ethload user's guide.txt

黑客培训教程

       
       [ETHLOAD]
            drivername = ETHLOAD$
            bindings = MYMAC
       
       where MYMAC is the name of the MAC module you want  to  use.
       The  MAC  module name is what is between [] in  PROTOCOL.INI
       which  is  followed by a drivername= line with the  name  of
       the  device driver loaded in CONFIG.SYS (the name of  a  MAC
       module often ends with _NIF).
       
       You  also have to modify the [PROTOCOL MANAGER] entry to add
       a  dynamic  line.  But first try without  this  modification
       before modifying further your PROTOCOL.INI file.
       
       [PROTOCOL MANAGER]
            devicename = PROTMAN$
            dynamic = YES
            bindstatus = YES
            priority = ETHLOAD
       
       These  modifications do not modify the  usual  behaviour  of
       your  PC,  so you may leave these lines in your PROTOCOL.INI
       file even if you don't use ETHLOAD8.
       
       After you have made these changes, you must reboot your PC.
       
       After  this  reboot, when you want to use ETHLOAD  you  must
       issue the ETHLOAD command to the MS-DOS prompt.
       
       By  the  way,  the  Protocol Manager  directory  (containing
       NETBIND, ...) should be in the PATH of MS-DOS.
       
       Remark  1: in PROTOCOL.INI the case of the left part of  '='
       does  not matter, but uppercase characters must be  used  on
       the right part as indicated in the examples above.
       
       Remark  2:  the use of ETHLOAD should not be disruptive  for
       your  favourite protocol stacks, so you should not  have  to
       reboot your PC.
       
       Remark  3:  you  may  have  to run  READPRO  before  loading
       ETHLOAD  if  the  image  copy of PROTOCOL.INI  is  corrupted
       (i.e.  ETHLOAD  displays an error message like 'PROTOCOL.INI
       corrupted').
 
 4.4. Digital Equipment DLL.
       
       If  DLL.EXE  (or DLLDEPCA.EXE) is already loaded,  you  have
       nothing  to  do  before  starting  ETHLOAD  by  the  ETHLOAD
       command.
       
       Note:  in order to go promiscuous, DLL requires that ETHLOAD
       shutdown  ALL  connections: LAT,  DECnet,  ...  After  using
       ETHLOAD  you  probably will have to reset the  whole  DECnet
       protocol stack (so reboot your PC).
       
       Note  2:  it seems that at least for version 4.1 of DLL,  it
       is  impossible to run ETHLOAD in a DOS box within MS-Windows
       3.1.
 
 4.5. Packet driver.
       
       Packet   drivers   exist  for  nearly  all  known   Ethernet
       adapters.  There  even  exists  'packet  driver  shim'  that
       transform some other datalink drivers into a packet driver.
       
       You  have to use a software interrupt between 0x60 and  0x7F
       in order to let ETHLOAD run.
       
       ETHLOAD  will  use  the  first  packet  driver  found  while
       checking from interrupt 0x60 up to 0x7F.
       
       The  use  of ETHLOAD is not disruptive to your other network
       application  which  will  continue  to  run  at   very   bad
       efficiency...
       
       To  start ETHLOAD, just issue the ETHLOAD command to the MS-
       DOS prompt.
       
       Remark:  nearly all packet drivers can be found in  numerous
       anonymous  FTP  server including the Simtel repository.  For
       BITNET  users,  they  can  also be fetched  through  TRICKLE
       server.  The  Crynwr Packet Driver Collection is copyrighted
       using the GNU General Public License.
       
       Remark 2: for the 3Com 3C509 you should use version 11.*  of
       the Crynwr packet driver.
       
       Remark  3:  for  some packet drivers, you may  have  to  run
       PKTRCV with the mode 3 before running ETHLOAD, you may  even
       have to unload all programs using the packet driver...
 
 4.6. Loopback driver.
       
       This  driver  allows  to test ETHLOAD mainly  for  debugging
       purposes.
       
       It can be used also to check the start-up of ETHLOAD, ...
       
       To  use  this  driver, you must use options on  the  command
       line.
       
 
 4.7. File driver.
       
       This driver reads frames from an ASCII file. By default  the
       file ETHLOAD.IN is used but other files can be specified  by
       using parameters on the command line.
       
       Of  course,  the  input file format is compatible  with  the
       output  file  format of ETHLOAD used in  recorder  mode  and
       with ETHDUMP9.
       
       The format of the file is simple:
           -  empty  lines  or  lines  beginning  with  a  ';'  are
           ignored;
           -  else  line  consists of 2 decimal tokens followed  by
           the frame.
       
       The decimal tokens are:
           1)  a  time-stamp when the frame was received  expressed
           in MS-DOS ticks10 from the start of the recording;
           2)  the length of the received frame including the  FCS,
           this  length  may be different from the  length  of  the
           frame in the file.
       
       The   frame  itself  starts  with  the  first  byte  of  the
       destination  address  (excluding  the  preamble)  and   goes
       through  all fields: source address, Ethernet type  or  IEEE
       802.3 length, data bytes, ... For Token Ring, FA and AC  are
       also copied.
       
       Each  byte  is  represented  by two  contiguous  hexadecimal
       digits. Bytes can be separated by spaces, tabs and '-'.
       
       An example of input file is:
       
       0000000087  0060 000E20009127 0000E80109FC 0020 FF-FF-00-20-
       01-00-00-00-00-03-00-0E-20-00-91-27-40-05-00-B0-BB-1E-00-00-
       00-00-00-01
       ;
       0000000125  0060 00AA001E1FE4 000080CAC901 0020 FF-FF-00-20-
       01-00-00-00-00-03-00-AA-00-1E-1F-E4-40-05-00-00-02-01-00-00-
       00-00-00-01
       ;
       0000000141  0110 FFFFFFFFFFFF 00AA001E1FE4 0060 FF-FF-00-60-
       00-04-00-00-00-00-FF-FF-FF-FF-FF-FF-04-52-00-00-00-03-00-AA-
       00-1E-1F-E4
                                 
                               * * *
                                * *
                                 *
       

5. Command line options.
       
       In   nearly  all  configurations,  ETHLOAD  can  be  started
       without  specifying command line options. In some case,  you
       may  need  to  use  these  command  lines  options:  special
       datalink drivers configuration, few memory left, ...
       
       Command  line  option can be specified in  either  the  UNIX
       shell format:
           ETHLOAD -do1 -i65 -t
       or in the MS-DOS format:
           ETHLOAD /D:O1 /I:65 /T
       
       Case does not matter.
       
 
 5.1. Datalink driver: -d
       
       ETHLOAD  can  be  forced  to use a special  datalink  driver
       instead of trying to find automatically the best one.
       
       To use Novell ODI, specify: -do or /D:O
       To  use  Novell ODI with the MLID board 3, specify: -do3  or
       /D:O3
       To  use  Microsoft/3Com NDIS, specify: -dn or /D:N (you  may
       specify the MAC module to which ETHLOAD must bind)
       To use Digital Equipment DLL, specify: -dd or /D:D
       To  use Packet driver at first interrupt found between  0x60
       and 0x80, specify: -dp or /D:P
       To  use  Packet driver at interrupt 0xHH, specify: -dphh  or
       /D:PHH
       To use Loopback driver, specify: -dl or /D:L
       To  use  the  file driver (default filename is  ETHLOAD.IN),
       specify: -dffilename or /D:Ffilename
 
 5.2. Protocols to be analyzed: -p
       
       ETHLOAD  by  default analyzes all protocols.  This  requires
       both  more  memory  and  more processing  than  analyzing  a
       single  protocol. By using the -p option, you  can  restrict
       the protocols to be analyzed by ETHLOAD.
       
       To analyze DECnet, specify d after the -p.
       To analyze the TCP/IP protocol suite, specify i after the  -
       p.
       To analyze the OSI protocol suite, specify o after the -p.
       To analyze the TUBA protocol suite, specify t after the -p.
       To  analyze the XNS/NetWare protocol suite, specify n  after
       the -p.
       To  analyze the IEEE 802.2 LLC sublayer, specify l after the
       -p.
       To  analyze the Netbeui protocol suite, specify b after  the
       -p.
       
       By  specifying a digit after the -p, you specify the highest
       layer  to  be analyzed. E.g. -p3 will analyze frames  up  to
       layer 3 (e.g. no DECnet NSP, no TCP or UDP, ...).
       
       This  option  may  be  useful if you need  more  memory  (as
       ETHLOAD will allocate fewer tables for its operation) or  if
       you need more CPU power or time accuracy.
 
 5.3. Real time frame trace: -t
       
       ETHLOAD  can  display the very first bytes of  all  received
       frames in real time on the bottom line of the display.
       
       This  behaviour is set by using the -t option on the command
       line.
       
       Remark: in version 1.01, ETHLOAD always displayed the  first
       bytes of the packet.
       
 
 5.4. Slow/secure mode: -s
       
       ETHLOAD  works  by default in fast mode with  packet  driver
       and ODI.
       
       The  unsecured  (the  default) is defined  as  enabling  IRQ
       while  a  frame is analyzed. The disadvantage  is  that  the
       datalink  driver may be overloaded, but, the  big  advantage
       is that a lot of frames are neither dropped nor ignored.
       
       If  you want stability instead of accuracy, you may elect to
       use the -s option.
       
       By  using this option, ETHLOAD can see much more packets but
       may sometimes runs into problems...
       
       So,  this  option  should be set ONLY if  you  encounter  no
       problems  with ETHLOAD (PC that hangs, inconsistent display,
       ...) and you have a high percentage of lost packets.
       
       The  meaning  of  this  option is  different  for  the  file
       driver,  if  used with the file driver, ETHLOAD will  ignore
       the  timestamps in the file and receives all frames as  fast
       as  it  can  process them (so no frame will be  dropped  and
       this will go fast).
 
 5.5. Measure interval: -i
       
       ETHLOAD  measures  the load of the LAN at regular  interval,
       the  screen  is  also automatically refreshed  at  the  same
       rate.
       
       By  default,  this  interval is 5 seconds.  You  may  select
       another  measure/screen refresh interval  by  using  the  -i
       option followed by the number of seconds.
       
 
 5.6. Quiet Mode: -q
       
       ETHLOAD  normally  wait  for a  key  to  be  pressed  before
       actually  analyzing  frames so  you  can  read  the  startup
       information.
       
       If  you  want  to automatically start the analysis  you  may
       specify  the  -q  option in the command  line.  This  option
       could be useful in batch files, ...
       
       The  -q  option  will also suppress the line displayed  when
       loading dictionaries.
       
 
 5.7. Recorder mode: -r
       
       ETHLOAD  can also record all received frames into  an  ASCII
       file instead of analyzing them.
       
       Of  course,  this  file is compatible with the  file  format
       used by the file driver (-df).
       
       By  default,  the output file is ETHLOAD.OUT but  any  other
       valid name can be specified directly after the -r option.
       
       Please  note  that  only the first part of  the  frames  are
       recorded.
       
 
 5.8. LAN bandwidth: -b
       
       ETHLOAD  needs the LAN bandwidth to compute and display  the
       load.
       
       Generally, ETHLOAD can ask the datalink driver for  the  LAN
       bandwidth. But, for packet drivers and DLL drivers  this  is
       impossible and ETHLOAD defaults to 10 Mbps (i.e. Ethernet).
       
       The  -b option allows to specify the LAN bandwidth expressed
       in bit/s.
       
       E.g.  -b1000000  or  -b1.0E+6 will  set  the  bandwidth  for
       Starlan 1 Mbps LAN.
       
 
 5.9. Promiscuous override: -o.
       
       ETHLOAD  requires promiscuous mode to correctly analyze  all
       frames of the LAN.
       
       Not  all  LAN adapters and not all datalink drivers  support
       this  mode.  By  default,  if the promiscuous  mode  is  not
       supported, ETHLOAD does not start and exits immediately.
       
       Anyway,  you  might want to start ETHLOAD  and  analyze  the
       very  small  fraction of the LAN traffic which is  broadcast
       or  multicast.  If you want this, you have  to  use  the  -o
       option when starting ETHLOAD.
       
       Note:  if  your  LAN  adapter and  datalink  driver  support