FarSync
Line Monitor for Windows |
![]() |
![]() |
Once installed, the FarSync Line Monitor will appear as an option off the Windows Start menu.
The user interface to the FarSync Line Monitor is the same on all Windows platforms. The appearance may vary slightly depending on exactly which version of Windows and line monitor you are using. The screenshots shown below were taken on a number of different Windows platforms.
The FarSync Line Monitor supports 4 monitoring modes:
Internal mode is used to monitor signal transitions and data traffic for FarSync ports that are in use by programs running in the local machine. So in this case it's the FarSync port’s usage that is being monitored, for example when accessing remote WAN resources via TCP/IP.
Peer/Unidirectional
mode is used to capture both incoming signal transitions and
incoming data from a remote peer device/system. In this case, the
monitor is actually acting as an endpoint on the selected line(s)
and is therefore displaying/monitoring the activity of its peer.
Remote mode is used to capture traffic sent and received by LAN-attached devices such as the FarLinx gateway.
To select the required mode, start the FarSync Line Monitor and select the File-Recording Mode menu item. This will display the following configuration dialog:
Select your required Monitoring Mode and, for Passive and Peer modes, select the FarSync ports that are to be used for monitoring. In these modes you can also optionally update the port configuration for any of the selected FarSync port(s). When doing this it is important to ensure that you configure the port’s Interface, Mode and Encoding settings to match the line being monitored e.g. if you were monitoring an X.25 or HDLC line then the monitoring port’s Mode parameter would have to be set to HDLC whereas if you were monitoring a line carrying a transparent bitstream, e.g. when running a Bit Error Rate test, then the Mode should be set to Transparent.
Also note that the Wireshark... option enables you to setup the FarSync real-time monitoring support so that you can use the standard 32-bit version of the Wireshark product to display/decode the monitored traffic by using the FarSync Monitor interface which is made available in the list of interfaces offered by Wireshark:
Note that although both the FarSync Line Monitor and Wireshark can be used for real-time monitoring, only one at a time can be used for this
For further details regarding the use of Wireshark itself please refer to the help that is installed with the Wireshark product. Note that only the 32-bit version of Wireshark should be used with the FarSync monitoring support (even when using 64-bit versions of Windows).
When started, the FarSync Line Monitor will automatically start capturing using the monitoring mode (as configured above). The screenshot below shows a monitor started with no current traffic on the ports.
The main parts of the screen are as follows:
Command Menus
File, Comments, View, Window and Help
Command Buttons
Record, Freeze, Pause, Clear Trace, Open (Trace File),
Save (Trace File), Log To Disc and Help/About
Captured data display area formatted into columns. The use and number of columns will depend on the actual type of decoder in use (e.g. X.25, PPP - see below)
The Record Button is used to start/stop real-time capturing.
The Freeze Button is used to stop display updates whilst still capturing data during time-sensitive capture sessions
The Pause Button is used to temporarily stop capture (and display updates)
The Clear Button deletes all captured data (and can be used before or during capture sessions)
The Open Button is used to display previously captured data
The Save Button is used to save the current captured data to disc. Using the File-Save As menu option enables you to save the data in text or pcap (Wireshark) formats as alternatives to FarSync Line Monitor's own format (*.fmn) that is used by default.
The Log To Disc Button is used to start/stop logging of captured data to disc
The following capture shows the initiation of an IP over PPP session as decoded by the FarSync PPP decoder which is included as part of the FarSync Line Monitor.
Column 1 is the number of the event within the captured data
Column 2 identifies which port/line is
being monitored [0 ==> FarSync card 0 (i.e. named SDCI0), A => Port
A]
Column 3 is the time at which the line event was traced
Column 4, in the case of the PPP decoder, is the PPP protocol, if the entry is blank then the corresponding data packet is probably compressed or encrypted.
Column 5, in the case of the PPP decoder, details any related PPP commands decoded from the data packets.
Column 6 is the complete data packet received, including the protocol headers already decoded
Additional columns are available to be inserted into the trace information. To see what additional information is available to be traced, choose Options from the View menu
Once data has been captured the trace can be saved to file using FarSync Line Monitor's own format (*.fmn) and read back later by FarSync Line Monitor. Alternatively the trace can be saved in pcap format which is supported by Wireshark so that the file can be subsequently decoded by Wireshark itself.
In addition to saving captured traces, FarSync Line Monitor can also be run in Log To Disc mode where all data is both displayed and saved to a log file, either in pcap or text format.
When analysing the trace, it is possible to add comments to the trace file. Select the line at which you wish to insert a comment, and then select the Comments menu.
This comment is then placed in the trace.
Once inserted, comments can be subsequently edited and deleted.
When the trace is saved to file (in fmn format) any comments inserted into the trace will also be saved.
It is possible to have several trace windows open at the same time. Either several files can be viewed at the same time or several portions of the same trace can be viewed at the same time. To view several trace files simultaneously, open all the files required and then choose Tile from the Window menu. To look at, say, two parts of the same trace choose New Window and then Tile from the Window menu. You can then use the slider bars in each window as required. This is shown in the example below:
As well as supporting the above packet display, the FarSync Line Monitor can also display the entire contents of each packet via its Data Window which is accessed via the View - Data Window menu option e.g.
As well as supporting the above packet display, the FarSync Line Monitor can decode selected X.25 frames/packet further by using its Frame Window which is accessed via the Frame - Data Window menu option e.g.
The FarSync Line Monitor can decode the captured data using the following alternative decoders:
PPP - packet is decoded as a synchronous PPP frame
X.25 - packet is decoded as a level 2 or level 3 X.25 packet
Raw - packet contents is not decoded
To select the appropriate decoder to be used, right-click in the captured data area and choose the decoder you require. Note that the particular columns displayed in the capture data window are decoder-specific.
For further decoding of the packets' payload you can save the trace in pcap format and then read that into Wireshark. Alternatively, you can use Wireshark in real-time decoding mode.
You can configure the maximum number of events to be recorded or displayed via the Properties dialog which is displayed when via the File - Properties menu option. This is useful, for instance, when needing to trace over long periods of time. In addition, the Event Offset setting enables you to read and display sections of previously recorded trace files. This can, for instance, help reduce the display time for very large files.
Copyright © 2001-2013 FarSite Communications Ltd. |
![]() |