ethload user's guide.txt

黑客培训教程

       ETHLOAD user's guide                         40
                                 
                                 
       
                                 
                                 
                                 
                                 
                           ETHLOAD 1.04
                                 
                           USER'S GUIDE
                                 
                                 
                                 
                                 
                                 
                                 
                                 
                                 
                                 
                           A simple free
                                 
                  Ethernet load/problems analyzer
                         and events tracer
                                 
                                 
                                 
                                 
                                 
                                 
                                 
                             E. Vyncke
                                 
                         [e-mail]
                                 
                          16 January 1994
                                 

1. Introduction.
       
       ETHLOAD is a free software running on any MS-DOS PC with  an
       Ethernet controller.
       
       Currently,  ETHLOAD  supports  the  following  drivers  (for
       Ethernet and Token Ring):
         - Digital Equipment Corp. DLL specification;
         - Microsoft    3Com    NDIS   (Network   Driver    Interface
           Specification);
         - packet  driver as issued from PC/TCP, Clarkson  University
           or from the Crynwr collection;
         - Novell   ODI  (Open  Datalink  Interface)  if  the  driver
           supports promiscuous mode;
         - ASCII file containing Ethernet frames;
         - loopback driver (mainly for debugging purposes).
       
       The purposes of ETHLOAD are  twofold:
         - display  very  simply  non  accurate  numbers  about   the
           Ethernet load (number of frames/sec, bits/sec, ...);
         - display  important parameters, events and  loads  for  the
           TCP/IP, DECnet, OSI, XNS, NetWare and Netbeui protocols.
       
       ETHLOAD allows you to:
           -  check  simply the load of your Ethernet  (with  error
           rate, inter frame gap,...);
           - check which host is sending most of frames;
           - see which host is sending to which host;
           -  see  what  kind  of  protocols are  in  use  in  your
           Ethernet;
           - ...
       
       In a TCP/IP network, ETHLOAD allows you to:
           - see ARP table contents;
           - see which host is sending (un)resolved ARP probes;
           -  see the IP host which is sending most of the IP,  UDP
           or TCP packets;
           -  see what kind of protocols are in used (either TCP or
           UDP);
           -  see which is the mostly used telnet/rlogin server (or
           client);
           -  see  the boot sequence with important BOOTP and  TFTP
           events;
           -  see some characteristics of IP hosts (fragments size,
           MTU,   IP  retransmission,  options  used  --  including
           source routing, ...);
           - see main RFC 1001/1002 NetBIOS events and names;
           - see the working of DNS;
           -    see    important   TCP   events:   start/stop    of
           connections,...
       
       In a DECnet network, ETHLOAD allows you to:
           -  see  which node are sending/receiving most of  DECnet
           packets;
           -  see  all  Connect Initiate packets (including  object
           number, ...) ;
           - see returned packets;
           - ...
           
       In an OSI network, ETHLOAD allows you to:
           - see the top transmitter/receiver NSAP;
           -  see  what  happens  with TUBA (TCP  &  UDP  with  Big
           Addresses);
           -  see the exchange of information between ES and IS and
           between IS;
           -   see   important  events  for  the  transport  layer:
           connection/disconnection,   TSAP   are   displayed    in
           hexadecimal, ASCII and EBCDIC.
           
       In a Microsoft NetBEUI network, ETHLOAD allows you to:
           - see the main naming events;
           - see the connections and the datagrams.
           
       In a Novell NetWare network, ETHLOAD allows you to:
           - see the routers;
           - see the different XNS/IPX networks;
           - see the advertised services ;
           - see who is connected to who.
           
                               * * *
                                * *
                                 *

2. Miscellaneous and acknowledgements.
       
 
 2.1. Original copyright.
       
       This  software is based on the very first version of ETHLOAD
       I  have  developed while I was working in a  company  called
       Network Research Belgium. This version was already free  and
       in  the  public  domain  thanks to the  management  of  this
       company.
       
       Here  follows the copyright included in the source files  of
       about 0,1% of the current version of ETHLOAD.
       
       /*  This  software  and  documentation can  be  copied,  used,
       modified freely as long as:
       - the source contains this text
       -  this  software, documentation is provided  free  of  charge
       (but for the cost of media: paper, CD-ROM, ...).
       Network  Research Belgium and the individuals who have written
       this  software DO NOT ASSUME any responsibilities  in  respect
       to the use, (un)expected side -effects of this program.
       The  software  and  documentation is provided  as  it  is.  No
       maintenance will be given.
       Anyway,  we  would  be pleased to hear of  any  use  of  these
       softwares by email, fax:
               [e-mail]
               fax: [phone]
       Suggestions, modifications are always welcome.
       These  softwares have been developed by a special team  called
       BERT  in a company called Network Research Belgium located  in
       Herstal, Belgium, Europe .
       This team includes:
               Eric Vyncke, [e-mail] now [e-mail]
               Frederic Blondiau, [e-mail]
               Michel Ghys, now [e-mail]
               Marie-Christine Timmermans, [e-mail]
               Jean Hotterbeex, now [e-mail]
               Manu Khronis,   [e-mail]
               Vincent Keunen, [e-mail]
       */
       
 
 2.2. Current copyright and disclaimer.
       
       Right  now,  all  software developments are  made  home  and
       tested  after  working hours in my current company:  Siemens
       Nixdorf Informationsystems, SNI. So, here follows the  usual
       disclaimer:  Siemens  Nixdorf  and  NRB   are  by  no  means
       responsible  for  any good or bad effects of  this  program.
       And  by the way, the quality of ETHLOAD does not reflect the
       usual quality of NRB or SNI software.
       
       NRB,  Siemens  Nixdorf and the author do  not  support  this
       software  and are, in no case, responsible for any  bad  use
       or  any bad effect or any false result or anything caused by
       any version of ETHLOAD.
 
 2.3. Support.
       
       If  you  have problems to run ETHLOAD, please read carefully
       this  manual and also check the common pitfalls in  appendix
       A.4.
       
       The  UseNet  comp.protocols.tcp-ip.ibmpc  newsgroup  is  the
       right  place to state your problems, to comment on  ETHLOAD,
       ...  I'm  reading  this newsgroup every day  (together  with
       comp.sys.novell  and the BITNET mailing  list  about  NOVELL
       and  PATHWORKS).  This  if the preferred  way  to  get  some
       'support'.
       
       Anyway,  you can get some support from the author  since  he
       wants  to promote this software... You can reach the  author
       through       email:       [e-mail]1,        X.400:
       /c=be/admd=rtt/prmd=sni/o=siemens  nixdorf/ou1=liege/ou2=L1/
       ou3=D1/ou4=csl/g=eric/s=vyncke/ or by post mail:
       
         Eric Vyncke
         Rue Nolden, 25
         B-4432 Alleur
           Belgium (Europe).
       
       If  you are happy with ETHLOAD, my little son, Pierre, would
       appreciate  to receive any postcard (he is still very  young
       and still lives with us :-)!
       
       Due  to the large 'success' of ETHLOAD, I'm no more able  to
       reply  to  all questions or comments addressed to  my  email
       address...   So,  you  are  strongly  urged   to   try   the
       comp.protocols.tcp-ip.ibmpc newsgroup.
       
       In  no  case,  shall I answer to phone calls  at  my  office
       (except  for those of you who are working for a  company  of
       the  Siemens  group)...  Don't forget  that  I  am  paid  by
       Siemens Nixdorf and that I have a lot of work to do  at  the
       office :-)
 
 2.4. Distribution channel.
       
       I  have no access to internet, so I cannot place ETHLOAD  on
       anonymous  FTP  server, if you run  such  a  server  I  will
       appreciate that you reserved some place for ETHLOAD on  your
       BBS or anon FTP server...
       
       If  you  do so, please warn me by email in order to  keep  a
       list of distribution channels.
       
       Normally,   ETHLOAD   is   available   as   package   called
       ETHLDvrr.ZIP  (where  vrr are version and  release  numbers)
       from   the   Simtel  repository  (aka  oak.oakland.edu)   in
       /pub/msdos/lan            and            also             in
       ub4b.eunet.be:/pub/ub4b/network/msdos. A  companion  program
       called   ETHDUMP  is  generally  available  from  the   same
       locations under the name ETHDPvrr.ZIP.
       
       These  servers can be accessed by email via TRICKLE  servers
       on   BITNET   for  the  Simtel  repository  or   via   mail-
       [e-mail] (commands: help,  reply  <address>  and
       get ethld104.zip).
 
 2.5. Thanks to testers.
       
       I would like to thank anyone of you about his/her comments.
       
       I thank especially my beta-testers:
           Ralf Buettemeyer, [e-mail]
           Michel Dalle, [e-mail]
           Niels Kr. Jensen, [e-mail]
           Hans-Joachim Koch, [e-mail]
           Hans-Michael Pronk, [e-mail]
           A.A.L. Reijnierse, [e-mail]
           Frank Van Uffelen, [e-mail], [e-mail]
           
       I thank also for comments, suggestions, ...:
           Joe Doupnik, [e-mail]
           Knut Eckstein, [e-mail]
           Thomas Gasser, [e-mail]
           Derek Johnston, [e-mail]
           Ross Lazarus, [e-mail]
           Ted Llellewyn, [e-mail]
           Jos Minnema, [e-mail]
           Craig Morgan, [e-mail]
           Russ Nelson, [e-mail]
           Hugo Philips, [e-mail]
           Oliver Rehmann, [e-mail]
           Lars Scheffmann, [e-mail]
           Russell Thamm, [e-mail]
           
       And, all of you who have send a postcard :-)
 
 2.6. Changes.
       
   1.01:
       - support for packet driver, ODI and NDIS
       - support for TCP/IP
       - no more load graphics
       - dictionaries
       - bug correction in the length display
       -  porting from large model in Borland C to small  model  in
       Borland C++
       
   1.02:
       - bug correction in DLL support
       - documentation about copyright on packet drivers
       - dropped packets percentage in MAC screen
       - MAC flow screen
       - SMTP, TFTP and BOOTP support
       - Telnet/rlogin monitoring
       - options in command line
       - OSI support
       - improved DLL, ODI, NDIS and packet driver routines
       
   1.03:
       - use a local stack for all interrupt time routines;
       - add file driver;
       - support DNS, RFCNBIOS in TCP/IP;
       - add NetBEUI and XNS/NetWare supports;
       - improved display routines;
       -  NumLock  key for switching between numeric  and  symbolic
       display;
       - improved memory management;
       - port to large model C;
       - slight changes in DECnet presentation.
       
   1.04:
       - consider socket instead of packet types for Novell;
       - addition of TUBA
       - better OSI support (active network layers)
       - slight modifications in packet driver
       - add the -b option to specify LAN bandwidth
       - add the -f option to allow very trivial filtering
       - add the -m option to specify more buffers
       -  add  the -o option to allow partial work of ETHLOAD  even
       if promiscuous mode is not supported
       - remove the old -s (stack) option
       -  replace  the old -f (fast) option by a -s (slow)  option,
       the default is now fast mode
       - some IEEE 802.5 support (MAC frames, ring status, ...)
       - decode MSS option in TCP
       - decode IP options
       - add a dictionary for DNA objects
       -  ETHDUMP (the companion) can record short frames  (  <  14
       bytes) and can be put in quiet mode
       - the key '%' change top display percentage
       - length in recorded file now includes all headers and FCS