System information

Packet Capture Mode 41
• “Append packets to existing file” checkbox—when selected, allows you to add
packets to the existing file.
• “Replace hardware address in all saved packets” checkbox—when selected,
enables hardware address substitution in the saved buffer.
• “Original address” dropdown—allows you to determine which hardware
address will be searched for during the replacement. The hardware address
must be entered manually the first time it is used. Observer will remember ten
previously-entered addresses. This box is only enabled when the “Replace
hardware address in all saved packets” checkbox is selected.
• “New address” dropdown—allows you to determine which hardware address
will be replaced during the replacement. The hardware address must be
entered manually the first time it is used. Observer will remember ten
previously-entered addresses. This box is only enabled when the “Replace
hardware address in all saved packets” checkbox is selected.
As the changes are made in the saved buffer file, and not in the buffer
loaded into Observer, in order to change several hardware addresses, it
will be necessary to change while saving and then reload the buffer file for
each subsequent change.
• Save Packet Buffer in Sniffer® Format—displays the Save Packet Capture dialog
to save the current Observer packet buffer in Sniffer® format. This is useful for
sites that require the sending of Observer capture buffers to Sniffer® users for
viewing or analysis. The following extensions will be used (depending on the type
of buffer being saved):
*.enc—for Ethernet captures
*.trc—for Token Ring captures
*.fdc—for FDDI captures
*.cap—for CAP formats
You can read a Sniffer® formatted buffer by selecting “Load Capture
buffer in Sniffer® format” from the main Observer “File” menu item.
• Save Decode as Text—displays the Save Decode as Text dialog and allows you to
save the current packet buffer to a text file. This differs from “Save Capture
Buffer” in that it will save the buffer in text format (to be viewed by a text editor),
where the option under “Save Capture Buffer” saves the packet buffer in
Observer’s buffer format for the Observer viewer to read at a later date. You will be
given a choice of packet numbers to print. The default is set for all captured
packets. However, if after reviewing a packet’s contents in the “View Packets”