LAN Analyzer and Protocol Decoder - CommView

Prev Page Next Page
About CommView
What's New
Using the Program
Selecting Network Interface for Monitoring
Latest IP Connections
Viewing Logs
Advanced Rules
Reconstructing TCP Sessions
Reconstructing UDP Streams
Searching Packets
Statistics and Reports
Using Aliases
Packet Generator
Visual Packet Builder
NIC Vendor Identifier
Using Remote Agent
Capturing Decrypted SSL Traffic
Capturing Loopback Traffic
Port Reference
Setting Options
Frequently Asked Questions
VoIP Analysis
Working with VoIP Analyzer
SIP and H.323 Sessions
RTP Streams
Call Logging
Call Playback
Viewing VoIP Logs
Working with Lists in VoIP Analyzer
NVF Files
Advanced Topics
Capturing High Volume Traffic
Working with Multiple Instances
Running CommView in Invisible Mode
Command Line Parameters
Exchanging Data with Your Application
Custom Decoding
CommView Log Files Format
How to Purchase CommView

Selecting Network Interface for Monitoring

Monitoring your network connection begins with selecting the network interface that you will monitor. Selecting the correct network interface for monitoring is crucial for achieving the desired monitoring results. We tried to make CommView as simple and user-friendly as possible, all you need to do to start monitoring your network is select an adapter in the drop-down list in the toolbar and click on the Start Capture button.

As network technologies develop, more and more different adapter types become available in the market. WiFi adapters, xDSL, you name them. CommView supports many of them; however, each type of network connection has its own peculiarities that you need to know in order to obtain proper monitoring results.

Let us walk through the list of the most common types of network adapters and see how CommView operates with them and how it should be configured.

During installation, CommView detects the network adapters available in your system. At some point, the installation script will prompt you to install the driver for your dial-up adapter. You need to click Yes if you plan to monitor your dial-up network or your xDSL connection, or use PPPoE/VPN over other types of network connections. If you say No at this point, you can always install the dial-up adapter driver later on by clicking Settings => Install Dial-up Driver. During the dial-up driver installation your network links will be brought down for a moment.

Once the installation is completed, launch CommView and click on the drop-down list in the toolbar. You will see the Loopback adapter, your Local Network adapter (if you have one), and your dial-up adapter (if you clicked Yes when prompted to install dial-up driver).

Let's see how these entries correspond to the actual hardware in your computer and the network connection types.

If you are connected to the network via an ordinary Ethernet adapter, just select it from the drop down list and start monitoring. CommView supports virtually any 10, 100, or 1000 Mbit Ethernet adapter available on the market.

If you dial-up via modem to connect to the network, select your dial-up adapter for monitoring. Please note that you will only see incoming and outgoing packets (and no pass-through packets) in CommView. This is not a limitation of CommView. Such is the nature of any point-to-point connection; only two hosts, the local and the remote participate in the connection. If you use ICS, you will capture all packets to and from the ICS clients.

When using CommView for monitoring wireless 802.11 a/b/g/n/ac networks, select your Wi-Fi adapter for monitoring. General purpose drivers cannot put Wi-Fi adapters in promiscuous mode; CommView will show incoming and outgoing packets, as well as multicast and broadcast packets. 802.11 packet headers will not be displayed. If you are looking for a promiscuous mode monitoring solution for Wi-Fi networks, consider CommView for WiFi that actually puts your wireless adapter into monitoring mode and allows you to capture traffic from other wireless stations and APs. CommView for WiFi can be downloaded from the TamoSoft Web site.

If your network connection is via an xDSL modem with USB interface, you may be able to monitor it with CommView. Officially, we do not support USB interfaces in CommView, so the best thing is to try. In many cases the actual network connection will be established over PPPoE link, in which case you will need to select the dial-up adapter for monitoring and will be able to capture the network traffic.

If your xDSL modem has Ethernet interface, but the actual connection is made over PPPoE link, select the dial-up adapter for monitoring the network traffic to/from your computer, and broadcast/multicast packets. If you select your Ethernet adapter for monitoring, you will be able to capture all packets on the LAN segment, however they will be PPPoE encapsulated and may be encrypted.

If you are connected to the network via a secure VPN link, monitoring your Ethernet network adapter will only allow you to capture encrypted packets. In this case you need to monitor the dial-up adapter to capture the actual data being transmitted.

If you have two or more network adapters in your computer that are Bridged, monitoring the Bridge will show incoming and outgoing traffic for each adapter in the Bridge, broadcast and multicast packets, and the packets being redirected to another bridged network adapter.

Monitoring Loopback adapter will show you the local traffic sent or received over TCP/IP by the programs running on your computer.  If you do not have any programs running that exchange data locally, you won't see any traffic when monitoring Loopback adapter. Please note that the Packet Generator function will not work with the Loopback adapter. For more information please see the Capturing Loopback Traffic chapter.

In addition to physical and virtual network adapters, the latest CommView version allows for selecting a virtual adapter for capturing decrypted SSL traffic. These SSL virtual adapters are overviewed in the Capturing Decrypted SSL Traffic chapter.