print

Tip of the Month

December 2002

Annotation

Troubleshooting network issues has long meant enough paperwork and tracefiles to challenge even the most organized protocol analyst.

WildPackets has consistently addressed this organizational issue with features within our analyzers such as a comment field of 250 characters for each filter, the ability to name nodes and the ability to name individual NICs. With the new EtherPeek releases, analysts will now be able to annotate tracefiles on the fly!

Historically, if you capture packets relating to a Client/Server issue and you are sitting at the client workstation, you would want to take notes such as "packets 0-135 Client Boot", "packets 136-245 Logging on to network", etc. This method was effective if the analyst was organized. More often than not, the analyst would be tasked with several other "fires" to be put out before being able to view the trace in more detail. The time between taking the trace and examining it was ripe time for misplacing those notes and forgetting the details of a trace. Peek technology now allows the analyst to attach notes within each packet on the fly!

Simply highlight the packet to annotate and click on the little yellow notepad in the toolbar! After you have written your note and saved it, a little paper icon will appear next to the packets number. You will be able to edit or erase the note. Once made, the notes will be stored with the tracefile. If someone else views the trace with the new release of EtherPeek, they will be able to read the notes along with the trace!