ed to the needs of many network monitors will also provide a similar function, albeit the target audience. One example would be an annual summary of restricted to the lower protocol layers, or with less detail in the 61/14 Telecommunication system measurements analysis. For most users, the service provided by a network monitor Sophisticated packet decode facilities may include a windowed is more than adequate, but for network protocol developers the display, with every packet shown in a variety of layouts, as specified added sophistication, and expense, of a protocol analyser is justi- by the user. The full name of every field will be given, along with fied. the corresponding value and a suitable mnemonic. It may be possible to focus on one protocol layer, with higher and lower layers suppressed from the display. The monitor could even summarise 61.4.4.1 Triggering and filtering each packet on a single line to enable rapid browsing. With such diversification in the means of decoding packets it is Sometimes it will be necessary to record all of the traffic on the worth considering the true merit of packet decode. The majority of network for a period of time. However, it is more usual to require protocol related faults that occur on networks are associated with just a single conversation, or group of conversations, to be captured. the lower layers, and are frequently due to the improper configura- The network monitor will have a number of filters that the user can tion of a network device. For such problems, the packet capture and use to specify patterns that must be matched before a packet is decode facilities provided by most network monitors are more than stored. adequate. The more sophisticated features are only really of use in It is often possible to define a logical relationship between a a development environment. number of patterns. For example, 2 patterns could be set up such that a server address is specified as the source in one pattern and the destination in the other. The monitor can then be instructe