> Tools | Insert Comment Frame
>
> My NetMon is described as:
>
> Retail 349 Jul 10 1996
> Network Monitor V4.00.349
>
> It's from the NT Enterprise Server CD-ROM.
OK, that's probably the one bundled with NT Server.
The one I have claims to be
Retail 316 Jun 23 1995
Network Monitor Version 1.1
although I'm not sure what "Retail" means here; I'm loath to call it
"Retail" unless I can buy a box at Fry's with Network Monitor in it; I've
seen no way to just buy it, by itself....
Microsoft may not believe this, but sometimes people running Boring Old
NT Workstation, not NT Server or even NT Server with SMS, might well
want to capture packet traces going into and out of their box. I guess
they have to buy (or otherwise get) stuff from somebody else....
It lacks that menu item.
> After looking at the decode for the TRAIL and STATS "layers" that NetMon
> shows, adding a dissect() routine for the TRAIL and STATS layers to
> ethereal would be easy enough. But they'd have to be taken into
> consideration when using the Summary routines in ethereal.
Perhaps it belongs in "wiretap" instead - have some way of getting
statistics out of a capture file after you've finished reading it (you
have to keep track of the drop counts in "snoop" files as you read the
packet, etc., so you can't necessarily get the statistics until you've
read the entire file), with "wiretap" not returning that stuff as a
frame.
