System information

Packet Capture Mode 35
Windows to multi-task the receiving and analysis of the data going and
coming from the Observer PC.
• Do not include traffic from Observer/Probe local MAC address—excludes packets
sent and received from the station running Observer or Probe (the MAC address of
the station from which you are capturing packets).
• “Include Expert Load information marker frames” checkbox—When checked,
Observer will not strip out the timestamp informational markers used by Expert
Time Interval and What If analysis modes. Leave this box unchecked unless you
intend to use these modes.
• “Use circular packet buffer” checkbox—allows you to choose the buffer as fixed or
circular (first in, first out).
• Fixed buffers—capture packets until the size of all of the captured packets is
equal to the size of the buffer defined. At that time, Observer stops capturing
packets and can no longer accept any new packets until the buffer is cleared.
• Circular buffers—when the packet capture buffer fills, Observer will write
new packets to the end of the buffer and discard packets from the start of the
buffer. Using this feature allows you to continually run a packet capture, and
once the event of interest takes place, you can immediately go to the Observer
station and have the event recorded. You can record the event regardless of
how long and how much network activity preceded the event. The circular
buffer also allows you to save the buffer to sequentially labeled multiple files
(see below).
Saving the buffer to a file or files while capturing using a circular buffer:
• “Save packets to a file while capturing using a circular packet buffer” checkbox—
When checked, causes Observer to use a “FIFO” (first in, first out) buffer for
packet capture.
• “Maximum file size (MB)” checkbox—Specify the largest file you want written
out to your hard disk. The valid range is from 1MB to 2000MB.
Saving partial packets:
• “Enable capturing partial packets” checkbox—by default, Observer will capture
the entire packet. This option allows you to define a specific amount of each packet
to capture to the buffer. For example, a setting of 64 bytes will result in Observer
only capturing the first 64 bytes of every packet.
Most of the pertinent information about the packet (as opposed to the information
contained in the packet) is at the beginning of the packet, so this option allows you
to collect more packets for a specific buffer size by only collecting the first part of
the packet.