# EtherPeek NX 2.1 Readme

Welcome to EtherPeek NX for Windows!

This file includes important, updated information for users of EtherPeek NX for Windows. The information is more current, in some cases, than that provided in the User Manual or Online Help files. Please read this information carefully.

## Installation Notes

If you are upgrading from an earlier version of EtherPeek NX, you should remove it before installing this release. The installer can do this for you automatically. To manually remove EtherPeek NX, open the "Add/Remove Programs" control panel, select the program and click the "Add/Remove" button. Any files created after installation, including free plug-ins downloaded from our website, may need to be deleted manually. If you've installed the capture driver in the Network Control Panel, uninstall it from the Network Control Panel and reboot.

## Uninstallation Notes

To remove EtherPeek NX, open the "Add/Remove Programs" control panel, select "WildPackets EtherPeek NX 2.1" and click the "Add/Remove" button. All files created during the installation will be removed, however you may need to manually delete the EtherPeek NX folder to remove files created after installation. If you've installed the PEEK capture driver in the Network Control Panel, uninstall it from the Network Control Panel and reboot. If you installed the special WildPackets error capture driver for one of the supported ethernet cards, you may need to reinstall the vendor-provided adapter driver.

## Product Documentation

Please read the EtherPeek NX QuickTour for an overview of the features of EtherPeek NX. The Online Help is available from the Help menu within the program. A pdf of the User Manual, with full descriptions of the features and functionality of EtherPeek NX, can be found in the Documents directory in the 1033 folder under the directory in which you installed EtherPeek NX. The Peek SDK folder is also available in this location. (Note: Demo and Eval versions of EtherPeek NX do not contain a pdf of the User Manual or the Peek SDK folder.)

## New EtherPeek NX Features and Enhancements

- Improved Statistics Output reporting, including more CSV row reports and the ability to schedule new file sets

- Improved Monitoring and Graphing support
- Improved protocol identification (ProtoSpecs engine), with ability to identify tunneled protocols
- New Decode and Notes Columns
- Ability to save TCP/UDP/RTP data streams to a file
- More network statistics
- Performance enhancements, including the Capture Performance Options to selectively disable components
- User configurable memory usage options
- Side-by-side packet decode and hex view
- Friendly warning dialogs
- Repeat Mode Triggers

## New Expert Diagnoses and Enhancements

- Updated Expert Settings, now ordered by OSI layer

- EAP Authentication failure
- HTTP Client Error, 4xx errors
- HTTP Request Not Found
- HTTP Server Error, 5xx errors
- DNS Non-Existent Domain
- DNS Server Error

## New/Improved Packet Decoders

- Improved AppleTalk

- Improved NCP
- Improved PPP
- Improved TNS
- MS Exchange (MAPI)
- Megaco Text
- Tazmen Sniffer Protocol (TZSP)
- Autocol
- GARP/GVRP/GMRP
- GPRS/GTP
- Rapid Spanning Tree (RSTP)
- Simple Service Discovery Protocol (SSDP)
- TALI (SS7 over TCP/IP)
- TKIP - WPA/SSN
- LDAP - GSS
- BACnet - Building Automation and Control Networks
- Line Printer Daemon (LPR/LPD)
- VOIP - Q.850, H.245
- WAP/WTP/WSP
- IP Mobility
- Yahoo Messenger
- MSN Messenger
- MMS/ICCP
- Improved MPLS
- Router-port Group Management Protocol (RGMP)
- iSNS
- Cisco Group Management Protocol (CGMP)
- ISDN Q.921-User Adaptation (IUA) layer protocol
- Stream Control Transmission Protocol (SCTP)
- Kerberos 5 gss-api
- Secure IMAP traffic
- Ethernet PAUSE control frames
- Fibre Channel (FCIP)

## New/Improved Packet List Summaries

- Improved NCP summaries

- SCTP

## Technical Tips and Additional Product Information

1. Recommended system requirements

   Minimum - 600 MHz processor, 256 MB RAM
   Recommended - 1.7 GHz processor, 512 MB RAM
   Windows XP (Service Pack 1 or later) or
   Windows 2000 (Service Pack 3 or later)
   Microsoft Internet Explorer 5.5 or later required

2. Windows XP and Windows 2000 users need appropriate permissions to load/unload device drivers and to capture packets

   If permissions are insufficient, you may see a message that the adapter could not be opened. It is best to solve this problem by using an account with administrator privileges to capture packets with EtherPeek NX. If you need to allow non-administrative users to capture packets, you can install the Peek driver module into the Network Control Panel. This will allow non-administrative users to capture packets with EtherPeek NX. See the Peek Driver module Readme for installation details.

3. EtherPeek NX and error packets

   EtherPeek NX provides the ability to capture error packets only by installing one of the special drivers located in the "Driver" directory where you installed the program. To use these special drivers, you must have a compatible network adapter and a supported operating system configuration. Please refer to the "Readme.htm" file located in that directory. If you do not have a special driver installed, EtherPeek NX does not capture error packets but does provide the ability to report errors on your network if your NIC driver returns error statistics to EtherPeek NX. EtherPeek NX can provide statistics on these two error types currently: CRC error and Frame Alignment error (Runt and Oversize error packets are only available using the special driver). If your network adapter driver does not report error statistics, you may notice that error counts don't change in the Network Statistics window.

4. Bad checksum messages on outgoing packets

   This may be caused by a setting in your network card. If the machine sending the packets is also the EtherPeek NX machine, the checksums may appear incorrect if the hardware is also calculating TCP checksums. Turning off hardware TCP checksums in the driver solves this problem. Check the properties on your network card. Look for the checksum offload setting (possibly in the Advanced tab) and disable it. We are working to resolve this issue in future product releases.

5. Analysis Module compatibility

   The WebStats Analysis Module, as well as other modules purchased/downloaded separately and older custom plug-ins using versions of the plug-in API prior to version 6 are not compatible with this version of EtherPeek NX. You will get a message that "...the plug-in failed to load. This might be due to a mismatched API..." To eliminate getting this message, delete the incompatible DLL files from the Plugins folder where EtherPeek NX was installed. Contact the vendor of the plug-in for an updated version.

6. RMONGrabber remote RMON-compliant packet capture

   RMONGrabber is a separately purchased Analysis Module that extends the reach of "Peek" products by allowing for packet capture from an RMON-compliant probe. Version 1.0 of RMONGrabber is not compatible with EtherPeek NX 2.1. You will need RMONGrabber version 1.1.

7. Graph Improvements

   Modifications to the default graphs may not be seen if you have a previous installation of EtherPeek NX unless you import the default graphs from the Graphs folder where EtherPeek NX was installed.

8. Incompatible with "Large Fonts" settings

   If the text in windows captions appears truncated or windows are cut off, you may have "Large Fonts" enabled. Return the setting to "Small Fonts" to correct this problem. Change the "Font Size" setting by clicking the "Advanced" button in the Display Control Panel's "Settings" tab.

9. Chart FX Properties Dialog

   The Chart FX Properties dialog contains many charting options unavailable in other EtherPeek NX dialogs.

   - Colors for individual statistics in a multiple-statistic graph
   - Color and weight of border lines
   - Width and shape of bars (bar chart only)
   - Grid lines and tick marks for X and Y axes
   - 3D depth, angle, and perspective
   To see the Chart FX Properties dialog, double-click the chart area of any graph in the Graphs tab of a capture or file window. The Chart FX Properties dialog contains bugs. The dialog makes available many options that have no effect on EtherPeek NX graphs, such as Color Palette. Other options such as Cluster/Z-Axis have temporary effect, lost as soon as you switch to another graph, or exit EtherPeek NX. Some options freeze or crash EtherPeek NX, such as Color Scheme.
   To minimize the potential for lost capture data, WildPackets recommends setting up graphs before capturing critical data. Set up your graphs while capturing sample data, or while working with saved packet files. Once your graphs are set up, avoid the Chart FX Properties dialog during critical capture sessions.

WildPackets, Inc.
1340 Treat Blvd., Suite 500
Walnut Creek, CA 94597 USA
(925) 937-3200
http://www.wildpackets.com/support/contact
Copyright © 1989-2003 WildPackets, Inc.
All rights reserved.