over the of a fileserver or a gateway, for example. scale and sampling period for histograms, and the method of orde- Where a monitor can associate alarm conditions with network ring entries for tables. stations, it is useful to detect: When a new station appears on the network (sometimes called 61.4.2.4 Further processing an intruder alarm). 2. When an important station, such as a server, seems to have The more powerful network monitors provide sophisticated features stopped transmitting (a dead station). for the user to control: For the latter, it is necessary to specify the requisite period of 1. Which statistics are to be collected. silence before the alarm should be generated. For client-server 2. What filtering and manipulation is to be performed. based communication that involves hello or uptime packets, it is 3. How the data is to be stored and displayed. quite straightforward to set this time. For less deterministic traffic, the user will probably have to specify quite a long time period. However, it is still important for the user to be able to transfer When an alarm is detected, the network monitor will probably statistical records and tables to disc to enable subsequent post make an audible signal. It might also be possible to use the alarm to processing. Most network monitors provide a mechanism to either trigger some other action, such as packet capture. record a snapshot of a table at the user's request, or periodically make a summary entry to a disc file. 61.4.4 Packet capture and decode Files of statistics may be processed by the user's own software to perform analysis specific to the user's needs. The files may even be Traditionally, it has been the role of the protocol analyser to record in a form that enables them to be read into a standard software conversations between stations on the network and present a chro- package for more generalised processing, such as report generation. nological sequence of packets in an interpreted form. However, The user is able to produce reports that are tailor