Finisar Surveyor manual Stop-and-Save Capture Buffer, Modes, Expert Analysis Mode

Configuring Surveyor 4

Module Settings (Properties)

For THGm modules, the default is no packet slicing (full packet length). For THGm, the slicing size must be 64 bytes or greater and packet slicing of 128 bytes is not supported for 1Gbps Ethernet.

For Portable Surveyor 10/100 Ethernet Analyzer Cards, and NDIS cards, the default setting is no packet slicing for capture, 128-byte packet slice for monitor. For NDIS modules, you cannot have both monitor and capture set to full packet size.

Stop-and-Save Capture Buffer

Only local devices support a stop-and-save-to-disk function for the capture buffer. Check the Enable Full Buffer Auto Save box to enable the save-to-disk feature. When using the save-to-disk feature, capture is stopped when the buffer is full and the contents are written to disk. Capture is restarted as soon as the data is written to the file. When the capture buffer fills again, the new contents are appended to the file. If you start a new capture, the file is overwritten. If capture is stopped before the capture buffer contents are full, the buffer contents are not automatically written to disk; you must manually save the capture buffer to disk.

Modes

Select the Modes tab from the Configuration → Module → Settings... to set the modes for a module.

Expert Analysis Mode

Expert Views and Alarms can be disabled. When disabled, no Expert Views or Alarms will display in Surveyor software.

Uncheck the Enable Expert Analysis Mode box to disable Expert Views and Alarms. The default is to enable Expert Analysis. If you do not have the Expert plug-in, you cannot enable Expert Analysis Mode.

Non-Well-Known-Ports Mode

Non-well-known port (non-WKP) numbers in tables can be enabled or disabled for each module when monitoring with local devices. When disabled, most port num- bers above 1023 display as TCP Other or UDP Other with no port number pro- vided.

It is recommended that you leave this feature disabled unless you are looking for specific port numbers greater than 1023, since non-WKP numbers can quickly fill Application Layer Tables. Surveyor always displays the port number if the number is less than or equal to 1023. Surveyor also displays some ports above 1023 since applications associated with them are widely accepted.

Check the Monitor TCP/UDP non-well-known-ports individually box to enable the display of all non-WKP numbers. The default is to not display these port numbers.

With the option enabled all TCP packets with non-WKP numbers (TCP or UDP)

4-9