NetXRay 2.0.5 Release Notes _______________________________________________ NetXRay README FILE NetXRay Version 2.0.5 (C) Copyright 1995, 1996. Cinco Networks, Inc. All rights reserved. ______________________________________________ This file includes important and updated information for users of NetXRay. The information in this file is more up to date than the manual. Some notes are uniquely applied to Win 95 or NT only. Please read them carefully. ________________________________________________ Special Upgrade Note for Existing NetXRay Users ________________________________________________ 1. The new NetXRay includes some new 32 bit graphical DLLs which are not compatible with the old NetXRay 1.13, or 1.2.0 releases. It is recommended that you should un-install your current NetXRay first, then re-install the latest NetXRay 2.0.5. Please refer to your NetXRay User's Guide regarding how to un-install NetXRay from Windows 95 or NT. 2. NetXRay driver NETXRAY.SYS for NT has changed. This version of the NETXRAY.SYS (2.04) is no longer compatible with the older NETXRAY.SYS. You must follow the steps as outlined in the manual or this README file Section 4 to un-install old NETXRAY.SYS completely before attempting to re-install NetXRay. Otherwise, you may encounter GPF trap when you run NetXray. 3. If you are an existing NetXRay Beta test user for trial versions (post 1.2.0) of the NetXRay software, please delete NetXRay.INI file which is located under Windows 95 or NT directory. If you fail to remove the beta version of the NetXRay.INI, the following symptoms may occur: ú During NetXray startup, a dialog message such as this may be displayed: "C:\Program Files\CincoNet\.....\31e5a500\netXRay.nab contains an invalid path." And you may fail to open your address book. ú Or when you are trying to define a new capture setting profile, you may encounter this dialog warning: "Can't Open Setting File to Write". ________________________________________________ Bug Fixed in 2.0.5 ________________________________________________ 1. The last packet captured in the buffer is truncated by 14 bytes, and may cause GPF in rare occation. ________________________________________________ Bug Fixed in 2.0.4 ________________________________________________ 1. Display filter for Token Ring address did not mask out the source routing bit in the source address field. It is fixed now. 2. Abort a packet capture transfer during stop and view operation may cause the Distributed NetXRay Console GPF. It is fixed. 3. New NDIS drivers: DC21X4.SYS: Supporting CRC, Runt, Oversize, Jabber error counters. Tested: SysKonnect's SK-8520 10/100 PCI card. NE2000.SYS: Supporting CRC, Runt, Oversize error counters. Tested: Linksys NE2000 ISA card. Tested: Cnet: ISA card, model # CN650Eplus, and CN600Eplus. Tested: Cnet: PCMCIA card, model # CN40BC. The new drivers: NE2000.SYS, and DC21X4.SYS are located under cinconet\netxray\driver of your NetXRay directory. To install in Windows 95 environment, 1. Install adapter card following manufacturer's setup instruction. 2. Power up your PC, and let Win 95 discover the new adapter card. 3. In Dialog Box `New Hardware Found', Check the radio button `Select from a list of alternative drivers', click OK. 4. In Dialog box `Select Hardware Type', select Network Adapter from the list box. click OK. 5. In Dialog box `Select Driver', If you have DEC 21140 compatible card, select Digital Equipment/PCI Fast Ethernet DECchip 21140 based adapter. If you have NE2000 compatible card, select Novell/Anthem: NE2000 Compatible Click OK. 6. Follow instruction prompted by Windows 95 to complete te installation. 7. Make sure that your network access is functional via the newly installed NIC adapter. 8. Rename your adapter driver under Win95\system (for NT is WinNT\system32\drivers) directory. The file name for DEC 21140 card is DC21x4.sys The file name for NE2000 card is NE2000.sys. 9. Copy appropriate NetXRay supplieddriver located under Cinconet\Netxray\driver to Win95\system (for NT is WinNT\system32\drivers) directory. 10. Re-boot PC. ________________________________________________ Bug Fixed in 2.0.3 ________________________________________________ 1. Maximum Threshold values for Ethernet 100Mbit, and FDDI are now permitted for theoratical maximum values. 2. In SNMP decode, if an OID value spans more than one octet, NetXRay decoded incorrectly. It is fixed. 3. Frame padding in TCP/UDP decode was included in data portion. It is now separately counted in a different field. 4. Added NLSP option field decode. 5. If packet capture is in progress, and use exits NetXRay. GPF will occur. It is fixed. 6. F1, and Help Button will launch Help. ________________________________________________ Enhancement added in 2.0.3 ________________________________________________ 1. The Dashboard Detail Statistics can now be exported To export detail statistics, place mouse cursor over the Dashboard. Click the right hand mouse button to bring up the context menu, then select the Export.. 2. Header text are now added to Host Table, Matrix Table, and Protocol Distribution exported CSV files. 3. Novell Name Learning has been added to the address book The ability to add User Login name and its associated hardware address has been included in Address book name learning feature. NetXRay will also learn the file or print server names. To start Novell Name Learning, follow these steps: 1. Click Auto Discovery button on the Address Book window. 2. Click the Any Novell address on the network radio button. Click OK. 3. A small modeless dialog will show you the discovery in process. Every time NetXRay see a Get Nearest Server request, NetXRay will attempt to capture the server name and its hardware address and save it in the address book. 4. Next, you will need to login onto a Netware Server from your PC, enter the command: USERLIST /A NetXRay will extract the login user names and hardware addresses, and save them into the address book. 5. If you wish to add additional user names from another server, repeat step 4. 6. To stop the discovery, click the Cancel button on the modeless dialog box. Note: We may want to perform this name learning several times until you have learned everyone who belongs to this network domain. 4. Real time decode display during Capture is added Caveat: Real time decode can not keep up with high level of pack rates in the network. The rate it can view packet decode is entirely depends on the type of NIC card and driver used and the CPU speed. We strongly recommend that capture filter be set so that the actual packet rates can be reduced. To enable real time decode, go to Tools/Options, check Realtime Display in Decode option. Click OK to close the dialog box. When you start the packet capture, a separate window will be pop-up to show the packet summary in real time. This window can be closed without affecting the packet captured in the buffer. 5. Packet Decode window hex pane display can now be highlighted and cross referenced to field in the detailed pane. When you click and select a field in the detail pane, the corresponding hexadecimal octets is highlighted in the Hex pane. The newly added feature now lets you do the reverse. By selecting a group of hexadecimal octets, you can view the corresponding protocol field in the Detail pane. 6. The Dashboard Packet/sec dial scale has been changed to show up to 1 million packets/sec 7. Capture Buffer now allows up to 192M bytes Capture Buffer requires the specified amount of RAM to be allocated to NetXRay as non-swapable memory. Care must be taken to make sure that you have enough memory before assigning a large capture buffer size. For example, if your PC has 64 M bytes of RAM with Windows 95 running, this leaves you about 52 M byte of free memory in the PC. Do not assign capture buffer size > 52 M. Also when you decode a large capture file of multi mega bytes, NetXRay will require additional buffer space (RAM) for the decode results. To save memory space, it is recommended that you turn off the background decode mode. To turn off background decode, go to Tools/Options, un-check Background in Decode option. Click OK to close the dialog box. ________________________________________________ Bug Fixed in 2.0.2 ________________________________________________ 1. Undersize frame originated from this station is counted in dashboard and host table. Since short packets sent by this station are looped back by NDIS driver without proper padding to minimum 60 bytes, they have been erroneously counted as undersize runts frame. This version no longer counts them as runt frames. 2. In Find packet, when user select Don't Care in `From' field, and choose a new `Format' other then the default Hex, the offset field is cleared to blank. Thus prohibiting Find Next to start. 3. If user chooses capture buffer wrap when full, and also select packet slice option, the captured packet buffer will cause GPF when viewed. 4. In rare cases, NetXray windows positions were saved in-correctly in NetXRay.ini file. It causes GPF during the invocation of NetXRay. This bug is now fixed. 5. TFTP is now properly decoded. ________________________________________________ Enhancement added in 2.0.2 ________________________________________________ 1. The Dashboard high water mark is added A high water mark number is added in dashboard to show the highest level activity ever recorded. The numeric window now show a pair of numbers; the left on is the real time value, and the right one the high water mark. 2. UDP and TCP checksum values are verified. Erroneous check sum value is flagged, and correct value calculated. ________________________________________________ Bug Fixed in 2.0.1 ________________________________________________ 0.1 IP Address truncated in Decode Summary printout 0.2 Find Next, or Filter Data Pattern hex editing allowed only one character input. 0.3 Multicast packets are not counted in Dashboard, or Host table. 0.4 Occational, an IP address in reversed format is shown in IP Address Auto Discovery. 0.5 GPF occurred sometimes during IP address auto discovery. 0.6 Remove a statistics filter caused GPF in NT. 0.7 Decode for IP checksum may cause GPF, if the packet is too short. ________________________________________________ Enhancement added in 2.0.1 ________________________________________________ 0.8 Maximum Host and Matrix Table size is now user configurable To change the maximum table size, edit NETXRAY.INI located under Windows 95 or Windows NT directory. Add the following section for Host table [HostTableOptions] MaxNumNode=nnnn nnnn is the number of nodes less than 10,000 Or add the following section for Matrix table [MatrixTableOptions] MaxNumNode=nnnn nnnn is the number of nodes less than 10,000 Caution: The table size may affect the performance of the NetXRay monitoring. Do not make the table size unnecessarily large. 0.9 SMB decode is enhanced to meet the latest NT specification. 1.0 SNMP decode view allows user to see consolidated one-line summary in var-bind list. 1.1 SMB over Banyan VINES is added. ________________________________________________ Information ________________________________________________ 1. The new 2.0.0 Functions Not Documented in the User's Guide 1.1 The Console now supports multiple work space This function allows user to launch multiple copies of NetXRay with each one monitoring a separate probe. To launch a new NetXRay, ú Go to Programs, then Click NetXRay icon. An Adapter dialog box is shown. ú Click New Probe button to bring up a New Probe dialog box. ú Enter description, select Local Probe radio button, then click OK. Optionally, you can copy a work space setting for the new probe from the existing probes. Click open the combo list box and select an existing probe as the source to copy from. A probe's work space setting includes the address book, capture filter setting, packet display options, update frequency, alarm thresholds. ú Now select an adapter which is not being monitored by another NetXRay session., Click OK. If you are a network support personnel maintaining multiple sites, the multiple work space feature lets you maintain separate address book, and other setting for each site conveniently. Since every time you create a new probe, NetXRay sets up a separate directory to maintain another copy of the address book, capture filter setting, packet display options, update frequency, and alarm thresholds. To use a different setting, simply go to Tools, and click the Select Network Probe/Adapter to bring up the Adapter dialog box. Then Open the Local Probe of your choice, and select a network adapter. Click OK. 1.2 Three new buttons added to Address book: Undo: reverse the last action, typically a delete action. Redo: reverse the last Undo. Auto Discovery: Auto learn IP address, and its associated Hardware address and DNS name. The learned address and DNS name are added to the address table. If a duplicated IP address is found to be associated with a different hardware address, an entry is entered in the alarm log, and an audible alarm is sounded. Auto Discovery also supports the learning of NetBIOS name and its associated Hardware address from the network. The learned address and NetBIOS name are added to the address table automatically. To support NetBIOS name auto discovery, you must install and enable NetBEUI protocol in your PC. To properly learn IP addresses and DNS names in your network, you must understand the role of IP routers and gateways in your network. Since router carries traffic from other subnets to your local segment where NetXRay resides, its hardware address will be associated with any IP node address that has passed through the router. This router characteristics makes the IP address auto discovery process difficult if user does not manually identify the router in the address book first. The key is to enter your IP network routers' IP address, hardware address, and domain name in the address book first, and select the node type as Router. The proper steps to perform IP address and DNS name discovery are listed below: 1. Click Auto Discovery button on the Address Book window. 2. Click the Range (IP Address) radio button, enter the local subnet address where NetXRay is monitoring. Click OK. 3. A small modeless dialog will show you the discovery in process. When the search is finished, The dialog box will be removed. 4. Next, identify your routers in your subnet. Double click the router entry, select type as Router. Repeat this step for all the routers. This step must be performed, otherwise an IP node outside of you subnet will be entered into the address table with a duplicated router hardware address. During the discovery, NetXRay will first ping to an IP address to resolve the hardware address first. It ping is successful, the resovled hardware address is entered in the address book. The IP address itself will be entered into the name field. It then sends a DNS request to the Domain Name Server to obtain the name entry for this IP address. If one is found, the DNS name will be entered to replace the name field. Once you have identified the local nodes and the routers, you can optionally use NetXRay to monitor and attempt to resolve any IP node's domain name. To do this, follow these steps: 1. Click Auto Discovery button on the Address Book window. 2. Click the Any IP address on the network radio button. Click OK. 3. A small modeless dialog will show you the discovery in process. Every time NetXRay see a new IP address, it will attemp to learn the IP's domain name. If name is not found the IP address is dropped, and not entering in the address book. 4. To stop the discovery, click the Cancel button on the modeless dialog box. Note: Auto discovery function makes use of Microsoft TCP/IP ICMP.DLL. If you have not installed Microsoft TCP/IP, Auto Discovery will fail with an error message displayed. 1.3 The update frequency of each individual monitor windows can be configured. To modify update frequency, click Tools/Options..., select General page. Then make necessary changes. 1.4 Minor enhancement to capture data pattern filter option: To toggle an operator between AND and OR, simply click the operator icon. To turn on or off the NOT operator, simply click the operator icon. 1.5 NetXRay Probe Auto Launching function is not available in NT version. To auto start NetXRay Probe add it to the NT start up group. 1.6 Network Errors are now supported for NE2000 compatible NIC and DEC 10/100 chipset 21140 based NIC cards. See updated note in the beginning of this release note. 1.7 Support Packet Capture hot link directly from Matrix and Host table NetXRay adds a hot link that you can launch packet capture between 2 stations directly without going to capture filter setting to define the address pair first. To launch the capture from matrix window, 1. Click and select the address pair of you choice. An arrow marker will be shown pointing to the selection. 2. Click the right hand mouse to bring up the context menu. 3. Select Capture. The capture is started with address filter defining the hardware address pair plus the `Default' filter applied. The capture window is shown with capture in progress. The same NetXRay hot link is also available in Hot Table. The function is identical to the matrix table hot link except the 2nd address of the address pair is replaced with `Any'. 1.8 Create Address Filter directly from Matrix and Host table NetXRay adds a hot link that you can create address filter directly from within the Matrix Table. To create address filter from matrix window, 1. Click and select the address pair of you choice. An arrow marker will be shown pointing to the selection. 2. Click the right hand mouse to bring up the context menu. 3. Select Create Capture Filter. The capture filter setting window is shown with the selected address pair filled in the address filter. 4. Click Ok to save the new filter setting. The same NetXRay hot link is also available in Hot Table. The function is identical to the matrix table hot link except the 2nd address of the address pair is replaced with `Any'. 1.9 Mark Packets in Decode Window for Separate Viewing or Saving NetXRay lets you mark individual packets, or group of packets in the summary pane of the packet viewer into a separate decode window. To mark a packet: Simply click the check box in front of the index number. To mark a group of packets: Click the right hand mouse button, and select the Mark Range... function. Click Range radio button, enter packet range Click Mark button To clear all marked packets: Click the right hand mouse button, and select the Mark Range... function. Click All nnn Packets radio button. Click Unmark button To mark all packets except a few un-desired packets Click the right hand mouse button, and select the Mark Range... function. Click All nnn Packets radio button. Click Mark button Scroll the summary pane to locate the un-desired packets. Click the check box in front of the un-desired packets to de-select it. Once you have marked the packets, you can 1. Save the marked packets into a new decode window by selecting `Saved Marked..' from the context menu. Or, 2. Use the marked packets as `Book Marks'. Use F2 key to advance from one marked frame to another. 1.10 Apply Pre-Filter to Network Statistics Monitoring NetXRay lets you apply pre-filter to statistics gathering also. The filter you set for statistics is applied to Dashboard, Host Table, Matrix Table, History, and Protocol Distribution equally. Use the pre-filter on statistics, you can now look at your network loads in many different views. For example, by creating a filter with a station address filter to a router, you can tally all the conversation traffic to and from that router only. The Matrix Table will easily show who is talking to the router, and how often. If you open the Protocol Distribution window, it will show the % traffic load passing through the router by protocol types. History graph will plot traffic load at the router over time. If you want to look at matrix and host table statistics only for IP traffic, you can create and apply IP protocol filter to statistics. Same can be done to other protocol types, e.g., IPX, Appletalk, etc. To define a filter, please refer to Capture Setting: Filter Pages in the NetXRay Help Reference in On-Line Help. To apply a pre-filter to Statistics gathering, 1. Select Tools/Options.. 2. Check Apply Filter for Statistics. 3. Select a filter of your choice from the combo list box. Click OK. 1.11 VLAN Decode Support NetXRay adds new VLAN decode for Cisco ISL (Inter-Switch Link) and IEEE 802.10. The new ISL VLAN decode parses and displays the VLAN header, and the subsequent encapsulated frame in the native ethernet, token ring, or FDDI format. With the aid of the powerful NetXRay's Boolean data pattern filter, network developers or support personnel can easily capture packets based on VLAN ID's, and decipher VLAN configuration and encapsulated packets properly 1.12 Custom Decode DLL NetXRay adds a custom decode sample DLL library in C++ which allows user to provide his own custom decode to interpret his proprietary protocol packets. The ability to provide custom decode couple with the standard NetXRay decode library gives user a powerful and cost effective tool to experiment and develop new protocols. To obtain a sample DLL library, please contact Cinco Networks, Inc. directly. 1.13 Support Multiple SNMP MIB Dictionaries NetXRay has removed the artificial limitation of only allowing 64K byte of SNMP.LST to be stored in NetXRay working memory. NetXRay now uses virtual memory to hold the SNMP dictionary. However, you will still need to balance the size of your SNMP dictionary and your available PC memory, because an overly large SNMP.LST file may cause unnecessary page swap to disk and create program threshing during dictionary searching. It also supports multiple SNMP dictionary files. NetXRay will search any file name with the prefix of `snmp' and the file extension `lst', then stores the OID entries into its working memory. If NetXRay encounters duplicate OID entries, it will override the internal table with the latest entry from the .lst file. This provides greater flexibility for programmers to organize and compile their SNMP mibs. Users are no longer bounded by having to compile one large monolithic SNMP dictionary. 1.14 New Protocol Decode NetXRay added new IP application decodes: RPC (Sun), NFS (Sun), DNS, HTTP, Secure HTTP, POP3, SMTP, FTP, NNTP and NetBIOS over TCP detail decodes. 1.15 New packet decode printer output format, and Print to file working properly NetXRay has replaced the print output format of brief decode into WYSIWYG decode format. The new WYSIWYG decode format prints exactly what is shown in the detail pane window of the Packet Viewer. Print to file is now working properly. 1.16 New Power Search ability in the Packet Viewer. NetXRay now supports the ability to locate and search packets that match a protocol field, or a data pattern in the packets. To perform power search from a known packet, 1. Highlight a protocol field, or a data pattern in the detail pane of the packet viewer. Click the right hand mouse button, and select Find Next... 2. Click the Find Next button to locate the next packet that matches the pattern. To perform power search from any packet, use this method when you do not know where the packets but you know the offset and data pattern in the packet you wish to find, 1. From the Packet Viewer window, click the right hand mouse button, and select Find Next... 2. Enter the offset location, and the data pattern in the dialog box. Click the Find Next button to locate the next packet that matches the pattern. 1.17 Packet Capture file format has changed. NetXRay 1.3.0 and higher now supports a new capture file format. Any capture file saved in version 1.3.0 and higher can no longer be read (or Opened) by prior NetXRay versions of software. Please call Cinco Networks for upgrade policy, if you wish to maintain your NetXRay to the latest version. 2. Special Token Ring Set Up Steps Please bypass this section if you have NetXRay/E (Ethernet) version. Running NetXRay requires that you setup your Token Ring Adapter into promiscuous first. Contact your NIC vendor if you are not sure about its support for promiscuous mode. Currently, Madge, Olicom, Intel TokenExpress and Thomas Conrad cards are tested. Note: Adapters not supported: IBM 16/4 Token Ring card and NIC card using IBM or National's Tropic chip set. 2.1 Set up Madge Token Ring Adapters First, you must installed the version 4.3(1) of the miniport driver from Madge. If not please contact Madge technical support. Madge Token Ring Ringnodes * to enable promiscuous, you need to open network icon, Select Madge adapter, (Win95) From the property page, change "GATHER NETWORK STATS" value to "yes" (WinNT) Click Configure, change "GATHER NETWORK STATS" value to "yes" However, if you received the latest version 4.3(2) of the miniport driver from Madge, the "GATHER NETWORK STATS" option has been deleted from the driver's .INF files. Therefore, you can not setup the Token Ring promiscuous mode properly, and will cause NetXRay to hang. To get a new NETMADGE.INF (for Win 95) or OEMSETUP.INF (for Win NT), you need to contact Madge technical support, or access to the Cinco's FTP server to download the latest Madge miniport driver file MADGE.ZIP. The location of this file on Cinco FTP server is `/ftp.cinco.com/users/cinco/release/1.1/patch'. 2.2 Set up Olicom Token Ring or Intel TokenExpress Adapters Olicom Token Ring Adapters Some earlier versions of the Olicom NDIS 3.1 driver may not support receiving all MAC level packets when set by NetXRay in promiscuous mode. If you experience this problem, you can set a special flag in NetXRay.INI located under Windows 95 directory. This will tell NetXRay to use non-standard method to force Olicom driver to enable receiving all MAC frames: 1. Invoke the DOS box 2. Change directory to Windows 95 directory (typically named as WIN95) 3. Edit NETXRAY.INI 4. Search for the [NetworkAdapter] section 5. Add TRingMacFlag=1 below the section header. DO NOT add this flag if you are using other manufacturer's Token Ring NIC. 6. Save the file and exit. Intel Token Express Adapters Intel Token Express card is a private label version of the Olicom card. Use the same set up as described above. 2.3 Setup Token Ring NIC to capture or generate packet size larger than the default size. It is strongly recommended to re-configure your Token Ring NIC card's receive buffer size to maximum allowable size, i.e., 18,432. So that NetXRay can capture all packets up to maximum size allowable. Follow the steps below: ú Select Win 95 Control panel, choose Network ú Select the adapter of you choice ú (Win95) From Advance tab, select Maximum Frame Size, then type in the maximum frame size you wish to capture using NetXRay. ú (WinNT) Click Configure, select Maximum Frame Size, then type in the maximum frame size, 18,432. ú Click OK, Windows 95 or NT will prompt you to re-boot your system If you Token Ring card does not contain the above settings, call your NIC manufacturer for setup instructions. 3. Helpful Hints and Special Notes. 3.1 Un-install NetXRay in Windows 95 Special Note. NetXRay uses standard Windows 95 Installation process. It installs six shared DLLs into Windows 95's System sub-directory, and also enters into Windows 95's Registry about their presence and shared nature. These files are GSW32.EXE GSWAG32.DLL GSWDLL32.DLL GSPROP32.DLL MFC30.DLL MFCANS32.DLL When you un-install NetXRay from your system, you may be prompt with these messages: "The System indicates that the following shared file is no longer used by any program: path name of the file If any programs are still using this file and if it is removed, those programs may not function. Are you sure you want to remove the file??" Click "No" if you do not wish to delete this file. However, if you previously installed these files under Windows 3.1, or your application programs (typically the Win3.1 application) does not follow the Win95 convention in using the Registry. These files may be deleted from the system when you remove NetXRay using the Add/Remove icon in control panel. This may cause your Windows application to fail, if they are also sharing these DLLs. To prevent these files to be deleted by the Uninstall program, you can manually change their use count in the Registry prior to removing NetXRay. Follow the steps below: 1. Invoke DOS box 2. Type REGEDIT to start Registry editor 3. Double click HKEY_LOCAL_MACHINE, SOFTWARE, Microsoft, Windows, CurrentVersion, SharedDLLs 4. Registry will display a list of shared DLLs that are currently installed in the system. Double click on the file you wish to retain, change the Value Data to 1 plus the value displayed. And click OK. Repeat the same steps for other files you wish to retain. 3.2 Import Sniffer capture files special notes To Import from Sniffer capture files that are saved in version higher than 4.1, you must save the Sniffer capture files in un-compressed format in order for NetXRay to decode them properly. Please refer to your Sniffer's user guide for detail. NetXRay may not be able to support all file formats produced by Sniffer. Please send us the files that fail to decode, so that we can modify our program to accommodate these new formats. NetXRay has tested with 4.4 un-compressed files and will decode them correctly. 3.3 Running 100 M bit Fast Ethernet When you use NetXRay in 100 M bit Fast Ethernet environment, the utilization rate display in the Dashboard may shown as 10 times as the normal rate. This error was caused by a bug in some brand's Fast Ethernet card, because its NDIS driver does not return the speed value to NetXRay correctly. To remedy this problem, you can manually force NetXRay to use the speed set by you in NETXRAY.INI file. To preset the speed to 100 M bit, 1. Invoke the DOS box 2. Change directory to Windows 95 directory (typically named as WIN95) 3. Edit NETXRAY.INI 4. Search for the [NetworkAdapter] section 5. Change OverrideLinkSpeed=0 to 3 (0 stands for auto speed detection, 3 forces 100 M bit speed) 6. If you change NetXRay to monitor 10 M bit Ethernet later, you must change this setting back to 0. Other values for OverrideLInkSpeed, 0 = Auto Detect. 1 = 10 Mbit 2 = 25 Mbit 3 = 100 Mbit 4 = 155 Mbit 5 = 4 Mbit 6 = 16 Mbit 7 = 56 Kbit 8 = 64 Kbit 9 = 1.54 Mbit 10 = 2.04 Mbit 11 = 45 Mbit 12 = 50 Mbit 13 = 45 Mbit 3.4 Ethernet undersize packets shown in Dashboard and Capture Buffer If you are using NetXRay to monitor the network, and you are also using the same PC to access the network resources, e.g., browse the Netware File Server, you may get a burst of undersize packets counted by the Dashboard. Do not be alarmed! This is normal. In Ethernet network, any short packets less than 64 bytes in length will be padded by the NDIS driver before transmitting onto the net. However, a node can not see its own packets transmitted onto the network. In order to solve this problem, Windows 95, and NT NDIS 3.1 simply `loops back' the packet `as is' back to NetXRay. The loopback packet does not include any `padding', it is then counted as undersized errors. To make sure you are truly monitoring network undersize packets, do not activate other network applications while using NetXRay. 3.5 Dashboard CRC, Jabber, Fragment, and Collision Errors Always show zero counts. These error counters in this version of the NDIS 3.1 driver in Windows 95 has not supported in most of the Ethernet NIC cards that we tested. We are unable to qualify a vendor to support these error counters thus far. Cinco will continue to work with vendors to ask for their cooperation of implementing these important functions. However, Network Errors: CRC, Fragment, and Collision are now supported for NE2000 compatible NIC and DEC 10/100 chipset 21140 based NIC cards. The new drivers: NE2000.SYS, and DC21X4.SYS are located under cinconet\netxray\driver of your NetXRay directory. To install in Windows 95 environment, 1. Rename your old driver under Win95\system directory. Then copy the appropriate driver into the system directory. 2. Re-boot Windows 95. To install in Windows NT environment, 1. Rename your old driver under WinNT\system32\drivers directory. Then copy the appropriate driver into the system32\drivers directory. 2. Re-boot Windows NT. 3.6 NetXRay causes system trap (Blue Screen) during startup. If your Windows 95 does not have any protocol stack, i.e., NetBEUI, IPX, or TCP/IP bonded to the NDIS 3.1 driver, a system trap will occur during NetXRay startup with the following message: "Invalid VxD dynamic link call from NETXRAY(01) + 00000202 to device "0028", service 8029. Your Windows configuration is invalid. ...........". To fix this, go back to Control Panel and Network icon to bind at least one protocol stack to the NDIS 3.1 driver. 3.7 NetXRay displays Open Adapter Failure during startup. The following are known causes and remedies for the Open Adapter failure. Cause: If you accidentally installed the Network adapter driver more than once, NetXRay may pick the wrong driver that fails to open. To confirm that there are two identical drivers installed, Go to Control Panel/System, select Device Manager page, expand the Network Adapter listing. You should see two or more identical drivers listed. Or when you see two identical drivers in NetXRay's Select Network Adapter dialog box. Remedy: Remove the idential drivers, and re-install your network driver from scratch cleanly. Cause: If you accidentally installed the Network adapter driver more than once, NetXRay Select Adapter dialog box show two or more identical drivers listed. But Control Panel/Network dialog box only show one driver. Select the second driver causes open adapater Open error. Remedy: The second entry is caused by prior incomplete installation of the NIC card. Somehow the Win95 Registry is left with two of the same entries. To remove the second one from Windows 95 Registry. 1. Bring up DOS Prompt. 2. Type REGEDIT 3. Select My Computer\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Net 4. Open each entry 0000, 0001, 0002, etc. to find the duplicated entry. Delete the second one. Now netxray should see only one. Cause: If you migrated your Win 95 PC from an existing Windows for Workgroup 3.11, and were using Microsoft DLC stack, it may cause NetXRay Open Adapter failure. Remedy: Go to Control Panel/Network, select the Microsoft DLC stack, and remove it. Cause: If you migrated your Win 95 PC from an existing Windows 3.1, and were using 16 bit NDIS driver, it may cause NetXRay Open Adapter failure. Remedy: Go to Control Panle/Network, select the NDIS 2.0 driver, and remove it. Cause: NetXRay supports only Enhanced mode 32 bit driver, if you selected Real mode 16 bit NDIS or ODI driver support for your network adapter, it may cause NetXRay Open Adapter failure. Remedy: Go to Control Panle/Network, select your network adapter card, and click Property button. Select Enhanced Mode Driver. Cause: If you purchased NetXRay for NT system and try to run it in Windows 95, it will cause NetXRay Open Adapter failure. Remedy: Contact the reseller or Cinco Networks where you purcahse NetXRay from and exchange for a Windows 95 version. Cause: If you use IBM Tropic chipset based Token Ring adapter, it does not support promiscuous mode and will cause NetXRay Open Adapter failure. Remedy: None. User recommended Madge or Olicom NIC card. Cause: If you use Madge Token Ring adapter, and have promiscuous mode turned off as in default mode. It will cause NetXRay Open Adapter failure. Remedy: See section 2.1 of the readme file about how to enable Madge card promiscuous mode. 4. Installation Procedures for NetXRay/NT Ver. 3.51 and Ver. 4.0 **** NetXRay supports only NT Ver. 3.51 (Release Build 1057) and Later. **** If You are using older NT versions, Do not proceed any further. 4.1 Installing NetXRay in Windows NT/3.51 1. Insert NetXray Disk 1 in the floppy drive. 2. From File menu, select Run... 3. Enter 'a:setup' in the command line edit box, click OK. 4. Follow the instructions on your screen until NetXRay is installed successfully (Use the suggested directory path). Next, you need to install the NetXRay.sys device driver in NT. 1. Select Control Panel from the Main group 2. Click the Network icon. 3. From the Network Setting Dialog box, click Add Software.... 4. Select ' Requires disk from manufacturer' from the Network Software combo box. Click Continue. 5. An Insert Disk Dialog box is shown with 'A:' displayed in the edit box. 6. Insert Disk3, then click OK. 7. A Select OEM Option dialog box with Cinco NetXRay Driver v1.1 highlighted is displayed. Click OK. 8. The Network Setting Dialog box is now shown. Click OK. 9. NT will start binding the NetXRay driver to your Network NDIS driver. When it is complete. A Network Setting Changed dialog box is displayed to ask you to restart your NT. 10. You must re-booting your NT before running NetXray. 4.2 Uninstalling NetXRay from NT/3.51 1. Select Control Panel from the Main group 2. Click the Network icon. 3. Select Cinco NetXRay Driver from the Installed Network Software List box, click Remove. 4. A dialog box is prompted to ask you for confirmation. click Yes. 5. The Network Setting Dialog box is now shown. Click OK. 6. A Network Setting Changed dialog box is displayed to ask you to restart your NT. Click Don't Restart Now. 7. Go to the NetXRay group, click Uninstaller. The NetXRay will be completely removed. 8. Now restart your NT. Installation Procedures for NetXRay/NT Ver. 4.0 4.3 Installing NetXRay in Windows NT/4.0 1. Insert NetXRay Disk 1 in the floppy drive. 2. Click the Start button, then click Run.... 3. Enter `a:setup' if Disk 1 is in drive A. Otherwise enter `setup' with the appropriate drive letter. 4. Click OK. Follow the instructions on your screen until NetXRay is installed successfully. - OR - 1. Insert NetXRay Disk 1 in the floppy drive. 2. Double click the My Computer icon. 3. Double click the Control Panel Folder. 4. Double click the Add/Remove Programs icon. 5. Click Install... button. Follow the instructions on your screen until NetXRay is installed successfully. Next, you need to install the NetXRay.sys device driver in NT. 1. Select Control Panel from Start button 2. Double click the Network icon. 3. Select Protocol page 4. Click Add button 5. Click Have Disk.... 6. An Insert Disk Dialog box is shown with 'A:' displayed in the edit box. 7. Insert Disk3, then click OK. 8. NetXRay.sys is copied to NT system. 9. Click Close. NT will start binding the NetXRay driver to your Network NDIS driver. When it is complete. A Network Setting Changed dialog box is displayed to ask you to restart your NT. 10. You must re-booting your NT before running NetXRay. 4.4 Uninstalling NetXRay from NT/4.0 1. Select Control Panel from Start button 2. Double click the Network icon. 3. Select Service page 4. Select NetXRay Driver, click Remove. 5. A dialog box is prompted to ask you for confirmation. click Yes. 6. Click Close. 7. A Network Setting Changed dialog box is displayed to ask you to restart your NT. Click Don't Restart Now. 8. Select Control Panel from Start button 9. Double click the Add/Remove Programs icon. 10. Click NetXRay to select. 11. Click Add/Remove.... button to start removing NetXRay. 12. Click OK, when un-install completes. 13. Now restart your NT. 5. CONTACTING TECHNICAL SUPPORT For more immediate technical support, please call at 510-426-1770 from 8:00 AM to 5:00 PM PST or FAX your request to 510-426-8105. Our Internet E-mail address is sales@cinco.com We are very interested in your feedback about features and enhancements that you would like to see in NetXRay. If you can't accomplish a certain task, please send us a detailed description by FAX and we will find a solution for you. _________________________________________________________ Features Not Implemented or Incomplete _________________________________________________________ 1.. Decode ú AppleTalk: ZIP, ASP _________________________________________________________ Known Problems _________________________________________________________ 1. The delay time in Packet Generation: Send one packet mode can not be controller accurately. NetXRay uses NDIS interface timer to regulate the delay between each packet sent. NDIS 3.1 provides the timer resolution at about 10 ms and can not guarantee any accuracy. If you wish to generate maximum packet generation load, select 0 ms delay. The maximum packet generation rate depends on the CPU speed, the memory size, and your NIC card performance. Work around: None.