Overview Report

The Overview Report is the primary, tabular view displayed in Report Page - Figure 2 and in Figure 1 below.


Figure 1.  Overview Report example

This interactive view displays a listing of the records in the trace file which currently is loaded.  The user may change the set of columns displayed by selecting from any of the Overview Report templates available, or may create new reports as necessary.  Functions associated with this view include:


Report Templates


Understanding the Data

The Overview Report table may contain a varying number of columns, depending upon which report template a user has selected to view the information in the currently loaded trace file.  In the example shown in Figure 1, the HTTP report template is being displayed, which presents data related to the Hypertext Transfer Protocol.  This report template also uses data in the TCP, IP, and capture-level protocols.  The columns in a report template can draw data from any protocol recognized by the Trace Analyzer, combining this information in a way most useful to the reader.  For information on creating and editing report templates, please refer to the Customizing Reports section.

The Mark Column

This column appears as the first column in any report template, regardless of the other columns in the template.  Each cell in this column contains a checkbox, which is used to bookmark the record displayed in that row.  Please refer to the Bookmarks section below for more information about bookmarks.

Field Data Columns

Most other columns in a report template will be normal data columns, which extract and format information from individual fields within specific protocols.  For example, in Figure 1, the Frame # column extracts the record number from the CAP protocol, the Source IP and Destination IP columns extract source and destination IP addresses, respectively, from the IP protocol, the Src Port and Dest Port columns extract source and destination port numbers, respectively, from the TCP protocol, etc.

Certain cells in a data column may contain no data at all.  This simply indicates that the record being represented by the row in question does not contain data matching the data required by that column.  For example, if a report column is used to display a TCP source port number, and a record is encountered which is not a TCP/IP frame (and therefore does not contain a TCP header with the source port number), no information will be displayed for that record in that column.

Since trace files may contain records composed of a wide variety of protocols, report templates are likely to contain columns which require data from protocols which may or may not appear in all records in a given trace.  This can lead to a situation where a report contains many blank cells and is difficult to read.  Two functions are built into the Trace Analyzer to help overcome this difficulty:


Summary Interpretation Column

This is a specialized data column which can be added to a report to provide a compact summary of the innermost (i.e., highest level) protocol in each record.  It is usually the last column in a report template.  The text of the summary interpretation information in each row of the table is color-coded to match the color assigned to the innermost protocol for that record.  An example of a Summary Interpretation column can be seen in Report Page - Figure 2.

Customizing the Display

The Overview Report can be changed directly from this view, in order to interpret the currently displayed trace records in different ways:

Selecting a New Report Template

The current report template can be replaced using the Select Report Template action in the Report Toolbar.  All columns in the table (except the Mark column) are immediately removed and replaced with the columns defined in the newly selected template.  Changing the current report template does not affect the trace file being viewed.  Nor does if affect the data filter, if any, which is currently applied to that data.  It simply changes which data are being extracted and viewed from the same underlying trace records.
To draw a distinction between report templates and data filters, the report template affects which columns (i.e., protocol data fields) are being viewed, while the data filter affects which rows (i.e., trace records) are being viewed.
The last report template to be selected during a Trace Analyzer session will be the template displayed the next time the application is started, unless overridden by the user with the -report command line option.

Changing Column Width

While this change does not necessarily change the current report's content, it may cause the data displayed to be truncated, if the column is not wide enough to display all the data.  This change is made by positioning the mouse directly over the right edge of any column header and dragging that edge to the left or right.  The mouse button which initiates the drag may differ, depending upon your operating system.  The column immediately to the left of the dragged edge is the column which is resized.  Any change made to a column's width is recorded as a permanent change to the current report template.  Column width may also be set from the Report Configuration Page.

Raw vs. Interpreted Data

Clicking the mouse on the header of any column in the Overview Report toggles between the display of interpreted data and raw data in that column.  The colors are displayed normally (light text, colored background) when the column is in Interpreted Data mode (see Figure 2).  The column header colors are inverted (colored text, light background) when the column is in Raw Data mode (see Figure 3).  Note that for some data, there is no difference in the raw data and interpreted data representations.  Clicking the header will have no effect on the data display, though the column header will still toggle between inverted and normal display.  Any change made to a column's data representation mode is recorded as a permanent change to the current report template.  The data mode for a particular report column may also be set from the Report Configuration Page.

Figure 2. Interpreted Data Mode

Figure 3. Raw Data Mode

Report columns which are defined to display interpreted data will first apply any end-user symbolic name aliases to the raw data.  If none are found to match the data, the standard interpretation supplied by the program's protocol definitions, if any, is applied.  If at this point, still no interpretation has been applied, the raw data is displayed in the column, formatted according to that column's format clause.

Note:  Interpreted data mode can be set globally via the Use aliases checkbox in the User Preferences Configure - Preferences dialog window.

Report Toolbar

The Report Toolbar runs across the top of the Overview Report table.  This toolbar provides controls to perform the actions described in Table 1:

Control
 Action Description
Select Report Template This combo box allows the user to select the current report template to apply to the Overview Report from a list of preconfigured report templates.  The Overview Report is immediately refreshed upon the selection of a new report.
Select Previous Bookmark Clicking this icon moves the current row selection backwards to the closest, previous, bookmarked record.  The search for the previous bookmarked record begins at the currently selected record, whether or not it is bookmarked.  The search will not wrap around to the end of the trace.
Select Next Bookmark Clicking this icon moves the current row selection forwards to the closest, next, bookmarked record.  The search for the next bookmarked record begins at the currently selected record, whether or not it is bookmarked.  The search will not wrap around to the beginning of the trace.
and 
 Toggle Bookmark View This control toggles between the two icons displayed.  When in its first state, clicking on this icon will cause the Overview Report to display only bookmarked records.  When in its second state, clicking on this icon will cause the Overview Report to revert back to displaying both marked and unmarked records.
Find Previous Clicking this icon causes the search engine to apply the data filter selected in the "Select Find Filter" combo box in reverse order to each record previous to the currently selected row.  The first row which contains a record which is accepted by the data filter is selected.  At this point the search ends.  If no record is found which matches the data filter's criteria, the search ends unsuccessfully.  The search will not wrap around to the end of the trace.
Find Next Clicking this icon causes the search engine to apply the data filter selected in the "Select Find Filter" combo box in forward order to each record following to the currently selected row.  The first row which contains a record which is accepted by the data filter is selected.  At this point the search ends.  If no record is found which matches the data filter's criteria, the search ends unsuccessfully.  The search will not wrap around to the beginning of the trace.
Select Find Filter This combo box is used to select a data filter to apply in all subsequent "Find" operations, from a list of preconfigured data filters.
Show Hidden Columns Overview Reports may contain data columns which are normally hidden from view.  Selecting this checkbox displays those columns.  Deselecting this checkbox hides those columns.  See also the Customizing Reports - Column Attribute Components section.
Select Row The user may type a record number into this entry field and press the <Enter> key.  If the record number which the user entered exists in the current Overview Report view, it is selected.  If not, the closest available record (previous or next) is selected instead.  This entry field is automatically updated whenever the Overview Report row selection changes.
Table 1.  Overview Report Toolbar actions

Bookmarks

Bookmarks are a mechanism provided for the user to flag certain records in the Overview Report as noteworthy.  Bookmarks serve the following purposes in the Trace Analyzer: Records may be bookmarked using the Mark report column, which always appears as the left-most column in the Overview Report (see Figure 1).  To mark a record, click with the mouse in the checkbox for the desired record when the checkbox for that record is empty.  This action will bookmark the record in the row that was clicked. A checkmark will appear in the checkbox to signify this.  If the checkbox is clicked while already checked, that record will be unmarked.

The Trace Analyzer supports bookmarking any number of records, up to the total number of records in a trace.  The same set of bookmarks is maintained, regardless of any data filter which may be applied against the trace data.  Bookmarked records which are excluded by a particular data filter simply are not displayed in the Overview Report when that filter is applied;  however, these records remain bookmarked.

A list of bookmarks for a given trace file is maintained persistently between Trace Analyzer sessions in a configuration file.  Trace files are not edited to retain bookmark information.  Please note that any list of bookmarks in the configuration file is always associated with a particular trace file by that file's fully qualified pathname.  If that trace file is moved to another directory, this association is broken and bookmark information for that trace file is lost.

Navigating Trace Records

A single row in the Overview Report table view may be selected at any given time.  Selecting a row in the Overview Report highlights that row and has the effect of selecting the associated trace record.  Selection of a trace record updates the contents of the Detailed Interpretation Report and the Hex Dump Report, such that each of these secondary reports will display data pertaining to the selected record.  A row may be selected in one of several ways:

Printing an Overview Report

This report can be printed from the Printing Reports File - Print menu item.  See the Printing Reports section for additional information.

Copyright © 2000-2001 Golden Code Development Corporation.  ALL RIGHTS RESERVED.