Stopping Sniffer Trace Automatically When LM WS Fails

READ THIS FIRST

NOTE: This article applies to Microsoft LAN Manager WORKSTATIONS only. If you are trying to stop a Sniffer trace automatically when a server or Windows for Workgroups or NT workstation fails, use article

INTRODUCTION

A common problem when trying to capture network traces after LAN Manager workstation failures is that nobody is there to notice and stop the Sniffer. The Sniffer should be configured to filter out only packets sent to and from the workstation, but that may not be limiting enough.

This article explains how to trigger a Sniffer to stop automatically when there is a workstation failure. The method involves running a batch file that repeatedly attempts to send a packet to the failed workstation. When the batch file detects the failure, it sends a broadcast message (STOP THE SNIFF) to the domain, and the Sniffer triggers on it.

Obviously the batch file has to be run on a machine other than the one that is monitored for a crash.

"STOP THE SNIFF" BATCH FILE

Depending on the protocol in use, the text string "STOP THE SNIFF" may appear at different offsets in your trace, so some other steps are necessary:

1. Turn on Sniffer and trace broadcasts from your test machine.
2. Type net send /d:mydomain STOP THE SNIFF. (Mydomain can be a non-existent domain if you want to avoid bothering people.)
3. Stop Sniffer and examine the trace to find the offset of the string STOP THE SNIFF.
4. On the top level of the Sniffer menu, make sure Trigger is checked.
5. From the Trigger menu, select Pattern Trigger.
6. Select "Match 1."
7. From the Pattern menu, select "Pattern =" and press ENTER.
8. Enter the pattern in HEX (53544F502054484520534E494646)and press ENTER.
9. Select "Offset =", enter your offset (TCP/IP = E5) and press ENTER.
10. On the main Trigger menu, make sure "Stop capture" is checked.
11. From the main menu select filtering, being careful to include messages sent from your test machine to "broadcast" and "NetBIOS."
12. Press F10 and test it out.

Once the Sniffer triggers, be sure to save the file to disk immediately-- in non-compressed format if you are going to mail it to Microsoft Product Support Services.