rundown.! The following attributes exist: OUTPUT=filespecE Used to specify the file where reporting is to occur.F When a single cycle is performed and this attribute isF omitted, reporting is directed to the default terminalF device. When two or more cycles are specified however,B a file must be specifi1ed or statistics will not be@ produced. The file type .PRB_STATS is defaulted.!! REPORT=MATRIX! SEGMENT! SUMMARY (default)!G! Specifies the report type. The summary is a listing of1! global and protocol/node values.D This qualifier is mutually exclusive with the /PLAYBACK qualifier./TABLE /TABLE=filespecI Specifies a file containing protocol and/or node definitions for filterF associations (see /FILTER) or 2display formatting (see /DISPLAY). TheH file type .TBL is defaulted. Definitions within the file follow normalE DCL syntax rules (with no preceeding $) with the following commands being recognized: NODE 'Name'9 /ADDRESS= Hexadecimal_address (12 digits): [/DESTINATION= (processing_attribute,...)]5 [/SOURCE= (processing_attribute,...)]( Where valid processing_attributes are:I PRIORITY Selects thi 3s node (source or target)? for front of display list.E DISABLE Inhibits node (source or target)< processing and display.B BYPASS=(option,...) Bypasses the selected option:A SMOOTHING ...no smoothing calculation.> THRESHOLD ...no threshold limiting. PROTOCOL 'Name'; /IDENTIFICATION= Reference_number 4(1 to 15)4 /VALUE= Hexadecimal_number (2 bytes)F Line continuation (via the minus sign) is not supported. HexadecimalD representation must not include any separators or quotation marks.D Leading zeros, if any, can be omitted. Protocol and node names are truncated to 12 characters.H It is possible to specify a logical terminal device as a filename. TheI utility displays a 'Table>' prompt requiring the user to input node andI protocol definition commands. Since thes 5e commands are processed beforeE any filtering association is attempted, one can specify arbitrarilyI complex filter requirements on the fly without having to create a tableI file. Enough node and protocol definitions should be entered to satisfyI all filtering references. Prompting ends and the utility continues when" CTRL/Z is entered at the prompt.H Each protocol is identified by a unique number. No checks are made forG duplicated names or matching values. Similarly, nodes must 6 be definedH with unique addresses although their names may be the same. Since nodeH filtering is selected on a name basis, one could define many addressesJ within a symbolic class name and use that name in a filter specification to view class-wide traffic.E Protocol and node definitions are written to the recording file. OnI playback, any specified table file definitions will override equivalentI recorded information. This allows dynamic updates of table information.I This q7ualifier is required when /FILTER is specified with a protocol or node class. 2 Examples 1. PROBE/RECORD=OUTPUT=MYFILE6 Logging to file MYFILE.PRB for eventual playback.( No display nor statistics produced.* Filters would have been useless here.9 Cycles could have been used to automate the process. 2. PROBE/STATISTICS ETA0+ No logging. Adapter is DEBNT-A-I type.@ Summary statistics (on display) when stopped from keyboard. No interactive disp8lay.1 3. PROBE/RECORD/DISPLAY/SCHEDULE=(ACTIVE=0:5:0)3 Logging to RECORDED.PRB. No statistics report.7 Default display (average/nosmoothing/nothreshold).; 1 implied cycle, 5 minute activity, no standby period.D 4. PROBE/DISPLAY=PEAK/SCHEDULE=(CYCLE=5,ACTIVE=::10,STANDBY=:1:) -6 /FILTER=SOURCE/STATISTICS=OUTPUT=MYOTHERFILE4 No logging. Monitoring source information only.D Statistics to file MYOTHERFILE.PRB_STATS for 5 cycles, 1 minuteE wait follow 9ed by 10 seconds activity. Default display except for peak value.9 5. PROBE/DISPLAY=(SMOOTHING,THRESHOLD=5)/TABLE=CONFIG -C /FILTER=(PROTOCOL=(1,2,3,9),NODE=(MYVAX,ADAM,EVE,BIGONE))E No logging. The only frames considered will be to/from the nodesE named in the command line, as defined in the file CONFIG.TBL andB only for protocols defined in that same file with identifiersA 1, 2, 3 and 9. The only nodes displayed will be those with aE smoothed load : value of at least 5% of the global network traffic> except for those nodes defined with the BYPASS=THRESHOLD.C The following lines are typical of those found in a basic 'table' file:7 NODE ADAM /ADDRESS=AA0004000104/DESTINATION=DISABLE; NODE EVE /ADDRESS=AA0004000204/SOURCE=BYPASS=THRESHOLDC NODE MYVAX /ADDRESS=AA0004000A04/SOURCE=PRIORITY/DESTIN=PRIORITY# NODE BIGONE /ADDRESS=AA0004000B04; NODE SRV1 /ADDRESS=08002B012345 ! Some DEC box !D PROTOC ;OL DECNET /ID=1 /VALUE=6003 ! file transfers etc...C PROTOCOL LAT /ID=2 /VALUE=6004 ! lots of small framesE PROTOCOL LAVC /ID=3 /VALUE=6007 ! traffic similar to LATD PROTOCOL DUMP-LOAD /ID=4 /VALUE=6001 ! MOP remote operations> PROTOCOL APPLETALK /ID=9 /VALUE=809B ! MacIntosh stuff= PROTOCOL IP /ID=10/VALUE=0800 ! typically U*ix2 InterpretationC The following subtopics address the display and statistic outputs% data field <s and legend conventions. 3 DisplayG Use the following partial symbolic diagram and underlying information to identify display semantics:G ---------------------------------------------------------------------/ PROBE 2.2 ????????::@@@@@@@@ mmmmmmmmmmm RATE %LOADG fps cur/=== 0 10 20 30 40 50 60 70 80G Segment |----|----|----|----|----|----|----|----|-G (( Local )) RRRRR %%%/+++ |cccccccccccccppppppp =pppppppppppppppnnnnnnG Source |--T G NNNNNNNNNNNN RRRRR %%%/+++ |cccccccccccccppppppppppppppppppppppnnnnnnG NNNNNNNNNNNN RRRRR %%%/+++ |cccccccccccccppppppppppppppppppppppnnnnnn! Destination |--TG RRRRR %%%/+++ |cccccccccccccppppppppppppppppppppppnnnnnnG NNNNNNNNNNNN RRRRR %%%/+++ |cccccccccccccppppppppppppppppppppppnnnnnnG |----|----|----|----|----|----|----|----|-G >NODES....... SIZE.....byte 0 10 20 30 40 50 60 70 80G $$$$ of #### Maximum= hhhh Frames= xxxxxx etHr M Filters= 0__3___7___G CD= &&&/1000 Average= aaaa Reject= yyyyyy Ieee Protocols 123456789AF (iiiii)ttttt Minimum= llll Exit= Automatic @ (iiiii)wwwww+ssss [^Z |G ---------------------------------------------------------------------C $ probe/display=(interval=v,scale=full,threshold=T,smoothing=~) -B _$ /table=some.file /schedule=(cycle=i,standby=w,active=s) -; ?_$ /filter=(format=ethernet,multicast,protocol=(3,7))G ---------------------------------------------------------------------D 1. Numbers appearing besides the Protocol header are defined validC protocol identifiers. Numbers appearing besides the Filter header? are active protocols (0 is a fix reminder for global switch).F 2. The reject count is the total of all filtered and dropped frames.E 3. Nodes are sorted based on their interval load. Therefore, a nodeC transmitting or re @ceiving a large number of small frames could beC displayed below a node transmitting or receiving a smaller numberD of large frames if this node imposed a larger network load. Values4 in the rate column would then appear out of order.E 4. Displayed size is the physical frame size (i.e. data + envelop).G ---------------------------------------------------------------------7 a : average frame size {bytes}6 c : current value bar [bold]7 A h : high frame size {bytes}= i : cycle number {pure number}7 l : low frame size {bytes}> m : mode {symbol}[bold]8 N : node name (or address representation) {symbol}7 n : null [blank]8 P : protocol name {symbol}9 p : peak or average value bar [reverse]? R : absolute rate B {frames/second}9 s : timer activity setting {seconds}> T : threshold mark [bold diamond]9 t : running time {seconds}9 v : display refresh interval {seconds}9 w : timer standby setting {seconds}8 x : frames processed {frames}8 y : frames rejected {frames}8 ? : host name C{symbol}8 @ : adapter name {symbol}8 = : rage or imum legend {symbol}= $ : active node sublist size {pure number}= # : node list size {pure number}= & : collision factor (*1000) {pure number}= % : network utilisation load percentage {pure number}= ~ : smoothing percentage {pure number}= + : average or maximum relative load {pure numberD} 3 StatisticsG Use the following partial symbolic diagram and underlying information" to identify statistic semantics:G ---------------------------------------------------------------------2 PROBE 2.2 STATISTICS Elapsed time: d dd:dd:dd.ddG Segment Node::Device Rate(hz) Load(%) CD(/kf)G (local) ????????::@@@@@@@@ Max: ++++ +++ +++G Min: ---- --- ---G E ----Size-----G Category Frames Multicst Bytes Ave Min MaxG Ethernet: xxxxxxxx ffffffff bbbbbbbb aaa lll hhhG IEEE 802.3: xxxxxxxx ffffffff bbbbbbbb aaa lll hhhG Total: xxxxxxxx ffffffff bbbbbbbb aaa lll hhh8 Filtered: yyyyyyyy yyyyyyyy bbbbbbbb Dropped: zzzzzzzzG ----Size-- F---G Protocols # Frames Multicst Bytes Ave Min MaxG PPPPPPPPPPPP p xxxxxxxx ffffffff bbbbbbbb aaa lll hhh . .G PPPPPPPPPPPP p xxxxxxxx ffffffff bbbbbbbb aaa lll hhhG -Max--Ave- ----Size-----G Nodes Rate %Load Frames Bytes Ave Min Max NNNNNNNNNNNNG S: rrrr %%% xxxxxxxx bbbbbbbb aaa lll hhhG D: <_p_p_p_p_p_p_|IEEE> Grrrr %%% xxxxxxxx bbbbbbbb aaa lll hhh . . G -: <_____________|____> 0 0 0 0 0 0 0G D: <_p_p_p_p_p_p_|IEEE> rrrr %%% xxxxxxxx bbbbbbbb aaa lll hhhG ---------------------------------------------------------------------G 1. A frame is considered filtered only if both direction data is lost as a result of some filtering.F 2. A frame is dropped if either the listener or the data manager areH unable to pass control o Hf the intermediate queue to the other process.G 3. The 'S' and 'D' node entry headers identify source and destinationA statistics. A strike-through indicate node direction filtering.F 4. Numbers appearing besides the node direction headers and enclosed9 with <|> are protocol/type hits on this node direction.E 5. Shown size is the physical frame size (i.e. data + envelop). The( playback size format is data/physical.G ------------------------------------------------------------------ I---7 a : average frame size {bytes}7 b : overall byte count {bytes}; d : elapsed time {VMS delta}8 f : multicast frame count {frames}7 h : high frame size {bytes}7 l : low frame size {bytes}8 N : node name (or address representation) {symbol}8 P : protocol name {symbol}= p : protocol identifier J {pure number}? r : last interval absolute rate {frames/second}8 x : processed frame count {frames}8 y : rejected frame count {frames}8 z : dropped frame count {frames}8 @ : adapter name {symbol}8 ? : host name {symbol}= % : network utilisation load percentage {pure number}= - : generic minimum {pure Knumber}= + : generic maximum {pure number} 2 FootnotesA The following subtopics may interest the technical or otherwise inquisitive user.3 Ethernet_basicsB Ethernet as it is now known was developped by Xerox, Digital andF Intel in the mid 70's. It was later modified slightly and adopted by' the IEEE under the 802.3 appellation.E Ethernet is a bus network based on a 50 ohms cable and operating atF 10 Mbps (millions bit per second). The ori Lginal specification calledD for a 500 meters (maximum) coax over which up to 100 taps could beG made. Over the years, many other cable implementations have appeared,; for example thinwire, twisted pair and even fiber-optics.B Ethernet's digital signaling uses Manchester encoding (mid-cycleF transition in the direction corresponding to the bit value). ChannelF access is arbitrated by a distributed probabilistic method, known asC Carrier Sense Multiple Access with Collision Detection ( MCSMA/CD).F Using this method, a station is free to transmit if the cable is notB being used. If two stations transmit simultaneously, a collisionD occurs. Each station, after having transmitted a jam signal, stops? and waits a random interval before attempting retransmission.C On Ethernet, information is transmitted in frames. All frames are% composed of the following elements:4 1. Preamble - 64 bits used for synchronization.@ 2. Destination - 48 bits unique address identify Ning the targetA machine or a multicast code which will trigger* all listening machines.@ 3. Source - 48 bits unique address identifying the origin machine.E 4. Protocol - 16 bits frame type identifier. This interpretation? is only valid in the Ethernet specification.D Length - In the 802.3 specification, the protocol field isD replaced by the data (next field) size, in bytes.E 5. O Data - the actual information transmitted. This field can@ be between 46 and 1500 bytes long. Padding isB performed on small (less than 46 bytes) frames.D 6. FCS - 32 bits frame check sequence used to validate theA frame contents and detect transmission errors.E The Ethernet specification guarantees a minimum time between framesE equivalent to 12 bytes of silence. Probe does not include the fixedE preamble field nor P interframe gap sizes into its frame calculationsE but does consider their impact when calculating network utilization values.3 Program_conceptD 1. The Probe utility is made up of 4 modules named PROBE, ACQ, DMSD and REPLAY. Module PROBE is the overall controller, responsibleC for command parsing, set-up, scheduling (timer based) and user" interaction during recording.D Module ACQ is spawned from PROBE and is responsible for networkF monitoring and file loggi Qng. It is aynchronous and respond solely to network inputs.D Module DMS is also spawned from PROBE but runs synchronously upD to twice per second (depending on user selection). It maintainsD statistics and performs all display functions during recording.A Module REPLAY performs all aspects of playback and analysis.D 2. All 3 recording modules run at an elevated, real-time, priorityB level and are internally synchronized and interlocked throughC event flags and R special instructions. Data sharing is done viaB global sections. Some privileges are required, especially for the ACQ module.A Module REPLAY is a single stream interactive application and$ requires no special privileges.3 Performance_issuesB 1. This utility is designed to benefit from multiprocessing withA up to 3 processors. For minimum penalty in single and diadicB CPU configurations, all monitoring fonctions are asynchronousB except for statistics cum Sulation and display refresh features, which require a CPU on a regular basis.C In single processor system under heavy ethernet loading, thereD is a likelihood of display refresh slippage. This is due to theA priority given to data collection over display functions. AsE the load lessen, the display should catch up. Normal interactiveD users will probably notice a response time degradation in theseF cases but should otherwise be minimally impacted by this utility. TC To prevent display IO output queue buildups and important lagsD in the perceived response, it is recommended to use the highestD baud rate available to the terminal and to refrain from holdingB the screen (XOFF). Consider also the fact that various scalesC will fill the screen in different proportions (the worst beingC logarithmic, the best being full (100%) scaling). ThresholdingE and smoothing can be moderately useful in decreasing the display IO load Uing.B 2. Monitoring modules are foremost optimized for speed. IO's areC internally buffered and transmitted in 1 large chunck for bothC display and file recording functions. Statistics output uses aC RMS record-oriented approach. This is more convenient and doesB not impede on real-time activities as statistics are producedB during standby periods only. However, sufficient time must be0 given to the statistician to resynchronize.E There is a definite advanta Vge (static node block initialisation)B to preloading node addresses via a table file. Also, considerC defining more active nodes first in the table. This is becauseB node information is accessed through a hashing process. Nodes@ with identical hash keys (based on hexadecimal address) areA linked in a first-come-first-serve order. A very active node@ located at the end of a hash chain incurs additional search0 overhead compared with the chain head node.@ 3. The W likely limiting factors for a given system when runningA Probe will be a mixture of ethernet adapter capacity and CPU2 configuration (number of engines and rating).B In a real world situation on a VAX 6430 with 50 active users,E network loads of 30% (peak) are handled with little user impact.D A VAXstation 3100/76 (DECwindows terminal emulation) can handleD an offered load of about 1500 frames per seconds with some leftD over capacity. CPU utilization is about 5 X0% interrupt/kernel atE that time, with ACQ consuming the largest part of the remainder.= At times, the display refresh (DMS) can be seen lagging.3 Read_this_alsoA 1. To prevent subprocesses control losses, DCL level interruptsD (CTRL/C and CTRL/Y) are disabled by Probe. In display mode, theC user should avoid CTRL/T as it may affect the screen layout in unrecoverable fashion.? 2. In display mode, the output device is automatically set to@ NOWRAP, NOINS YERT, WHITE-ON-BLACK. It is not returned to itsC original state (if different) upon rundown. The keypad must be7 set to numeric mode to allow filter manipulations.A 3. The recording file produced by ACQ is seen by RMS as a fixedE record organisation. Each record is identified by a leading typeB and, as appropriate, subtype. Except for the introduction andE filling records (types 1 and 3 respectively) which are always atE the beginning of file, there is no guarante Ze of chronologicalityD in the data stream except when at most 2 logging streams exist. 4. Relevant SYSGEN parameters:A MAXBUF... Probe will attempt to use as many display lines as? possible within a given page size (as defined byA SET TERM/PAGE) up to a computed value based on theA largest single refresh IO that is permitted by theC system. The default VMS value is normally acceptableA for most display te[rminals but newer VT400 devicesD or workstation type screens may benefit from a boost.2 V22_Release_notesC The following is a list of changes made since PROBE version 2.1B: 1. New functionality/syntax: o /ANALYZE o /EXTRACT o /PLAYBACK o /RECORD=DATA& 2. New dynamic filtering key inputs: o Protocols A to F.* o Format H (ethernet) and I (802.3). 3. Revamped statistics layout:> o New header; additional informa\tion and clearer format.D o Protocol statistics are now cumulated regardless of protocol filtering state./ o Node statistics are now sorted by name.C o Protocol hits displayed separately for each node direction.5 o IEEE hits maintained for each node direction. 4. Revamped display layout:0 o New counter and status field placements.! o Interval value now shown. 5. Internal enhancements:G o The default statistics sample interval is au ]tomatically changedF to 1 second when display is inactive. This allows more precise rate calculations.E o New/hidden protocol block (0) for unmatched frames statistics cumulation.G o Even though the display/statistics reported "size" value is theG total frame size (i.e. including envelop ), theG logger "size" correspond to the payload (significant DATA, i.e.E with padding removed when known) size. A new field is definedH for carrying IEEE type overhead information. This was documentedH in version 2.1B but the code was not implemented. The new replayG module displays both the logical (i.e. data) and physical (i.e. total frame) sizes.ww