r just give up layers. and display the data in hexadecimal and ASCII. The only effective means of overcoming this limitation is by copying a sequence of packets to a disc file and then using a specialised analysis package. 61.4.4.2 Presentation The standard of protocol decode performed on the captured packets 61.4.4.4 Post processing varies enormously between network monitors. At its simplest, the display may comprise a sequence of packets with the protocol types Special purpose high level protocol decode software has a limited identified and the important fields of the lowest network layers applicability, and SO is not widely used. It overcomes the packet interpreted to show mnemonics with associated field values. oriented approach to protocol decodes by behaving like the original Data communications network measurement 61/15 protocol implementation on the network stations. Hence, every different packets that together form a pattern or signature. By packet's context is meaningful. sending a particular series of packets to a single network station, it The main audience for this type of software is protocol developer- may be possible to stimulate it into behaving in a desired way. For S. In fact, the software results from a re-engineering of the original example, a network server might respond with status information if protocol implementation. To perform protocol decode, the software sent an authentic request, which could be simulated by the monitor. will have been changed to read packets from the disc rather than the Alternatively, where the monitor is able to retransmit captured network, and provide output to the screen instead of replying to packets, the pattern might be suspected of having caused a network received packets. fault. Replaying the packet sequence will give the user the oppor- The advantage of using this type of software tool is the implicit tunity to monitor the effect more carefully. validation of the operation of the protocol implementation being monitored. This is of greatest significance whe