contents
wPktSpy
Version 1.0

An ethernet IP traffic analyser for windows,
working with packet drivers.

Let's see who is working on your network !!!.

Program Features.

Information

Copyright

Program installation

Working with wPktSpy

Open/Close

Configuration

Statistics


Features

wPktSpy is a 16 bits windows program which records basic information about the IP traffic on
your ethernet network.
With wPktSpy you can measure a server load or record a trace of all the IP packets which travel thru your ethernet network (check your security !!!).
 Information is recorded in a text file typically named report.txt.
Here is a fragment of such a file :

wPktSpy v1.0 (c) Pascal Urien 1996
(12:55:06,73) 424 records FramesCt= 30865 BytesCt= 5512821
* Type* IP Address SA * IP Address DA *Ptcol* Port*   Count  *  Bytes   *
  0000 000.000.000.000 000.000.000.000 00000 00000 0000005325 0000733163
  0800 130.182.013.013 130.182.051.068 00017 00000 0000000002 0000000205
  0800 130.182.013.015 130.182.051.068 00017 00025 0000000003 0000000334

The following informations are recorded :

*Type : the type of an ethernet packet, a 16 bit hexadecimal value
0000 means ISO or not a recorded type
0800 means IP
0806 ARP
8035 RARP
....
*IP address (SA), the IP SA if " in order option" is selected, otherwise the smallest IP address included in the packet.

*IP address (DA), the IP DA if "in order option" is selected, otherwise the highest  IP address included in the packet.

*Ptcol, the protocol (a decimal value) encapsulated in the ethernet packet
0000	not a recorded type
0001	ICMP	internet control message
0002 	IGMP	internet group multicast
0003 	GGP	gateway to gateway protocol
0005	ST	stream
0006	TCP	transmission control protocol
0009	IGP	interior gateway protocol
0011	NVP	network voice protocol
0012	PUP	parc universal protocol
00 17	UDP	user datagram protocol
0020	HMP	host monitoring protocol
0022	XNS-IDP	xerox internet datagram
0027	RDP	reliable data protocol
0028	IRTP	internet reliable transaction
0029	ISO-TP4	iso class 4 transport
0030	NETBLT	bulk data transfer

Port, the smallest port number(a decimal value) of the packet is protocol is equal to 6 (TCP) or 17 (UDP).
A port may be associated to a specific application (service).
0000	not a recorded value
0021	ftp
0023	telnet
0025	smtp
0043	whois
0053	domain
0079	finger
0101	hostname
0109	pop2
0110	pop3
0119	nntp
0512	exec
0513	login
...

*Count, the number of packets

*Bytes, the number of bytes.


Information

Any additionnal information about wPktSpy can be found at:
http://ourworld.compuserve.com/homepages/UrienP/pktspy.htm

Any suggestion can be sent to the author
100666.2766@compuserve.com


copyright
http://ourworld.compuserve.com/homepages/UrienP/pktspy.htm

For any suggestion or information, mail to
100666.2766@compuserve.com
wPktSpy  version 1.0
Copyright ©1996 Pascal Urien
 All Rights Reserved

wPktSpy  version 1.0
Copyright ©1996 Pascal Urien
 All Rights Reserved

The information provided is provided as is, without warranty of any kind, either expressed or implied,including but not limited to the implied warranties of merchantability and fitness for a particular
purpose. In no event shall Pascal Urien be liable for any damages, whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Pascal Urien has been advised of the possibility of such damages. This program executable, help file and related text files may be distributed freely. It may be used without fee by any individual for non-commercial use.This version of wPktSpy may not be distributed as a part of any commercial package without permission.


Installation

Ethernet components

Before running wPktSpy  you need three components:
- an ethernet (802.3) adapter board.
- a packet driver, which drives your ethernet card.
- the winpkt.com utility.

A packet driver is a low level network access program that you can get for any ethernet adapter. Such a program is a Terminate and Stay Resident DOS program (TSR). Usually it's invoked in the autoexec.bat file by a command line which looks like:
pktdriver Packet_Vector [interrupt_number io_address memory_address], Packet_Vector is an hexadecimal number between 0x60 and 0x7F, parameters between[ ] are optionnal.

Example: 3C503.com  0x62 0x3 0x310 0xD000
3C503.com is the packet driver name
0x62 is the Packet_Vector
0x3 is the interrupt_number
0x310 is the io_address
0xD000 is the memory_address.

To access this packet driver from window, you need  an interface which is named WINPKT.COM. WINPKT is installed under DOS by the command line:
wpktcom Packet_Vector

Example : winpkt 0x62

If your autoexec.bat includes lines like:
pktdriver Packet_Vector
wpktcom Packet_Vector

you are ready to use wPktSpy !!!.

N.B: you can install you packet driver using the -w option, if you don't have the winpkt.com utility (example, pktdriver -w 0x62).

Installing pktplug.exe - version 2.0

pktplug.exe is a DOS Terminate and Stay Resident (TSR) program which is included in the wPkSpy package. Before running wPktSpy  you must install this TSR using the command line:
pktplug Vector, where vector is an hexadecimal number between 0x60 and 0x7F.
The  recommended value is 0x6A.

Example: pktplug 0x6A.

You can add this line in your autoexec.bat file.

wPktSpy  detects if pktplug has been installed, futhermore it detects all the installed packet drivers.
So if you are already using a packet driver, the only command to be executed under DOS before running wPktSpy  is :

pktplug Vector. (typically pktplug 0x6A).

N.B
The size of pktplug.exe v2.0 is 73 Ko. Version 2.0 is an extension of v1.0 which is used by wPktPlot.


openclose
Open - Close

Using wPktSpy.

When packet filtering parameters are set, press the CONNECT button to start the packet recording. A report file is periodically generated. The button DISCONNECT stops the packet recording. The SAVE button forces the generation of a report file.

Packet Filtering.

*Type
Packet whose type is less than "Type" are recording. Type is expressed in hexadecimal, 0800 means IP only.

*IP Address Filter
IP packet can be sorted with four conditions,
IP source address only, only the source address is recorded.
IP destination address only, only the destination address is recorded.
IP SA and DA in order, the order SA DA is used for sorting.
IP SA and DA without order, IP address are sorted the smallest IP address first.

*Protocol
Protocol whose number is less than "Protocol" are recording. This value is expressed as an hexadecimal number. FFFF means all protocol, 0000 means no protocol recording.

*TCP or UDP port.
When a transport protocol is used (either TCP or UDP) the Port value may be associated to a specific application. Packet whose port value are less than "Port" are sorted. Port is expressed as an hexadecimal value (3F means 127, 3FF means 1023 ...).

Other Functions.

*Report File.
A report file is periodically generated. The time period is expressed in second. The file is alternatively named 0report.txt and 1report.txt.

*Frame Rate.
This parameter specifies the maximum frame rate that you want to sort. Its value depends from your PC configuration. I think that 500 is a good value for a SX33, 1000 for a DX266 or P75, 2000 for a P133 ...

*Packet Vector
Select a particular ethernet card.

*Save
This button is used to generate a report file typically named report.txt.

*Cancel
This button is used to leave the dialog box without performing any operation.

*Disconnect.
Disconnect wPktSpy from the packet driver.

*Connect
Connect wPktSpty to the packet driver. A line with three fieds is generated each second.
First field : number of sorted records.
Second field :  number of sorted frames
Third field : time left before saving the report file.


configuration
Configuration.

This dialog box is used to save the wpktplug.ini file.
Same parameters are not defined in the Open/Close dialog box.

Refresh: value is expressed in millisecond, 20 ms is a typical value.
A sort is generated by wPktSpy each Refresh time.

FileName: the report file name.

KoSize: the maximum number of records expressed in 1024 unit. 2 means 2048 (2.1024=2048) and is a typical value. Maximum value is equal to 30.

Typical dump of wPktSpy.ini

[wPktSpy]
Vector=6a
Refresh=20
Speed=1000
RefreshFile=60
FileName=report.txt
TypeMax=FFFF
IpFiltering=3
ProtocolMax=FFFF
PortMax=003F
KoSize=2


Statistics

This box displays information about the ethernet load.

Packet Received: number of packets received and sorted.

Packet Lost: number of packet not sorted, because the load was too heavy.

Records: number of records.