d to 61.4.4.3 Protocols capture only those packets that match one of the patterns. Hence, the sample of packets will record all packets explicitly sent or received Just as there is great variety in the display of interpreted packets, by the identified server. Notice that to capture every packet associ- there are great differences between the range of protocols supported ated with the server would also require additional patterns specif- by network monitors. Most monitors will cope with the commonest ying appropriate broadcast and multicast, or functional, addresses. low level protocols, such as TCP/IP. For higher protocol layers, or In addition to providing a filtering facility, network monitors also other protocol families, it is often possible to purchase additional allow the user to specify a condition, or combination of conditions, software modules to extend the basic decodes provided by the that must be satisfied before any packet capture commences. These monitor. may be dependent on a certain packet sequence occurring, or the Some network monitors support a facility whereby users can write raising of an alarm or even a specified time. their own protocol decode functions. The user will write pro- The ability to specify a time at which packet capture is to start is grammes using pre-defined library functions, and then link the code useful when the user is interested in the conversations that occur with that of the monitor. This will be particularly useful for protocol during scheduled events. A typical example of this is filesystem developers, or users of proprietary protocols. network backups. Backups are performed automatically at times of low activity, such as during the night. The way in which most network monitors perform the interpreta- tion of network protocols results in a fundamental limitation to the The limit to the size of the capture buffer used to store conversa- detail provided in higher protocol layers. This derives from the fact tions varies greatly between different monitors. Monitors with t