Nestar ARCNET Sniffer

The ARCNET Sniffer developed as an internal test tool by Zynar, used the IBM PC ARCNET Network Interface Card developed by Nestar for the PLAN networking systems. That board used the COM9026 integrated ARCNET controller from Standard Microsystems Corporation, which had been developed in collaboration with Datapoint.

There was no promiscuous mode in the SMC chip that would allow all packets to be received regardless of the destination address. So to create the Sniffer, a daughterboard^[19] was developed that intercepted the receive data line to the chip and manipulated the data so that every packet looked like a broadcast and was received by the chip.

Since the ability to receive all packets was viewed as a violation of network privacy, the circuitry implementing it was kept secret, and the daughterboard was potted in black epoxy to discourage reverse-engineering.

The source code of the original TART/Sniffer BASIC and assembler program is available on GitHub.^[20]

Network General Sniffer

The Sniffer was a promiscuous mode packet receiver, which means it received a copy of all network packets without regard to what computer they were addressed to. The packets were filtered, analyzed using what is now sometimes called deep packet inspection, and stored for later examination.

The Sniffer was implemented above Microsoft’s MS-DOS operating system, and used a 40-line 80-character text-only display. The first version, the PA-400 protocol analyzer for Token-Ring networks,^[21] was released on a Compaq Portable II “luggable” computer that had an Intel 80286 processor, 640 KB of RAM, a 20 MB internal hard disk, a 5+1⁄4-inch floppy disk drive, and a 9” monochrome CRT screen. The retail price of the Sniffer in unit quantities was $19,995.^[22]

The two major modes of operation^[13] were:

• “capture”, in which
  • packets are captured, stored, counted, and summarized
  • filters control which packets are captured
  • triggers control when capture should stop, perhaps because a sought-after network error condition had occurred
• “display”, in which
  • packets are analyzed and interpreted
  • filters control which packets are displayed
  • options control which aspects of the packets are displayed

Navigation of the extensive menu system on the character-mode display was through a variation of Miller columns that were originally created by Mark S. Miller at Datapoint Corporation for their file browser. As the Sniffer manual described, “The screen shows you three panels, arranged from left to right. Immediately to the left of your current (highlighted) position is the node you just came from. Above and below you in the center panel are alternative nodes that are also reachable from the node to your left… To your right are nodes reachable from the node you're now on.”

Pressing F10 initiated capture and a real-time display of activity.^[21]

When capture ended, packets were analyzed and displayed in one or more of the now-standard three synchronized vertical windows: multiple packet summary, single packet decoded detail, and raw numerical packet data. Highlighting linked the selected items in each window.

In the multiple-packet summary, the default display was of information at the highest level of the protocol stack present in that packet. Other displays could be requested using the “display options” menu.

The translation of data at a particular level of the network protocol stack into user-friendly text was the job of a protocol interpreter (PI). Network General provided over 100 PIs^[23] for commonly used protocols of the day:

Decoding higher protocol levels often required the interpreter to maintain state information about connections so that subsequent packets could be properly interpreted. That was implemented with a combination of locally cached data within the protocol interpreter and the ability to look back at earlier packets stored in the capture buffer.

Sniffer customers could write their own protocol interpreters to decode new or rare protocols not supported by Network General. Interpreters were written in C and linked with the rest of the Sniffer modules to create a new executable program. The procedure for creating new PIs was documented in April 1987 as part of Sniffer version 1.20.^[24]

In addition to supporting many network protocols, there were versions of the Sniffer that collected data from the major local area networks in use in the 1980s and early 1990s:

• IBM Token-Ring
• Token Bus
• Ethernet (thick, thin, twisted pair)
• Datapoint ARCnet
• Starlan
• AppleTalk
• Corvus Omninet
• FDDI
• ISDN
• Frame Relay
• Synchronous Data Link Control (SDLC)
• Asynchronous Transfer Mode (ATM)
• X.25
• IBM PC Network (Sytek)