Feature # 2: Capturing packets from multiple adapters

EtherPeek NX™

> ## Feature # 2: Capturing packets from multiple adapters

> #### Sampling network traffic in detail

> To capture packets in EtherPeek NX, you create a Capture window, set its parameters (including the adapter to be used by that particular Capture window), and click the Start Capture button. It's as simple as that.

> ### Start capture

> To create a new Capture window:

> 1. Choose New... from the File menu to open the Capture Options dialog.
> 2. In the General view of the Capture Options dialog, set the Capture title (name) of the new Capture window.
> 3. Set the size of its capture buffer or accept the default in Buffer size: ... kilobytes.
> 4. Use the Continuous capture section to determine how the buffer will be used during capture. When Continuous capture is unchecked, capture stops when the buffer becomes full. When Continuous capture is checked, use the radio buttons to Discard all packets when wrapping the buffer or Discard oldest packets first (use ring buffer).

> 1. Choose any supported Ethernet adapter from the list displayed in the Adapter view of the Capture Options dialog.
> 2. You can set any other options in the Triggers, Filters, Statistics Output, and/or Performance views, either when you first create the Capture window, or later, by returning to the Capture Options dialog for that window. Make the Capture window the active (frontmost) window and choose Capture Options... from the Capture menu to open the Capture Options dialog for an open Capture window.
> 3. When you have set the capture options, click OK to open the new Capture window.
> 4. Click Start Capture. You will see packets from your selected adapter processed and displayed in the new Capture window.

> ### Packets view

> In separate views, a Capture window provides many ways of looking at the traffic captured into that window. These views are accessible by clicking the view tabs across the bottom of the Capture window. For an overview, see "Capture windows and Packet File windows".

> The Packets view is the heart of a Capture window. The view has three optional panes: Packet List (a table showing all packets, each on a single line), Decode (showing a decode of the packet selected in the Packet List) and Hex (raw hex and ASCII contents of the selected packet). You can display any or all of these panes simultaneously by using the buttons in the Capture window toolbar.

> The statistics and information displayed in other views is based on the packets in the Packets view. Similarly, Select operations performed in other views actually take effect in the Packets view. The Select features, in combination with the Hide Selected Packets, Hide Unselected Packets, and Unhide All Packets commands from the Edit menu, are powerful tools for sophisticated analysis.

> The default Packet List shows data for each packet in the following columns: Packet (showing the sequential number assigned at capture, plus a Note icon if you have made a note on the packet), Source address, Destination address, a Flags column (showing packets flagged as errors, trigger packets, and so forth), packet Size (length in bytes), packet Protocol, the Relative Time of packet capture (relative to EtherPeek NX program start), a Summary column showing additional information provided about the packet by any enabled Analysis Modules, and an Expert column, logging information provided by the Expert Analysis features.

> Many other columns are also available. To add to or change the mix of columns, click in the column headings to open the Packet List Options dialog. To change column order, use drag and drop.

WildPackets, Inc.
http://www.wildpackets.com
Voice: (800) 466-2447
Fax: (925) 937-2479
sales@wildpackets.com