Mode of Operation

Choosing the Mode of Operation

Network Trace has two, mutually exclusive modes of operation. This choice is coded into the PROTOCOL.INI configuration file and can only be changed at IPL time.

Each instance of NTRACE (separate DEVICE= statements in CONFIG.SYS) can be configured with a different mode. However, there is very little reason to ever install in this manner.

Protocol Mode

The first mode is known as "Protocol" mode. This mode uses the same core design that was provided in Network Trace for OS/2 v1.0. The concept of protocol mode is it is implemented as a protocol driver, along-side drivers such as NetBEUI, LANDD and IP. A single instance of NTRACE can be loaded and bound to all MAC drivers. When tracing is active, NTRACE copies every frame which is visible to it, and when inactive, it is completely dormant. This makes for a simple and non-intrusive architecture, however protocol drivers have some limits in the availability of facilities of the NDIS environment. Specifically, in some cases it will not ever get an opportunity to see certain frames and in other cases it does not get the opportunity to see the entire frame. In other words, this design's advantages and disadvantages stem from its design as an "end user" of the NDIS environment. This mode has the advantage where it is necessary to have a less intrusive installation. However, the "trade-off" for using this mode is a set of tracing limitations.

cannot capture outbound frames when using Ethernet LAN adapters
some LAN adapters force frame slicing
increased risk of lost frames

Service Mode

The second mode is known as "Service" mode. This is an alternate design that is implemented in Network Trace v1.1. The concept of service mode is that the tracing software is installed as a layer in the middle of the NDIS networking "stack". An instance of NTRACE is loaded in CONFIG.SYS for every MAC driver on which tracing needs to occur. Each of these instances is then bound to a specific MAC driver. Then the protocol drivers which need to be bound to that MAC driver are bound to the NTRACE driver. This means that it has a more complete access to the facilities of the NDIS environment. It is designed to resolve the limitations of Protocol mode, but it does so at the cost of being more intrusive to the environment. The advantages and disadvantages of this mode derive from its design as an integral part of the flow of every frame in the NDIS networking, rather than as just an "end user" of NDIS facilities.

an active participant in the NDIS networking at all times (as opposed to participating only while tracing is active), this consumes a small amount of CPU time
involved in the transmission or reception of every frame
more complex configuration

as an NDIS layer, the bindings must be changed for every protocol and MAC which need to participate in tracing
this means that there are changes to multiple sections of PROTOCOL.INI, where protocol mode just required the insertion of a single new section for each instance of NTRACE

more complex implementation, especially in regards to the heavy optimization which was built to support an environment which minimizes or eliminates lost frames under even the most stressful conditions

Golden Code recommends that service mode be used wherever possible. Service mode will yield the best possible tracing results. This is especially true in environments which experience heavy network traffic.