Inter-Office MemorandumToDistributionDateJuly 12, 1982FromAndrew BirrellLocationPalo AltoSubjectPupwatchOrganizationPARC/CSLXEROX Filed on:[Indigo]Pupwatch>Pupwatch.bravo and Pupwatch.press1.IntroductionPupwatch is a program for observing PUP packets on your local Ethernet network. It will runon any computer that can run Alto/Mesa 6.0 or Cedar. Pupwatch operates by making the computerpromiscuous, so that it will accept every well-formed Ethernet packet on the attached network. Itthen filters these packets to select only the packets which are from or to the particular PUP hostcurrently being watched.Pupwatch has a reasonable understanding of the common PUP packet types, the PUP ByteStream Protocol and the Leaf "Sequin" protocol. On the display, Pupwatch shows you a summaryof packets interactively as they arrive. By explicit command, you can cause Pupwatch to write adisk file containing details of the packets received.2.User InterfaceThere are two entirely different user interfaces for Pupwatch: one on Altos (or machinesemulating Altos) and one when running under Cedar.2.1.Alto-MesaWhen it starts up, Pupwatch initialises its display, then prompts you with the message "Host(NLS-name or Net-address):". You should then type the PUP address of the host you want towatch. This may be a PUP address constant such as "3#17#" (note the second "#"), or it may bea Name Lookup Server text name such as "Ivy"; any socket number is ignored. Pupwatch willthen display PUP packets it receives whose source or destination address matches the networknumber and host number you have given. Note that a network number is needed: Pupwatch isconcerned with packets on the PUP Internet, not just Ethernet packets. The address you give neednot be on your local network: if it is on another network, Pupwatch will perform the samefiltering, to show you any packets addressed to or from that host which happen to pass throughyour local network. Unless you intervene, Pupwatch will now sit there forever showing you packetsas it receives them. There are several commands you may type.If you type a "?", Pupwatch will tell you the available commands. Typing a space causesPupwatch to stop displaying packets; typing another space will cause it to continue. WhilePupwatch is waiting for you to tell it to continue, it is still receiving packets and buffering them(subject to not getting more than 150 packets ahead of the last packet displayed); it will display]gpi c8q]r -q7BrX ]q]r -q7Br Yq]r-q 7BrSsr NqF]r*X Ft2 2Curqr5 B> @7u rS >m5%qr <2:6qrqr 9 /. 7BH 5x5 0_t2 2-zrY +2 &u22#rU !7qr qr> Q9"  qr$( D qr$ '!9 \^ @" >2I 2T gU !A  U=^%PUPWATCH2these packets when you let it continue. If you type an "h", Pupwatch will prompt you for a newhost name; if you successfully give it a new host name, Pupwatch will re-initialise itself and watchfor packets to or from that host. If you type "q" Pupwatch will terminate (returning to the disk ornet executive as appropriate).If you type an "s", Pupwatch will enter "slow" mode. In this mode it will wait for you to typea space after every 40 packets (so that packets don't go by faster than you can read them). If youtype an "f", Pupwatch will leave "slow" mode and return to the default "fast" mode. If you typean "r", Pupwatch will replay buffered packets. Pupwatch retains at least the previous 150 packets,and up to 300. While replaying, Pupwatch is still receiving and buffering incoming packets (subjectto not getting more than 150 packets ahead of the one being displayed). Using the "r" commandcauses Pupwatch to enter "slow" mode as if you had also given the "s" command.If you type a "w" (and you are not running Pupwatch.boot), it will write a log of the bufferedpackets to the disk file "Pupwatch.log". The first use of this command commences writing at thestart of Pupwatch.log; subsequent uses of this command during a single run of Pupwatch append tothe file. Multiple uses of the "w" command will not cause a packet to be written to the file morethan once. The details of the text written to the file for each packet are described below.Pupwatch.log is formatted with the assumption that you will look at it with a fixed pitch font.Printing it with Empress.run and the default font (Gacha 8) works well.2.2.CedarThe operations available when running under Cedar are basically the same as under Alto-Mesa.Instead of being invoked by keyboard commands, they are invoked by buttons. When it starts upunder Cedar. Pupwatch initializes itself to watch the host that it is running on. You can change thehost being watched by typing a host name or address constant in the text area following the "Host:"label then clicking "New Host". Click the "Pause" button to cause Pupwatch to stop displayingpackets; this also causes the "Pause" button to change into a "Continue" button. The "Fast" and"Slow" buttons allow you to flip between "fast" and "slow" mode; the current mode is indicatedby its button being gray. When Pupwatch pauses in "slow" mode, the "Pause" button changes intoa "Continue" button. The "Write Log" button writes (or appends to) the disk log file; a viewerfor the log file is created if necessary.Two extra switches are available under Cedar. The "Yes" and "No" buttons following the"Broadcasts:" label control whether or not to display broadcast packets that would be received bythe host being watched. The "Normal" and "Background" buttons following the "Priority:" labelcontrol the priority of the process that displays packets; using background causes less perturbationto processes on the machine where Pupwatch is running, but may cause the display process to getfar enough behind that it misses packets. The current state of the "Broadcasts" and "Priority"decisions is indicated by the appropriate button being gray.Closing the Pupwatch viewer has no effect on Pupwatch's state; it continues as if it was open.Destroying the Pupwatch viewer takes your machine out of promiscuous mode. It isn't sensible torun two instances of Pupwatch at one time.3.Displayed PacketsEach packet displayed occupies a single line. Typical lines might look like:1234: from 60#354#234 [aData,to:37064,L:52] as??ghjk&frqG?r b4+ `S [ ^22 \2Z=" Y)O W^7) U8+ S<( Q^ P4N2Ni"< LG J] I I G?K EtF CG >u22;r+1 9.0 850 6K#@ 4&8 2-4 0_ /!/0 -VP +)2)S '?" &,G $aA$ ">! *5 <27@ l R * t22rM(v6 >YL@PUPWATCH340: to 60#354#234 [ack,to:37014,pups:5]123s: from 3#14#532 [mailCheckL,Birrell.PA]The first number is the number of milliseconds that elapsed between receiving the previouspacket and receiving this one. If this number would be greater than 9999, it is displayed as thenumber of seconds (for example "123s"). Intervals greater than 999 seconds are given as "long".The time interval is in decimal; all other numbers in Pupwatch are in octal. The clock used forthis interval timing has a period of about 42 minutes; wrap-around of this clock is not detected.The time is followed by either "from" or "to" then an address of the form "a#b#c", where"a#b#" is the source or destination host of the packet (the destination or source is the host thatyou are watching), and "c" is the bottom 8 bits of the corresponding socket number. Then insquare brackets is a summary of the packet. The summary always starts with the packet type, thenhas various details depending on the type. For many packets, the number of data bytes in thepacket is given in the form "L:123". For packets involved in the PUP Byte Stream Protocol, thesedetails include the bottom 16 bits of the sequence number at which this packet ends. For packets oftype "data" or "aData", the packet summary is followed by the first few characters from the datapart of the packet (with non-printing characters replaced by "?").4.Logged PacketsWhen you use the "w" command, Pupwatch writes three lines to the log for each presentlybuffered packet that hasn't so far been logged. Typical lines might look like:1234: from 60#354#234 [aData,to:37064,L:52] ID=432,37012 from=554,16234 to=6642,123 as<0><1>ghjkeirukhfiekrhfg<15>pierutyzx 141 163 0 1 145 150 152 153 145 151 162The first line contains the time interval, the source or destination, and the packet summary asgiven for displayed packets. The remainder of the first line contains the PUP packet ID, sourcesocket number and destination socket number, each written as a pair of 16 bit octal numbers. Thesecond line contains up to the first 50 characters of the data part of the packet, with non-printingcharacters replaced by "". The third line contains up to the first 25 data bytes ofthe packet as octal numbers.5.LimitationsPupwatch can buffer up to 300 packets, although it will only buffer up to 150 packets ahead ofthe one currently being displayed (to ensure that the "replay" facility works). If it runs out ofbuffering space and this might cause it to ignore a packet to or from the host being watched, thenthe message "Packet(s) lost" is displayed (or logged) when that point in the packet sequence isreached. On an Alto (or Alto emulator), although Pupwatch's Ethernet driver tries hard to avoidmissing packets it will occasionally miss packets that are successfully received by other hosts(because Pupwatch must inspect every packet on the local Ethernet). Pupwatch does not detect thishappening. Running under Cedar, the Ethernet driver should see all packets, unless insufficientprocessor time is available to it. When Pupwatch is running under Cedar to watch the host it isrunning on, Pupwatch guarantees to see all packets received by the Pup socket level or Cedar's RPCruntime. Pupwatch will not receive PUP packets having more than 532 data bytes.6.Released Versions&frqG?r(bAv+(`-2]r< \17* ZfO X3. Va U2& S</3 Qq\ O?" M@ L$qr JG9ur H|W FB At2 2>r K <O:'vS8S7S24^rM 2Fqrqr 0a .J -3G +i &Ot2 2#jrI !!A D  @ @H uP ur> @ 1/ K20 $qr) gt2 ^ >[9PUPWATCH4Pupwatch is available in four versions: Pupwatch.boot, Pupwatch.run, Pupwatch.bcd andPupwatch.df. Each version has its advantages. Pupwatch.boot is network bootable on Altos (orAlto emulators), but it does not have the disk logging facility. Pupwatch.run needs to be invokedfrom the Alto disk executive. Pupwatch.bcd runs on Altos and is much smaller than Pupwatch.run,but you need to have Runmesa.run and Mesa.image on your disk. Use Pupwatch.df to runPupwatch under Cedar.Pupwatch.boot is installed on the Ivy boot server; on network 3, it may be booted by namefrom the network executive, or by booting an Alto while holding down the "backspace" and "L"keys. The availability of Pupwatch.boot on other networks depends on it being installed there bygateway or IFS administrators. Pupwatch is boot file number 40; it may be copied from[Ivy]Boot>40-Pupwatch.boot. The other Alto versions may be copied from[Indigo]Pupwatch>Pupwatch.run and Pupwatch.bcd. The Cedar version can beobtained by using Bringover to fetch the public file from [Indigo]Top>Pupwatch.df.7.MaintenancePupwatch will be maintained at a leisurely pace for as long as it is useful to CSL. If you havecomments, suggestions (including requests for interpretation of extra protocols) or bug reports, senda message to LaurelSupport.pa.Last edit: July 12, 1982 3:22 PM&frqG?r2bV `S Q ^.4 \B ZQ Y)2W^K UX SE Q qr'" P4(' Ni2M3 LY Gt2 2DrOqr B-8 A  ;t rf ;=,` TIMESROMAN  TIMESROMAN TIMESROMAN LOGO TIMESROMAN  TIMESROMAN GACHA  lj/ ZiPupwatch.bravo Birrell.paJuly 12, 1982 3:32 PM