NOVELL TECHNICAL INFORMATION DOCUMENT TITLE: Limited Version of LANalyzer TID #: 2908065 README FOR: LZFWLF.EXE NOVELL PRODUCTS and VERSIONS: LANalyzer for Windows 2.2 Requestor/Redirector - NWC43NT Server Communications-IW411 ABSTRACT: LZFWLF.EXE is a "Limited Feature Version" of "LANalyzer for Windows 2.2" which provides enough of "LANalyzer's functionality, to allow you to Capture Packets. It is provided solely to help you work with a Novell Technical Support Engineer on the solution of a problem. NOTE: This utility was created to help system administrators and is provided free of charge as a courtesy. It is not a Novell supported product. ----------------------------------------------------------------- DISCLAIMER THE ORIGIN OF THIS INFORMATION MAY BE INTERNAL OR EXTERNAL TO NOVELL. NOVELL MAKES ALL REASONABLE EFFORTS TO VERIFY THIS INFORMATION. HOWEVER, THE INFORMATION PROVIDED IN THIS DOCUMENT IS FOR YOUR INFORMATION ONLY. NOVELL MAKES NO EXPLICIT OR IMPLIED CLAIMS TO THE VALIDITY OF THIS INFORMATION. ----------------------------------------------------------------- INSTALLATION INSTRUCTIONS: Things to Consider First ------------------------ LZFWLF supports: - NetWare Client 32 for Windows 95 - Windows 3.x. - Open Data-Link Interface (ODI) drivers - 16bit NetWare Client on both Windows 3.x and Windows 95 - Network Device Interface Specification (NDIS) drivers (using VMLID.NLM). Refer to "PROBLEMS WITH NDIS DRIVERS" and "SUPPORTED 32-BIT NETWORK DRIVERS" (below) for more information. LZFWLF requires: Certified adapters that include promiscuous mode and pass errors. NOTE: Promiscuous mode enables the driver to pass all packets received by the adapter, including packets not specifically addressed to the network adapter. Promiscuous mode also includes the adapter's ability to support multicast addressing and error capturing. Issues to consider: - 16bit or 32bit? - Novell ODI drivers or Microsoft NDIS drivers? To Install LZFWLF ----------------- 1. "Explode" LZFWLF.EXE into an empty directory on your C: drive. 2. Novell's Client (16bit NetWare Client or NetWare Client 32) must be installed before you install LZFWLF. Note: LZFWLF does not support the Microsoft Client. 3. In the Windows Program Manager, run the SETUP.EXE that comes with LZFWLF. 4. Follow the prompts EXCEPT: - When the installation program asks you for the directory to install LZFWLF into, do NOT choose the directory you exploded it into. - Do NOT bother to read the README when prompted to do so. Some of the information in it applies only to the full LANalyzer product. 5. If you are running the 16 bit NetWare Client, setup will automatically add statements at the end of your AUTOEXEC.BAT, to load DI.COM and APPLE.EXE (assuming you chose to allow Setup to update your AUTOEXEC.BAT during installation). Actually, they must be loaded prior to running Windows. To Use LZFWLF ------------- 1. Click on the LANalyzer Icon. 2. You will see a menu bar across the top. Ignore the "Monitor" "Alarms" and "Help" menu items. They do not work with this "limited" version. 3. Set the options you want with "Capture" menu item. 4. Start the capture. 5. Before you save the file, use the "Decode" menu item. 6. Use the "File" menu item to save the file. Note: You can use the Name Gathering feature to display station names instead of MAC addresses. You can gather station names for one NDS tree at a time. (this limited version can only deal with 5 stations at a time) If You Have Problems Running LZFWLF ----------------------------------- - First try selecting a 32 bit ODI driver. - If your network adapter does not support the 32 bit ODI driver, select a 32 bit NDIS driver. - If neither of these options work properly, select a 16 bit ODI driver. Refer to your client installation documentation for specific instructions. NOTE: Setup checks to see what version of the client is running. It copies the appropriate files to run LZFWLF on that client only. If you switch from one client to another (for example, from the 16 bit NetWare Client to NetWare Client 32), you must reinstall LZFWLF. PROBLEMS WITH NDIS DRIVERS -------------------------- Note: NDIS drivers are not certified by Novell; therefore, we cannot guarantee their operation with LZFWLF. When running NetWare Client 32 with some NDIS network drivers, you may encounter a number of problems, such as LZFWLF not seeing packets and stations on the network segment. A newer version of VMLID.NLM fixes those problems. If you are running on a token ring network and using an NDIS driver, you cannot capture your own workstation's transmitted packets from protocols bound to the NDIS driver (for example, Microsoft TCP/IP). SUPPORTED 32 BIT NETWORK DRIVERS 32 bit network drivers that have been tested or confirmed to work with LZFWLF. Please note that this list is not definitive because additional drivers may be available by the time you install LZFWLF. Novell ODI Drivers - CNE2000.LAN - CNE2100.LAN - MADGEODI.LAN - SMC8100.LAN - XPSODI.LAN Microsoft NDIS Drivers The NDIS drivers listed below require the VMLID.NLM, which is included in Novell NetWare Client 32 for Windows 95. - EE16.SYS - EE16MINI.SYS - MDGMPORT.SYS - NE2000.SYS - SMC8100W.VXD QUESTIONS AND ANSWERS --------------------- 1. What do I need to load before I run Windows and LZFWLF? Setup automatically loads the appropriate programs for your system (when you allow Setup to modify your system files during installation). If you are running the 16-bit NetWare Client, the following software is loaded when you run LZFWLF: - LSL.COM - TKENH.COM (if you are running on a token ring network) - The driver for the network adapter in your workstation. - IPXODI.COM - VLM.EXE or NETX.EXE Note: To check a driver's version number, run it using a question mark (?). For example, at the DOS prompt, type LSL ? If you are running NetWare Client 32, the following software is loaded when you run LZFWLF: - NIOS.EXE (for Windows 3.x) or NIOS.VXD (for Windows 95) - The driver for your workstation's network adapter. The driver must be bound to all the frame types used on the network. - LSLC32.NLM - CMSM.NLM - ETHERTSM.NLM (for Ethernet) or TOKENTSM.NLM (for token ring). - IPX.NLM - CLIENT32.NLM 2. If I am using the 16 bit NetWare Client, can I run LZFWLF without VLM.EXE and IPXODI.COM? Yes. However, if you do not load VLM.EXE before running Windows, you cannot gather NetWare names on Ethernet or token ring networks. 3. Can I use LAN WorkPlace while running LZFWLF? Yes. 4. Do I need to be logged in to a NetWare server to run LZFWLF? No. However, you must log in if you want to access the server while you are running LZFWLF. 5. Does LZFWLF support FDDI or other network types? No. LZFWLF supports Ethernet and token ring networks only. ADJUSTING MEMORY USAGE ---------------------- When attempting to load LZFWLF, you may receive a message from Windows indicating that your system does not have enough memory to run some applications. If you receive such a message, you need to determine whether you do not have enough Windows virtual memory or DOS conventional memory. 1. Check virtual memory. If the amount of virtual memory seems to be too small, increase the size of your Windows virtual memory or close other applications. In Windows 3.x, go to the Program Manager to find out how much Windows virtual memory you have. Then select Help > About Program Manager. The amount of virtual memory available to your system will be displayed. You can change your virtual memory setting through the Control Panel. Select the 386 Enhanced icon; then click the Virtual Memory button. Change the value as necessary and restart your system. In Windows 95, virtual memory is managed automatically. 2. Checking conventional DOS memory. If your system's virtual memory appears to be sufficient for the applications you are trying to run, you probably do not have enough conventional DOS memory. Conventional DOS memory is the first 640 KB of memory. Every Windows application must have a small amount of conventional memory to run. When all the conventional memory is in use, you cannot start additional applications. To make more conventional memory available, do the following: a. Eliminate some resident DOS programs (TSRs) or load them in high memory (above 640 KB), instead of loading the TSRs in conventional memory. b. Close any other applications. KNOWN PROBLEMS -------------- 1. If you are running LZFWLF on a Windows 95 system configured with multiple network adapters, you may receive the following message: "Multiple network adapter drivers are currently loaded, but only one can be loaded when running LZFWLF." Disable all but one network adapter driver, then restart LZFWLF. LZFWLF registers a dial-up adapter that is sending or receiving data as a network adapter. To run LZFWLF with this system configuration, disable all the adapters except the one you want to use with LZFWLF. To do so, follow these steps: a. Select Settings > Control Panel. b. Double-click the System icon. The System Properties dialog page will appear. c. Select the Device Manager tab. d. Select Network Adapter. e. Double-click Network Adapter. The Network Adapter Properties page will appear. f. In the Device Usage box, deselect Original Configuration and click OK. To restore the disabled adapters, repeat steps a through e, then select Original Configuration. 2. If you install NetWare Client 32 for Windows 3.x, edit STARTNET.BAT to make sure that all four Ethernet frame types and both token ring frame types are loaded for the network driver. If all the frame types are not loaded, LZFWLF may not capture all the different types of packets on your network segment. Ethernet Frame Types Token Ring Frame Types ETHERNET_802.3 TOKEN-RING ETHERNET_802.2 TOKEN-RING_SNAP ETHERNET_II ETHERNET_SNAP 3. If your system is running the 16-bit NetWare Client, you cannot run LZFWLF and the BOUNDS-CHECKER for Windows simultaneously. 4. You may encounter a problem when running the NetWare Client on COMPAQ DESKPRO systems on which the Power/Energy Saving features are enabled. We recommend that you disable the Power/Energy Saving features on COMPAQ DESKPRO systems when running the NetWare Client. 5. Setting a large capture buffer may cause Windows to page memory to disk to accommodate the buffer, thus causing other applications to be paged out of memory. This may cause problems for other applications. 6. When using a shared memory Ethernet adapter, ensure that the adapter interrupt level is set lower than that of the mouse. Therefore, if the mouse is on COM1, its interrupt is IRQ 4. Thus, the adapter interrupt should be IRQ 3 or less. 7. The 3Com 3C5x9 series of network adapters has problems capturing error packets. We recommend that you do not use these network adapters with LZFWLF. 8. You may receive messages indicating that DI.COM, APPLE.EXE, or TKENH.COM are already loaded. These messages occur when all the following conditions are true: a. You have previously installed LANalyzer for Windows or LZFWLF. b. You are running a memory manager or you load the DI, APPLE, or TKENH statements in your AUTOEXEC.BAT or STARTNET.BAT into high memory. c. You chose to allow Setup to modify the AUTOEXEC.BAT and STARTNET.BAT during installation. When these three files are loaded into high memory, setup does not detect them and inserts the DI.COM and APPLE.EXE statements into AUTOEXEC.BAT and inserts the TKENH.COM statement into the STARTNET.BAT file, thus creating duplicate entries for these statements. To fix the problem, follow these steps: a. Delete the relevant LOADHIGH statements from AUTOEXEC.BAT and STARTNET.BAT. b. Run the memory manager's memory optimization program. c. Restart your system; then restart LZFWLF. 9. You may encounter problems when running network software on laptop computers connected to docking stations. To resolve specific problems, we recommend that you contact your laptop vendor. ISSUE: LZFWLF.EXE is a "Limited Feature Version" of "LANalyzer for Windows 2.2" which provides enough of "LANalyzer's functionality, to allow you to Capture Packets. It is provided solely to help you work with a Novell Technical Support Engineer on the solution of a problem. Occasionally Novell Technical Support Engineers will request that you get a packet trace of a problem occurring to help determine the cause. You can send in a trace in sniffer or LANalyzer format. To get a limited version of LANalyzer download lzfwlf.exe from http://support.novell.com, file finder. LANalyzer for Windows can be installed only on Win95 and Windows 3.x. It can trace any node on the network (including OS/2, NT etc), however, it cannot be run from an NT, Macintosh or OS/2 machine. The network adapter in the machine running LANalyzer will need to be able to support promiscuous mode. Follow these steps when using LANalyzer: 1. Select "Filter..." under the "Capture" menu. You will want to verify with the engineer how the filter should be set. (See additional notes below) Typically you will not want to capture all LAN traffic. In most cases you will manually enter the 12 digit MAC address of a workstation and capture all traffic going to and from that workstation (arrow going both ways). Generally it is good to set up LANalyzer on a separate workstation so that running LANalyzer does not affect the trace (especially when you are tracing a performance issue). NOTE: To get the mac address of the card, you can use nlist user= /b /a 2. You may need to increase the Packet Buffer size. Select "Options" under the "Capture" menu. The default is 256K. Usually increasing the buffer size to 1024K is sufficient. When taking the trace watch the dial on the upper right hand side of the dashboard. When that fills up with green then it has started to overwrite the beginning of the trace and you may need to increase the buffer size and start the trace again. 3. Press the 'Start' button from the Dashboard window to start the trace. Then create the problem you are trying to capture. After the error has happened, select the 'Stop' button, then select 'View' (Ctrl-B). While viewing the Capture Buffer, select File, 'Save Unfiltered Packets' (Ctrl-U) and type a file name (with the default .tr1 extension). 4. We prefer that you zip the files that you upload, using the .zip as a naming convention, i.e. 1234567.zip. You can include a readme.txt if there is any information you would like to include with the trace. 5. Upload the file to ftp.novell.com/incoming or to our BBS: 801-373-6999. Once the file has been uploaded please notify your technician that it is there by updating the incident on the web at http://support.novell.com/elecinc/elecinc.htm or by calling 800-858-4000. *Additional Notes: A common procedure for taking a trace would be to try to get two traces, one of a workstation that works and one of a workstation failing. When doing this, it is important that the exact same steps are followed in each trace so they can be accurately compared. The following steps are useful in this case: 1. Install LANalyzer on a workstation other than the one that you are tracing, set the filter for all traffic going to and from the workstation you will be tracing. That workstation should be off before you start the trace. 2. Start the trace, then turn on the target workstation. Once you have completed logging in and the operating system has finished loading, then write down the packet number showing in the LANalyzer dashboard (or other trace utility). 3. As you recreate the error, between each step make a note of the packet number once that step has completed. For instance, load the application -write down packet number, open a file -write down packet number etc. etc. 4. Once the issue that you are trying to capture has been completed, you can stop the trace, save it and send the trace in to Novell for analysis. Include a note indicating the steps that were followed and the packet number at the end of each step for each trace. Self-Extracting File Name: LZFWLF.EXE Files Included Size Date Time ..\ LZFWLF.TXT (This file) INS0762.LIB 70101 5-6-1996 10:54:26 am LZFW.INI 8338 5-6-1996 10:01:20 am LZFW22.1 739254 5-6-1996 10:56:14 am LZID.DLL 4096 5-6-1996 10:14:20 am LZREADME.WRI 22656 5-6-1996 10:01:58 am SETUP.EXE 276480 5-6-1996 10:02:02 am SETUP.INS 21881 5-6-1996 10:54:20 am SETUP.PKG 1226 5-6-1996 10:56:16 am ----------------------------------------------------------------- Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information. -----------------------------------------------------------------