Home
Contents

LAN Analyzer and Protocol Decoder - CommView

Prev Page Next Page
 
Introduction
About CommView
What's New
Using the Program
Overview
Selecting Network Interface for Monitoring
Latest IP Connections
Packets
Logging
Viewing Logs
Rules
Advanced Rules
Alarms
Reconstructing TCP Sessions
Reconstructing UDP Streams
Searching Packets
Statistics and Reports
Using Aliases
Packet Generator
Visual Packet Builder
NIC Vendor Identifier
Scheduler
Using Remote Agent
Using RPCAP
Capturing Loopback Traffic
Port Reference
Setting Options
Frequently Asked Questions
VoIP Analysis
Introduction
Working with VoIP Analyzer
SIP and H.323 Sessions
RTP Streams
Registrations
Endpoints
Errors
Call Logging
Reports
Call Playback
Viewing VoIP Logs
Working with Lists in VoIP Analyzer
NVF Files
Advanced Topics
Capturing High Volume Traffic
Working with Multiple Instances
Running CommView in Invisible Mode
Command Line Parameters
Exchanging Data with Your Application
Custom Decoding
CommView Log Files Format
Sales and Support

Logging

This tab is used for saving captured packets to a file on the disk. CommView saves packets in its own format with the .NCF extension. The old (.CCF) format is supported for backward compatibility; however, you can no longer save the captured packets.  You can open and view these files at any time using Log Viewer, or you can just double-click on any NCF or CCF file to have it loaded and decoded.

NCF is an open format; please refer to CommView Log Files Format chapter for detailed NCF format description.

Save and Manage

Use this frame to save the captured packets manually to a file and to concatenate/split capture files.

It is possible either to save all packets currently stored in the buffer or save only a part of them within a given range. The To and From fields allow you to set the necessary range based on the packet numbers as shown on the Packets tab. Click Save As … to select a file name.

To concatenate manually multiple NCF files into a single, larger file, click on the Concatenate Logs button. To split NCF files that are too large in size into smaller chunks, click on the Split Logs button. Then the program will guide you through the process, and you will be able to enter the desired size of the output files.

Auto-saving

Check this box to have the program automatically save captured packets as they arrive. Use the Maximum directory size field to limit the total size of the capture files stored in the Log Directory. If the total size of the capture files exceeds the limit, the program automatically deletes the oldest files in the directory. The Average Log File Size field allows you to specify the approximate desired size of each log file. When the log file reaches the specified size, a new file is automatically created. To change the default Log Directory, click on the Save files to box and select a different folder.

IMPORTANT: If you want to have an important capture file stored for a long time, don't keep it in the default Log Directory: there is a chance it will be automatically deleted as new files are being saved. Move the file to a different folder to preserve it.

Please note that the program doesn't save each packet individually immediately upon arrival. It means that if you view the log file in real time, it may not contain the latest packets. To make the program immediately dump the buffer to the log file, click Stop Capture or uncheck the Auto-saving box.

WWW Access Logging

Check this box to enable logging of HTTP sessions. Use the Maximum file size field to limit the size of the log file. If the log file size exceeds the limit, the program automatically deletes the oldest records in the file. To change the default file name and path, click on the Save files to box and select a different file name. Log files can be generated in HTML or TXT formats. Click Configure to change the default logging options. You can change the port number that is used for HTTP access (the default value of 80 might not work for you if you are behind a proxy server), and exclude certain data types (usually logging anything other than HTML pages is quite useless, therefore it is a good idea to exclude URLs of pictures from the log file).