


PC/netwatch, version 5.0


A program to monitor the attached local network.  It is useful
primarily for debugging network operations on a broadcast network
such as the Ethernet.

Usage:

     netwatch

No arguments are required.  PC/netwatch listens to the attached
local broadcast network and displays one line of information for
every packet that goes by.  This information consists of the "to"
and "from" local network addresses, the packet length, the value
of the protocol type field, and 8 selected contiguous bytes of
the packet contents.  While netwatch is running one may type
control instructions to it.  The control instructions it
recognizes are:

a  -  Display packets whatever their source or destination.
      (This is the starting mode of operation.)
m  -  Display only packets coming from a given local net address.
      (Address is input as 12 hex digits.)
d  -  Display only packets going to a given local net address.
      (Address is input as 12 hex digits.)
t  -  Display only packets of a given protocol type.
      (Type is input as up to 4 hex digits.)
<  -  Display only packets larger than a given length.
      (Length is input as up to 3 decimal digits.)
o  -  First byte of packet contents to be displayed.
      (Input as a zero-origin decimal number.  Default is 14.)
S  -  Display statistics of network driver.
l  -  Clear screen.
r  -  Reset packet count at bottom of screen.
p  -  Send Address Resolution ARP broadcast packet.
q  -  Exit from the monitor program.
n  -  display packets in hexadecimal form.
s  -  display packets in symbolic form, if recognizable as an IP,
      CHAOS, or Ethernet ARP packet.  (This is the starting mode 
      of operation.)
A  -  display only ARP packets.
C  -  display only CHAOS protocol packets.
I  -  display only IP protocol packets.
?  -  Display the list of requests.

Performance

The limitations of the monitor in high-traffic situations should
be understood.  The monitor can handle a burst rate of about 200
packets per second.  Packets arriving faster than that are missed
(but counted in the statistics of the network driver).  In
addition, the display rate is about 25 packets per second and
there is a buffer that can hold 512 undisplayed packets.  If
packets arrive faster than the display rate for a long enough
time to fill up the buffer, the monitor discards overflow
packets.

31 October 1984.  This document is in file netwatch.txt
