LGOSystems Logo
Home
Products
Cognatrix
FrameSeer
FrameSeer Online Help
tcpdumpd
Stripper
IPGadget
Purchase from Kagi
Support
About LGOSystems
FrameSeer Help
Controlling the capture tab display

You can use the View menu to control how information is presented in the Capture tab.

View/Capture

You can control which columns are displayed by using this hierachical menu.

Frame Number
The sequence number of the frame in the current capture session or file.
Source Address
Either the Network Source Address or, if that isn’t available, the Data-Link Source Address.
Data-Link Source Address
The Medium Access Control (MAC) address of the sending device.
Network Source Address
The Layer Three address of the sending device (eg IP address, AppleTalk network and node address).
Destination Address
Either the Network Destination Address or, if that isn’t available, the Data-Link Destination Address.
Data-Link Destination Address
The Medium Access Control (MAC) address of the receiving device (unicast), or a multicast or broadcast MAC address.
Network Destination Address
The Layer Three address of the receiving device (eg IP address, AppleTalk network and node address), or a multicast or broadcast equivalent.
Protocol
One of the following (in order of precedence):
  • Transport Source Protocol>Transport Destination Protocol
  • Network protocol
  • Data-Link Protocol
Data-Link Protocol
The type of network protocol encapsuled within the frame (eg IP).
Network Protocol
The type of transport protocol encapsulated within the packet (eg TCP).
Transport Source Protocol
The identifier (socket, port) the sending station associates with this type of datagram. Some identifiers are protocol-specific (eg HTTP) whereas others are random.
Transport Destination Protocol
The identifier (socket, port) the receiving station associates with this type of datagram. Some identifiers are protocol-specific (eg HTTP) whereas others are random.
Length
The length of the frame when it was transmitted. Note that this does not necessarily indicate the amount of data actually captured (see Capture Preferences).
Date/Time
The date and time when the packet was captured.
Mark
Indicates whether the frame is marked or not.

You can choose which columns are shown by default when you open a new FrameSeer document via Capture Preferences.

When you use the View/Capture menu to turn on a column, it is always placed at the right hand side of the display. You can drag the columns into any order. You can also resize the columns as required.

Auto scroll

In dynamic mode, FrameSeer automatically scrolls the Capture tab as new packets are added. You can use this command to toggle this feature on and off. Turning auto-scrolling off allows you to inspect the information in the Capture tab without it moving off the screen before you are ready.

You can control whether automatic scrolling is enabled by default when you open a new FrameSeer document from Document Preferences.

Domain Names

DNS resolution during capture in DNS Preferences explains how to control the resolution of domain names.

The names supplied by the DNS are cached. Therefore, only the first use of Domain Names will cause DNS lookups. Thereafter, all name information will be retrieved from the cache.

If you enable Domain Names and FrameSeer appears to stop responding for up to 20 seconds, the most likely explanation is one of the following:

  • The DNS server in your IP configuration is wrong. If the address of the DNS server in your IP configuration does not point to a host that is reachable, name resolution will not work. You can check reachability using a tool like ping.
  • The DNS server in your IP configuration is correct but the name-services daemon on that host has stopped running. The DNS server needs to be both reachable and running the name-service daemon in order for name resolution to work. You can check whether the name-service daemon is running using tools like nslookup and dig.

Keep the following in mind during your investigations:

  • DNS servers can be configured manually or via DHCP. If your Macintosh obtains its configuration via DHCP, you may need to check that the DHCP server is supplying the correct DNS servers. Be aware that your DHCP server may also obtain its information dynamically.
  • More than one DNS server can be configured at a time. If only one server in a list is wrong, you may experience intermittent problems as resolution bounces between working and non-working servers.
  • DNS problems are often transient. For example, the administrator may have restarted your DNS server. It is often worthwhile to wait a few minutes and try again.