hat the recording of conversations, and consequently the decode lower limits are restricted to storing captured packets in memory, and display of the detail of those conversations, are all performed either the network adapter's or that of the system. Devices with on a packet basis. This is different to the operation of the protocol larger buffers achieve this in a number of ways: implementation on the interacting stations. 1. Copying captured packets directly to disc. Since the time to The layering of protocols serves to conceal the packet oriented nature of low level network protocols from the higher levels. The transfer data to the disc is quite long, this method restricts the speed at which packets may be received. Sensible use of the higher protocol layers are concerned with transactions, conversa- system memory for buffering will help to smooth out bursts of tions or sessions. Applications software on one machine will con- traffic. duct a conversation with peer level software on another machine, 2. Using a RAM disc (a virtual disc that actually comprises a oblivious to the way in which the conversation is broken up into packets, transmitted across the network and reassembled at the other dedicated area of system memory). The buffer is not as large as for a real disc, but the limitation on the packet capture rate is eased. However, network monitors interpret protocol information on a Packet slicing, a technique whereby only part of the captured packet by packet basis. Consequently, it is difficult to interpret high packet is stored, the rest being discarded. This approach ex- level protocol information in a packet in the midst of a conversation tends the limit at little cost, as long as the section of packet because the context in which that packet falls is unknown. stored is sufficient for the user's needs. This may be true for Network monitors compromise by either making semi-intelligent lower protocol layers, but is much harder to achieve for higher guesses, based on 'hints' in the lower level protocols, o