Introduction

What is traffic meter?

This tool allows you to monitor the traffic on a network or modem interface. It includes many useful features to monitor your volume, down and upload rates, view general statistics, measure specifications of your interface and much more...

License

This software runs under a freeware license. It means that you can download and use this software freely without the obligation of paying royalties of any kind. However, distribution of this software under a commercial license or modifying this software or any item related is still prohibited by law.

System requirements

In order to run this software you will require the Microsoft .NET Framework 1.1. You can download this by clicking on the link, or by updating the service pack updates of Windows.

Other requirements include Windows Xp, 2000, 2003 or Longhorn


How traffic is monitored

NET Traffic Meter uses a special driver to monitor network and internet traffic. This allows NET Traffic Meter to gather more extensive information about the network interface and the packets that are transmitted.

This schematic displays how traffic is monitored:

The only disadvantage of this method is that, if you are running a firewall, it is possible that it displays messages that "Netmon NT Driver (nmnt.sys)" is being contacted by a remote computer or that it sends information to a remote computer. What is in fact happening is that this driver captures the traffic (the packets) meant for a client application (Internet Explorer, Msn, Irc,...). Then it analyses the traffic and sends it back to it's correct destination. The firewall does not know this and thinks that the traffic was send to "Netmon NT Driver". It is possible that your firewall will ask you if you want to block traffic to or from this "Netmon NT Driver". If you block this driver, the traffic will be bypassed direct to the client and NET Traffic Monitor will not monitor any kind of traffic.


Introduction

Step by step configuration

This section explains how you should configure NET Traffic Meter. You can click with you right mouse button on the graphic window or the taskbar tray icon at the bottom to display the menu. Click on the "Configuration" menu item in the "Display" menu to display this window...


Untitled Page

General configuration

Before NET Traffic Meter will work properly, you need to verify the settings of your network or modem interface. Select the interface you wish to monitor from the "Monitor" list.

Remote capture interface

This interface is highly experimental and not recomended. You can see more information about it here.

Profiles

By default the "Automatic" setting is used as profile. This will adjust the speed setting to the maximum data rate that is received while the meter is running. It is recommended that you set the correct speed setting by selecting the type of connection you have in the "Speed" list. You can edit, add and delete connection profiles by clicking on the "Edit" button.

Additional options

If you want (recommended ) you can check the "Load ... with windows" option. When this option is set, Traffic Meter will start automatically when Windows starts. The chart window will be displayed as soon as the program is started. You can enable "Don't show meter at startup" to prevent this.

Another feature is the "Prefer bytes over bits": If this is checked all values will be displayed in bytes. One byte equals 8 bits. If this option is not set, all measurements will be displayed in bits.

When the meter is moved to the borders of the screen it will try to dock. To turn this off, enable the "Disable chart window docking". This may be usefull on multimonitor setups.

Optionally you can choose to disable port analyses. If this option is enabled, the "port usage" page in the statistics window is disabled, but less cpu time is used by NET Traffic Meter. If the option "Don't save ports in statistics" is disabled, the results from the port usage analyses is also saved in the statistics file. This allows you to view "port usage" from other days as well, but it will use a little bit more cpu.


Untitled Page

Volume configuration

Some service providers have volume limits on their internet connections. You can configure Traffic Meter to your ISP specifications so that it becomes easy to monitor your downloads, uploads and your remaining volume.

First you need to set the "Volume size" to the size of your ISP internet volume (in MB). Then choose the type from the "Volume type" list. There are 3 types available:

  • Monthly pack: Counts the volume size until the first of the month, and then resets the used volume.

  • Monthly volume: Counts and maintains the volume size for the duration of each month. The used volume will not be reset on the end of each month but will still count for as long as 30 days after the downloaded day.

  • Weekly volume: Counts and maintains the volume size for the duration of each week. The used volume will not be reset on the end of each week but will still count for as long as 7days after the downloaded day.

Custom options

Some ISP have night and day download ratios. If you set the 1/x value higher than 1, the amount downloaded will be divided by x between the start and the ending hour.

There are also 3 other options available. If you choose the "monthly pack" volume type you can set the day the monthly volume pack is reset using the "First day of volume" value.

If you enable the "Auto clear" option, only the statistics of the current month, week or last 30 days (depending on your volume type) will be kept.

If your ISP counts only download as part of the volume instead of download and upload, you can check the "Count only download" option so that only the incomming traffic is used to calculate your volume.

Tasktray icons

By default, only the "up/down" tasktray icon is displayed. This consists of two arrows (up & down), respectively indicating if there is an upload or a download stream. If you enable the "Display volume meter tray icon" option a second task tray icon will appear. This icon is a green bar indicating how much of your volume you have left. The red bar represents the amount of volume you have already used.

When the "volume" tasktray icon is displayed, you also have the option to hide the "up/down" task tray icon. Uncheck the "Display up/down tasktray icon" option to hide it.


Profiles

NET Traffic Meter uses profiles to define the connection speed. You can edit these profiles using the profile editor.

Using the "New" and "Delete" buttons you can add new profiles or delete the selected profile. If you select a profile you can make changes to that profile by changing the values bellow.

Profile settings

The "Name" field sets a user friendly name for the selected profile.

The "Bandwidth" box contains fields to set the upload and download bandwidth of the connection in bps.

Sometimes it may be useful (if you have more than one connection type on the same network interface) to use the fallback option. To use this option select the "Fallback bandwidth" checkbox. You should also enable the "Auto adjust bandwidth" option. Now you can set the minimum bandwidth in the "Fallback Bandwidth" box and the maximum bandwidth in the "Bandwidth" box.

The bandwidth will now be increased if larger values are found and will slowly decade (using the "Fallback Amount" in bytes) until the minimum bandwidth is reached.

If you have an internet connection and a LAN connection on the same network this may be a useful option to make sure the Internet transfer rates are still visible on the chart window.

If you enable the "Auto adjust" option, the bandwidth will increase automatically if larger values are found.

More options

if the "Draw upload relative" option is checked the upload lines in the chart window will be drawn relative to the download lines. If you can upload 10KB/s and download 100KB/s and both upload and download are at their peak the upload lines will be as large as the download lines. Otherwise the upload lines will be 10 times as small as the download lines.

When the "Hide and show..." option is enabled, the chart window will be hidden if the amount transfered is bellow the specified amount during the specified amount of time. If there is more transfer than specified the chart window will be displayed.

The sensitivity slider sets the change allowed when the bandwidth is adjusted automatically. If it is set to the far left, both upload and download can cause changes of any sie. If set to the far right, only downloads can cause changes and these may not be any bigger than half or double the bandwidth. The slider can be used to callibrate the autoadjustment so that insignificant measurements are ignored.


Customizing the chart window

Colors

In the configuration dialog, at the "Colors" tab you can specify the colors used in the chart window.

To change a specific color, click on the color his button, click on the "Select base color" button to choose another color and move the slider bellow to change the opacity of that color.

Graphics

In the "Graphics" tab you can change many more options to alter the looks of the chart window.

In the "Display" area you can check the items that you want to be visible on the chart window.

The "Distinct Up/Down" option will draw upload and download speeds separately instead of the sum.

If you are using more than one copy of NET Traffic Meter, you may want to enable the "Network Interface Name" in the "Diplay" option. This will mention the name of the interface that is monitored, on the chart window.

In the "Font" area you can define which font to use to draw the text of the chart window.

Rulers

The "Rulers" area defines where the horizontal or the vertical rulers (lines) are drawn.

You can also draw horizontal speed rulers. To do so check the "Horizontal speed rulers" option and enter the "Speed" value in the "Rulers" box. Now, horizontal lines will be drawn for each X amount of transfer speed so you can read the chart more easy.

Sometimes data is sent and received that is so small that you won't notice it on the chart. To make sure you know data was sent enable the "Detection lines" option can be enabled. Now, the area where data is transferred is drawn lighter than where no data is transferred.

Opacity effects

When you want the chart window to always stay on top (see "Meter always on top" menu item in the chart window popup menu) you may want to make it a little transparent. You can do this with the opacity slider (Windows Xp or 2000 only). This way you can still see what is beneath the chart window.

If the "Half opacity if mouse is not over window" option is enabled, the opacity of the window will be half the value of the opacity slider when the mouse is not located over the opacity slider. This way you can see more beneath the window, and you can increase the window it's opacity by moving the mouse over the chart window.

Mouse events

Sometimes very useful, is the show and hide on mouse events option. When this is on the window will make sure it is fully visible when the mouse moves over that window.

Now you can also simply click on the chart window to make it hide. These two combined make it much more easy to quickly see the chart window without keeping it always on top.

By default, the chart window is drawn in high quality. If you want more speed or memory you can move the quality slider to the left to improve performance a little, but decrease the quality of the chart window.


Untitled Page

Hotkeys

Hotkeys can be used to activate or show parts of NET Traffic Meter by pressing a single, or a combination of keys on your keyboard at any time.

To add a hotkey click on the textfield and press the combination of keys to use to trigger the selected action. Click on "Add new" to insert the hotkey into the list.


Profiles

Plugins

NET Traffic Meter 2.0 also supports plugins. These are small DLL files that can be integrated in NET Traffic Meter to extend its capabilities and features.

Plugins often come packaged in a ZIP archive. You can check the website for additional plugins to download and add to NTM.

To install a plugin you need to go to the "Plugins" page in the "Configuration" window:

Click on the "Install" button and select the plugin archive (zip) file you downloaded from the website to install it. It is possible you need to restart NET Traffic Meter before the plugin will work properly, so click on the buttan that appears when you are finished to restart.

When you no longer need a plugin you can disable it. From that point on it will not be loaded anymore, but you can enable it again later. If you want the plugin, click on the "Remove" button and it will be gone permenatly.

Some plugins contain help files and can be configurated. Select a plugin from the list and respectively click on the "Show help" or "Configure" buttons to do that.


Untitled Page

Sound

If you want to be notified when you have transferred an x amount of data, you can enable the audio ticker.

If enabled, it will play the "Audio file" every time when another "Count every" amount of data (in KB) is transferred.


Profiles

Performance tweaking

Altough NET Traffic Meter does not use much CPU resources, here are some tips to use even less resources:

  • Decrease graphic quality: NET Traffic Meter uses a little bit less memory when the graphic quality of the chart window is not in maximum quality setting.
  • Don't use to large chart windows: The larger the chart window is, the more memory is used.
  • Increase polling: NET Traffic Meter has a hidden feature, which is called polling. First make sure NET Traffic Meter has been started at least once. Close NET Traffic Meter. Now go to the installation folder and open the "config.xml" file. Look for this text: "<polling>1</polling>". Change it to (for example) "<polling>2</polling>". This will make the graphic update only once every two seconds. If you set the value to 3, it will update once every three seconds etc...
  • Hiding: NET Traffic Meter and the SQL Live Update tool support a hidden mode. In this mode, the application will be started and will work, but it won't be visible to the user. You can run the program on a computer without any visual indication. To set the hiding mode, open the "config.xml" (for NET Traffic Meter) or the "sqllive.xml" (for SQL Live Update) with a text editor (Notepad) and change the "<hiddenMode>False</hiddenMode>" item to "<hiddenMode>True</hiddenMode>". You need to do this when NET Traffic Meter and/or SQL Live Update is closed. To make the application visible again, set the option to True again. Don't forget to configurate this tools first before hiding them.
  • Disable port analyses or port statistics saving


Profiles

Multiple instances

By default NET Traffic Meter only allows one copy to be run at a time. However, if you copy the installation folder of NET Traffic Meter to another folder, for example:

You can run more than one copy of NET Traffic Meter without any problems. Remember: you need to copy all the contents of the original "NET Traffic Meter" installation folder to a new folder. The settings and statistics of one running NET Traffic Meter will then not interfere with the other one.


Untitled Page

Exclusions

The exclusions dialog allows you to specify which IP adresses, hostnames and dnsnames may not be counted in traffic and statistics. You can use this feature, for example if you are connected to the internet with internet sharing, to exclude network traffic with that server. If you add the IP of the server that servers as a gateway all the traffic directed to that server will not be counted. This way, only external traffic (for example to the internet) is displayed. To add a new IP, enter an IP, hostname or DNS name in the IP textfield and click on the "Add" button.

You can also add an IP range. Only IP adresses are valid here (no hostnames). Packets intended for sources and destinations with an IP located between the starting (first) IP adres and the ending (second) IP adres will not be counted.

Sometimes a local application communicates to another local application using TCP/IP. This traffic will also be visible unless the "Exclude local TCP/IP traffic" option is enabled. In this case, only traffic is counted that goes outside the local machine or comes in from a remote computer.


Remote monitoring

Important note: Remote monitoring was removed from NET Traffic Meter in version 2.1!

It is possible to capture statistics from another, remote computer on the network. Altough this feature is highly experimental and not recomended it may be usefull to monitor internet traffic if you have many computers connected to an internet server. You can than use the "exclusion" feature and the "capture remote traffic feature" to analyse internet traffic generated by all computers.

Before you can connect to a network interface you need to make the remote pc accessible. You can read this documentation on how to prepair the remote pc. Remeber that your firewall may not intercept these traffic packets in order for the remote connection to work.

Next, you will need to generate a connection link. You can do this by using the "Remote Network Information" plugin in NET Traffic Meter on the computer you want to connect to. You can always generate a link manually like it is described here.

Finally open the configuration window and click on the "Remote..." button. Now paste or write the rpcap connection link in the text field and press "Connect" to start the connection. If it is unsuccesfull, a connection error is displayed.


Statistics

The statistics window contains 5 tabs. They provide general information about the amount of download and upload, the rate (speed) and the amount of time connected. The first today tab also indicates an estimated value of upload, download an total transfer on the end of the month.

The "Daily", "Weekly" and "Monthly" reports the total amount of data transferred for each date.

By default, only statistics conserning the current year and month are displayed. If you enable the "Show all statistics" option, all data is displayed, regardless of the current date.

95th percentile

Some ISP use this method to elliminate traffic burst peaks on webservers etc... to prevent immediate or high costs to their clients. NET Traffic Meter can calculate the 95th percentile to an accuracy of 720 samples a month. If this option is enabled you will see a different volume chart calculated by this method.

Synchronisation

In the "today" page you have a button called "Adjust amount...". This can be used to add or subtract download or upload amounts in order to synchronise your volume with your Internet Service Provider. Sometimes your ISP can experience technical difficulties counting the amount of data you download and then it might be usefull to adjust you statistics.

Optionally, if a plugin is already available for your internet service provider, you can install a synchronise plugin that will adjust your volume to the volume your ISP measures.

Graphical representation

Under the daily, weekly and monthly table you have a button called "Show chart". When you click on this button you will see a new window displaying a graphical representation of the upload, download and total. If you select the "Show all statistics" option all data is displayed instead of the relevant data to this volume pack or period.

You can click on the "Save" button to save the graphic as a bmp, jpg or png image.

The volume tab displays a graphical representation of your the amount of volume you have spent. In addition, if you have a "monthly-based volume" on your connection you can see light-green bars that represent the volume you could used for each day. ( If your current volume exceeds this bar, it will be drawn in red from the point where you exceed it. )

Clicking on the "Save..." button will allow you to save the volume graphic as a bmp, png or jpg image.

Exporting statistics

You can use the "Export" button to save the statistic data from the charts into a Rich Text Document (RTF), which can be read by almost any application. If you want to process the statistics from NET Traffic Meter you may want to export the data as a CSV (Comma Seperated Value) file. This can be read by many, for example Excel, applications to draw charts and analyse your statistics.

Backup statistics

The "Open" and "Save" buttons can be used to backup and import the statistic data of NET Traffic Meter.

The "Clear" button will remove all data available and thus wiping all statistics...

Ports

Net traffic meter can also annalyse the kind of network traffic you have. If you take a look at the port tab you will see a list that summerizes all the different ports the network packets use.

It is mentioned with a usage value in percent and a possible description of the kind of traffic. On the right side, you will see a chart representing the moest frequent kind of traffic. Move over a slice to see it's description.


Alerts

Alerts can be used to notify you when a specific event has occurred, for example, if you have less than X% of your volume left.

You can add new events by clicking on the "New" button. You can enter a name in the "Event" text box to make it more easy in managing your alerts. If you temporary want to disable an event, you can uncheck the "Event is active" option.

If you check the "Event expires on" option and enter a future date, the event will (can) only be triggered until that time.

Conditions

In the condition field you can specify when the alert is triggered. It can be triggered if the volume, upload, download, (actual) download speed or upload speed of the connected time is bigger or smaller then the value specified (mind that the value type changes depending on what you choose from the "Trigger when" list).

At the bottom of the condition field you have 3 choices. These choices define what the time interval is for the condition. It can be a daily condition, weekly condition or monthly condition. These time intervals apply to all trigger events except to the Volume event. The time interval of the Volume event is always the time period of your volume.

Custom display

Instead of simply displaying an alert, you can also choose to show a custom message or to play an audio file when the alert pops up in the "Action" field.

When an alert is displayed you also have these options:

  • "Don't show this alert again today": Enabled by default. This will prevent this alert to be triggered again today.
  • "Disable this alert": This will deactivate the alert.

At the bottom of the alert configuration window you have two other options. If you select the "Alert acts like a popup window" option the alert will be displayed as a small popup window above (or bellow) the chart window. You can hide it by clicking on the "x" button.

When you enable the "Hide popup when no longer valid" option, the popup alert will automatically disappear when the condition is no longer valid.

Other actions

If you enable the "Close application" option, NET Traffic Meter will close the application mentioned in the list next to it. An application is specified by the name of the process. When the alert window is opened, this list contains all the processes that are running at that time, but you can also enter a process name manually. Most of the times this process name is the name of the program executable. It is also the name that is listen when you display the Windows task scheduler.

When "Start application" is set, NET Traffic Meter will start the program (exe) file you entered on the right when the alert is triggered.


Profiles

Tools

NET Traffic Meter contains additional tools to extend the capabilities of NET Traffic Meter.

These tools are menth for more professional or advanced users. These are the tools available:

  • Stopwatch: Gather timings and analyse the speed of your internet or network connection.
  • SQL Live Update: Send NET Traffic Meter statistics to a local or remote SQL database.
  • SQL Remote Report: Monitor, analyse statistics sent by SQL Live Update from a remote computer.

Some plugins may also appear available in this "tools" menu.


Stopwatch

The stopwatch is a useful tool for measuring downloads and uploads within a time span.

You can start the timer by clicking on the "Start" button. If you click on the "Auto start" button, the timer will start automatically when the first data is received. The button will then disappear and a timer displaying the time the stopwatch is running will appear.

The data measured is displayed in the grid bellow, and on the details page. The "U" and "D" meters display the usage of your upload and download bandwidth.

In the options tab you can enable useful extras such as, to make the window transparent or to make the windows appear on top of all other windows.


Profiles

SQL Live Update

This utility, when running, exports the statistics tables of NET Traffic Meter to a local or remote SQL database. At the moment Microsoft SQL server (or DE2000) and MySQL server are supported.

Using SQL Live Update is very easy. Fill in the information in the fields "Server", "Database name", "Username", "Password" and "Table prefix". You must have access to an SQL server in order you can use this program.

If the database does not exist yet it will be created.

Now select the "Enable SQL Live Update". If all information is filled in correct and the server is working SQL Live Update should start. If not and error will be displayed and SQL Live Update will turn itself off.

In the options screen you have more settings:

If you are using MySql server instead of Microsoft SQL server (default) you need to change the setting in the "SQL Server Type" field before you can connect to your database.

The "Update interval" field allows you to choose the amount of time SQL Live Update waits before it will update the database again.

If you want SQL Live to run every time when you start Windows, you may select the "Start SQL Live Update when Windows starts" option.

The Commands page has some additional functions:

"Update statistics now" will cause SQL Live to update the SQL tables immediately.

"Clear database statistics" will clear all rows in the SQL tables.

"Close tables" will clear all data in the tables and remove them from the database.

"Close database" will attempt to clear and close the whole database used by SQL Live Update.

SQL Tables

This overview shows what tables and columns are exported by SQL Live Update.

There are three tables available that contains all information from NET Traffic Meter.

The "daily" table contains upload, download, time for every day NET Traffic Meter was running.

The "monthly" table contains a summary of each month.

And the table "today" contains additional mesurements of the current day.

Daily

The primary key of this table is "day" which is a DateTime stamp. For each day the upload, download and total is stored (in bytes, KB and MB). Also the duration of the connection is mentioned in seconds.

Monthly

The monthly table uses the exact same formatting as the daily table with th exception that the monthly table contains a summary of each month.

Ports

If ports statistics is enabled, these will also be exported to an sql table.

Primary key is the "port" column and is followed by the "portusage" column which represents a count on how much the port is used. The increament of this number is, of course, higher if the packet is larger.

Today

This table is different from the other two:

The primary key here is the "item" column. Each row has also a value. This column indicates each value for the corresponding item. With the exception of "connected" and "volume_percfree" every value is also mentioned in valueKB and valueMB.

These are the different items available in this table:

  • transfered_up: amount of upload transfered today.
  • transfered_down: amount of download transfered today.
  • transfered_total: amount of download and upload transfered today.
  • max_up & max_down: the maximum (detected) bandwidth of upload and download.
  • avg_up & avg_down: the average upload and download today.
  • connected: the amount of time connected today in seconds.
  • estimated_up, estimated_down and estimated_total: the estimated amount of bytes uploaded, downloaded and total by the end of the current volume pack or period.
  • volume_uploaded, volume_downloaded & volume_totalused: amount uploaded, downloaded or used this volume pack or period.
  • volume_percfree: available volume this volume pack or period in percent.
  • volume_totalfree: available volume this volume pack or period in bytes.
  • volume_total: the total size of the volume pack or period in bytes.


Profiles

SQL Remote Report

This utility allows you to access statistics exported by SQL Live Update from a remote computer. It also allows you to view multiple SQL databases in a joint statistics report.

Before you can use this utility you must have access to an SQL database and SQL Live Update must have added tables and statistics to this database.

Fill in the information for each SQL Live database in the text fields above and click on the "Add new" button to add the new connection to the list. (Don't forget to indicate if the SQL database is a Microsoft SQL or MySQL database). If a connection is selected in the list bellow, you can make changes to it by changing the text fields or remove the connection by clicking on the "Remove" button.

After you have added all connections select the ones you want to view or merge by checking the box next to the connection. If you click on "Show statistics" all data from these connections (databases) will be combined (for viewing only, no changes are made to the actual tables) and displayed in a standard NET Traffic Meter statistics window.


Support

Please visit the form first to see if your problem is not listen there already. I also recommend you simply post your problem on the forum so that other users may see a solution to the same problem immediately. If you submit a bug or problem and an error log was created you can also submit that error log in your post or email. The file is called "errorlog.txt" and is located in the installation directory of NET Traffic Meter.

I give technical support to anyone that asks for it to the best of my abilities. If you have a problem, would like to request a feature, have found a bug or if you have any kind of (related) comment you can send post a topic on our forum at http://www.kctoolbox.tk.

Website

For the latest downloads visit my website: http://www.kctoolbox.tk

Forum

For the latest updates, information and questions visit my forum: http://www.kctoolbox.tk


Donate

Why should I donate?

KC's Toolbox is a hobby for me. One of the reasons I haven't taken my products commercial or shareware is that I don't have enough time to make the commitment that's required when you sell software. This means I don't get paid for what I do, but that's fine by me, because it also means I'm not constrained -- I work on whatever I feel like working on, and I never have to compromise the quality or feature set of my software to release the next version on schedule. It also means I have the freedom to work on whatever suits my fancy. No time is wasted on garbage like registration codes, copy protection, ads, nag messages, or other features of no use to the user.

I spend a lot of time on KC's Toolbox. I spent almost an hour every day doing administration for this site and my emails. Occasionally a person has a sticky, but interesting, problem they need help with, and I write special versions of tools to help. Obviously, I also spend a lot of time writing my software, and do my best to keep the program as bug-free as possible, as well as documented. It also costs some money to pay for the webhosting. -- only $5/month -- but this server will be out of my reach within a year.

I like working on NET Traffic Meter, and I don't need to be paid to keep working on it, since it is a hobby, I use the application myself and the cost is relatively low. I don't need donations, and I certainly wouldn't want anyone to send one that couldn't afford it or didn't think I deserved one. Donations help me in various ways, though, by defraying expenses, allowing me to purchase development tools and hardware for diagnostic purposes,...

KC's Toolbox has taken almost a full years of development to reach this point, and I have no intention on stopping any time soon, nor do I have an intention of making it non-free (proprietary) software. It may seem strange, but I would be perfectly willing to pay to work on my software, since I use it myself and I like working on it.

How can I donate?

You can donate any amount of money to my paypal account. Simply click on the paypal button on the right. If you like to donate something other than money or you would like to donate using a different method than the one that paypal provides, you can e-mail me at kctoolbox@skynet.be anytime.

If you don't have much money to spent or you can't donate something that might help the development of my software, you can always help me out with your skills. If you think you have what it takes, you can post your "willingness" to help out in the "Help out" section of our forum.

And even then, if you don't have any money or skills, you can still help out. Simply click on one of my sponsers at the top and you have already helped KC's Toolbox!

You can donate a small amount using my PayPal account (*), by sending a cheque (**) or by transferring money on my account (**).

(* Click on the paypal button to donate)

(** information can be provided if you contact me by email at kctoolbox@skynet.be )

Besides a small donation we can use some skills in development, testing and other areas. If you think you have what it takes you can contact me at my forum: http://www.kctoolbox.tk.


Untitled Page

WinPcap remote capture

WinPcap 3.0 comes with Remote Capture capabilities. This is an highly experimental feature that allows to interact to a remote machine and capture packets that are being transmitted on the remote network.

This requires a remote daemon (called rpcapd) which performs the capture and sends data back and a local client that sends the appropriate commands and receives the captured data.

WinPcap 3.0 extends the standard WinPcap code in such a way that all WinPcap-based tools can expoit remote capture capabilities. For instance, the capabillity to interact with a remote daemon are added to the client software without any explicit modification to it. Vice versa, the remote daemon must be explicitely installed (and configured) on the remote machine.

Remote Capture Running Modes

The Remote Capture Protocol (RPCAP) can work in two modes:

  • Passive Mode (default): the client (e.g. a network sniffer) connects to the remote daemon, it sends them the appropriate commands, and it starts the capture.
  • Active Mode: the remote daemon try to establish a connection toward the client (e.g. the network sniffer); then, the client sends the appropriate commands to the daemon and it starts the capture. This name is due to the fact thet the daemon becomes active instead of waiting for new connections.

The Active Mode is useful in case the remote daemon is behind a firewall and it cannot receive connections from the external world. In this case, the daemon can be configured to establish the connection to a given host, which will have been configured in order to wait for that connection. After establishing the connection, the protocol continues its job in almost the same way in both Active and Passive Mode.

Analyzer (http://analyzer.polito.it/30alpha/) has a set of commands (in the File menu) that allows you to accept a remote connection and then start the capture on the remote device. Currently, Analyzer is the only tool that is able to work in active mode, since it requires some modifications to the application code.

Configuring the Remote Daemon (rpcapd)

The Remote Daemon is a standard Win32 executable running either in console mode or as a service. The executable can be found in the WinPcap folder and it has the following syntax:

        rpcapd [-b <address>] [-p <port>] [-6] [-l <host_list>] [-a <host,port>]
               [-n] [-v] [-d] [-s <file>] [-f <file>]

The daemon can be compiled and it is actually working on Linux as well.

Here there is a brief description of the allowed commands:

Switch Description
-b <address>
 It sets the address the daemon has to bind to (either numeric or literal). Default: it binds to all local IPv4 and IPv6 addresses.
-p <port>
 It sets the port the daemon has to bind to. Default: it binds to port 2002.
-4
 It binds only to IPv4 addresses. Default: both IPv4 and IPv6 waiting sockets are used.
-l <host_list_file>
 It specifies a file that keeps the list of the hosts which are allowed to connect to this daemon (if more than one, the file keeps them one per line). We suggest to use literal names (instead of numeric ones) in order to avoid problems with different address families (IPv4 and IPv6).
-n
 It permits NULL authentication (usually used with '-l', that guarantees that only the allowed hosts can connect to the daemon). Default: the username/password authentication mechanism is required.
-a <host, port>
 It forces the daemon to run in active mode and to connect to 'host' on port 'port'. This does not exclude that the daemon is still able to accept passive connections.
-v
 It forces the daemon to run in active mode only (default: the daemon always accepts active connections, even if the '-a' switch is specified).
-d
 Forces the daemon to run in background, i.e. as a daemon (UNIX only) or as a service (Win32 only). Warning (Win32): this switch is provided automatically when WinPcap installs this daemon into the Win32 services (control panel - administrative tools - services).
-s <file>
 It saves the current configuration to file.
-f <file>
 It loads the current configuration from file; all the switches specified from the command line are ignored and the file settings are used instead.
-h
 It prints an help screen.

Installing the remote daemon

The remote daemon is installed automatically when installing WinPcap 3.0. The installation process places the rpcapd file into the WinPcap folder. This file can be executed either from the command line, or as a service. For instance, the installation process updates the list of available services list and it creates a new item (Remote Packet Capture Protocol v.0 (experimental) ). To avoid security problems, the service is inactive and it has to be started manually (control panel - administrative tools - services - start).

The service has a set of "standard" parameters, i.e. it it launched with the "-d" flag (in orde to make it running as a service) and the "-f rpcapd.ini" flag. The user can create a file called rpcapd.ini in the same folder of the executable, and put the configuration commands in there. In order for the service to execute the commands, you have to stop and restart it again (i.e. the initialization file is parsed only at the beginning). Viceversa, the UNIX version of rpcapd is able to read the configuration file when sending a kill -HUP signal to it. In that case, all the existing connections remain in place, while the new connections will be created according to the new parameters.

In case the user does not want to create the configuration file manually, it can launch rpcapd with the requested parameters plus the "-s filename" one. The daemon will parse all the parameters and save them into the specified configuration file.

Launching the remote daemon as a standard executable

The rpcapd executable can be launched directly, i.e. it can run in the foreground as well (not as a daemon/service). The procedure is quite simple: you have to invoke the executable from the command line with all the requested parameters but the "-d" flag. The capture server will start in the foreground.

Launching a capture on a remote machine

If you are using a tool that is already aware of the remote capture (like Analyzer), everything is simple. The capture wizard will help you to locate the appropriate interface on the remote machine.

If your preferred tool is not aware of the remote capture, you can still use the remote capture. In this case you have to read the next Section.

Be carefully: the capture server (rpcapd) must be up and running on the remote machine.

New string specifiers for interface selection

If your preferred tool is not aware of the remote capture, the only thing you must do is to insert, as interface specifier, the indication of the remote machine you want to contact. The following forms are allowed:

Adapter String Description
file://filename
 It opens a local file.
rpcap://host.foo.bar/adaptername
 It opens a remote adapter; the host is specified by means of the literal name, without port number (i.e. it uses the RPCAP default port).
rpcap://host.foo.bar:1234/adaptername
 It is the same as before, but it uses a different port number.
rpcap://10.11.12.13/adaptername
 It opens a remote adapter, but the host is specified by means of an IPv4 numeric address, without port number (i.e. it uses the RPCAP default port).
rpcap://10.11.12.13:1234/adaptername
 It is the same as before, but it uses a different port number.
rpcap://[10.11.12.13]:1234/adaptername
 It is the same as before, but the numeric address is specified within square brackets (like IPv6 addresses).
rpcap://[1:2:3::4]/adaptername
 It opens a remote adapter, but the host is specified by means of an IPv6 numeric address, without port number (i.e. it uses the RPCAP default port). In case of IPv6 addresses you MUST use the square brackets.
rpcap://[1:2:3::4]:1234/adaptername
 It is the same as before, but it uses a different port number.
rpcap://adaptername
 It opens a local adapter, without using the RPCAP protocol.
adaptername
 It opens a local adapter; it is kept for compability, but it is strongly discouraged.
(NULL)
 It opens the first local adapter; it is kept for compability, but it is strongly discouraged.

The following formats are not allowed:

Adapter String Description
rpcap://
 It cannot be used to open the first local adapter.
rpcap://hostname/
 It cannot be used to open the first remote adapter.