Copyright: Copyright (C) 2000 Mark Russinovich


Introduction to TDImon
Copyright © 2000 Mark Russinovich

http://www.sysinternals.com

TDImon is an application that lets you monitor TCP and UDP activity on your local system. It is the most powerful tool available for tracking down network-related configuration problems and analyzing application network usage.

TDImon gets its name from the fact that it monitors activity at the Transport Driver Interface (TDI) level of networking operations in the operating system kernel. This is the interface to protocol stacks such as TCP and UDP. Thus, the I/O activity shown by TDImon corresponds to TDI-formatted commands. Most TDI commands have direct correspondence with WinSock (the Windows socket API) functions, and thus are easy to interpret. For documentation on TDI and the commands shown in TDImon, please see the Windows NT or Windows 2000 DDK, available for free download from Microsoft’s web site.

If you want a more user-friendly view of TCP and UDP activity, including automatic DNS name resolution, a static view showing existing endpoints, and more, please see TCPView Pro, available through Winternals Software (www.winternals.com).

TDImon works on Windows NT 4.0, Windows 2000, Windows 95 and Windows 98.


Starting TDImon

On Windows NT and Windows 2000, simply execute the TDImon program file (TDImon.exe) and TDImon will immediately start capturing TCP/IP activity. Note that if you run TDImon on Windows NT/2000 TDImon.exe must be located on a non-network drive and you must have administrative privilege. On Windows NT and Windows 2000 TDImon will only show remote addressed for endpoints opened after it has started. However, if you purchase and install TCPView Pro from Winternals Software (www.winternals.com), the TDImon driver, which is shared between TCPView Pro and TDImon, is installed at boot time so that you see all remote addresses.

On Windows 95 and Windows 98 TDImon must install its driver and requires a reboot to activate. To uninstall the TDImon driver, use the File|Uninstall menu entry.

As events are printed to the output, they are tagged with a sequence number. If your system generates TCP/IP activity faster than TDImon is capable of collecting and displaying, gaps in the sequence numbers may result. All TDI operations are asynchronous in nature, and if an operation finishes after other operations are initiated, the sequence number of the completion is shown in the Result column in the form “Status Code-Completion Sequence #”. For example, if an operation begins at sequence number 1, and another operation (tagged with sequence 2) initiates and completes before the first operation’s completion, the first operation will show SUCCESS-3 in its Result column.

Menus, hot-keys, or toolbar buttons can be used to clear the window, save the monitored data to a file, search output, and change the window font. Each time you exit TDImon it remembers the position of the window, the widths of the output columns, the font selection, configured filters, and the time-stamp mode.

Note: Filtering and highlighting are enabled only if you have the full version of TCPView Pro installed on your system. For information on ordering TCPView Pro, see Winternals Software (www.winternals.com).


Capturing Debug Output

Capturing TCP/IP Activity

Capture

You control TDImon’s capture mode by toggling capture-on and capture-off with the [image] toolbar button, the Capture|Capture Events menu entry, or the Ctrl+E hot-key sequence. TDImon does not capture any data from the computer you are currently viewing when its capture-mode is off.


Searching, Filtering and Limiting Output

Searching, Filtering, and Limiting Output

TDImon has several features that can help you zoom-in on the TCP/IP activity you are interested in. These capabilities include searching, filtering, and limiting the number of output lines saved in the display.

Clearing the Display

To reset the output window, use the Edit|Clear Display menu item, [image] toolbar button, or Ctrl+X hot-key sequence. This also causes the sequence number to be reset to 0.

Searching

If you want to search for a line containing text of interest you use the find dialog. The find dialog is activated with the Ctrl+F hot-key sequence, the Edit|Find menu entry, or the [image] toolbar button. If the search you specify matches text in the output window, TDImon will highlight the matching line and turn off the display’s auto-scroll in order to keep the line in the window. To repeat a successful search, use the F3 hot-key.

Filtering

Note: Filtering and highlighting are enabled only if you have the full version of TCPView Pro installed on your system. For information on ordering TCPView Pro, see Winternals Software (www.winternals.com).

Another way to isolate output that you are interested in is to use TDImon’s filtering capability. Use the Edit|Filter/Highlight menu item, [image] toolbar button, or Ctrl-L hot-key to activate the filter dialog. The dialog contains two edit fields: include and exclude. The include field is where you enter substring expressions that match TCP/IP activity lines that you want TDImon to display, and the exclude field is where you enter text for output lines that you do not want TDImon to display. You can enter multiple expressions, separating each with a semicolon (‘;’). Do not include spaces in the filter expression unless you want the spaces to be part of the filter. Note that the filters are interpreted in a case-insensitive manner, and that you should use ‘*’ as a wildcard.

As an example, say you want TDImon to display TCP/IP activity that contains either “temp” or  “winnt”, but want to exclude lines that contain word “system32”. To configure TDImon’s filters for this you enter “*temp*;*winnt*” for the include filter and “*system32*” for the exclude filter.

Highlighting

TDImon also has another type of filtering: highlighting. If you want output lines that contain certain text to be highlighted in the TDImon output window, enter a highlight filter. Use the same syntax just described for include and exclude filters. As soon as you enter a highlight filter all output lines that match the filter will be highlighted for easy recognition.

To change the colors used for the foreground and background of highlighted lines, choose the Edit|Filter/Highlight Colors menu item. You will be asked to pick colors from a palette, and your choices will be remembered by TDImon from run to run.

History-Depth

A final way to control TDImon output is to limit the number of lines that are retained in the display. You use the Edit|History-Depth menu item, [image] toolbar button, or the Ctrl+H hot-key sequence to activate the history-depth editor. Enter the number of output lines you want TDImon to retain and it will keep only that number of the most recent output lines, discarding older ones. A history-depth of 0 represents no limit on output lines retained.

You do not need to use the history-depth feature to prevent all of a system’s virtual memory from being consumed in long-running captures. TDImon monitors system memory usage and will go into a low-memory state when it detects that memory is running low. TDImon’s low-memory state consists of it not capturing further output until the low-memory condition is no longer in effect.


Saving and Printing

Saving, Printing and Logging

TDImon lets you both save and print captured output.

Saving Output

You can save the contents of the TDImon output window as a text file (.log extension) using the File|Save or File|Save As menu items, or the Ctrl+S hot-key sequence.

Using Edit|Copy or the Ctrl+C hot-key sequence you can copy the output contained within selected output lines to the clipboard.

Logging to a File

To have TDImon log output to a file as it displays it, use the Edit|Log to File or Edit|Log to File As menu items, the [image] toolbar button, or the Ctrl+O hot-key sequence. Log file settings you specify include the name of the log file, the maximum size it should be allowed to grow, and whether or not TDImon should restart the log or append to it if the file specified already contains output.

When logging is active the log file toolbar button will look like [image]. To stop logging simply select the toolbar button or the Edit|Log to File menu item. A log file maximum size of 0 signifies no limit on the log file size. If the log file’s maximum size is reached logging to the file stops and the logging toolbar button changes to [image].

Printing Output

You can use File|Print or File|Print Range to print the contents of the display to a printer. Choose Print Range if you only want to print a subset of the sequence numbers displayed, or Print if you want to print all the output records. The Ctrl+P hot-key sequence corresponds to File|Print.

Using the Print Range dialog you can also specify whether or not sequence numbers and timestamps will be printed along with the output. Omitting these fields can save page space if they are not necessary. The settings you choose are used in all subsequent print operations.

In order to prevent wrap-around when output lines are wider than a page, consider using landscape mode instead of portrait when printing.


Options

There are a number of options that let you adjust several characteristics of TDImon, including the way that it behaves and looks.

Timing Format

TDImon displays time stamps of captured output in one of two formats: as clock-time (the time of day), or as relative time. When displaying relative time TDImon represents the time of a output record as the difference between its timestamp and the timestamp of the first record in the display. This mode is helpful when you debug timing-related problems. Use the Options|Clock Time menu item, [image] toolbar button, or Ctrl+T hot-key sequence to toggle between clock time and relative time modes.

Show Time

The show time option lets you automatically hide or make visible the timing information TDImon displays for each logged event. You may want to hide timing information to make more efficient use of screen space if you are not interested in it.

Auto Scroll

Use the Options|Auto Scroll menu item, [image] toolbar button, or Ctrl+A hot-key sequence to toggle TDImon between auto-scroll and non-auto scroll modes. When in auto-scroll mode TDImon will always keep the most recent output visible in the display window.

Hiding the Toolbar

You can gain more display space by hiding the TDImon toolbar. Use the Options|Hide Toolbar menu item or Ctrl+B hot-key sequence to toggle the toolbar’s presence. TDImon will remember the toolbar state when you exit it and restore the same state the next time you start it.

Changing the Font

Use the Edit|Font menu entry to open a font-selection dialog where you can choose a font that TDImon will use in its output window.

Always on Top

To keep TDImon as the top-most window on the desktop, use the Options|Always On Top menu item. Selecting the menu item a second time will toggle off the always-on-top mode.


Technical Support

Reporting Problems

If you encounter a problem while running TDImon, please visit the Systems Internals web site (http://www.sysinternals.com) to see if an update has been released that might correct the bug. If the problem has not been fixed, please submit a thorough report of the problem, including information on your system configuration and details on how to reproduce the problem, to:

mark@sysinternals.com