*****************************************************************
*********  Bloodhound Beta  *********  Bloodhound Beta  *********
*****************************************************************

	  ***********************************************

          INFORMATION & FUTURE FEATURES:  Bloodhound Beta  

 	 			B3GUIDE.TXT
 
	  ***********************************************


This file provides information on known bugs and future features 
of the Microsoft Network Analyzer for Windows, codenamed 
Bloodhound.  For an overview of the information on Bloodhound, 
please see the README.TXT in this directory.

Bloodhound is now code complete but is still undergoing testing. 
We're counting on you to help us find bugs.  In order to limit 
the number of duplicate bugs or requests, this file lists some
known bugs and features that are already being considered for
Product 2.  Please look in these lists before sending a bug 
report form.  Send the bug report form to BHBETA@microsoft.com 
(see README.TXT for detailed information).


General Information about this release
--------------------------------------
*  Bloodhound is not supported on WFW311 if you are using a 
   NDIS2.0 Mac or any real mode protocol stacks.  There are 
   known problems with the interaction of Bloodhound and the 
   WfW mapper functionality that may cause erratic behavior of 
   Bloodhound.

*  Be careful allocating large buffers for captures.  If you 
   allocate close to the limit for your computer's virtual
   memory, then subsequent actions (such as setting the crop
   frame size) may cause problems.  If you are capturing on a
   remote connection, DO NOT set a capture buffer larger than
   physical memory!

*  Some features are not supported on 16-bit platforms, so are
   only available with NT:
	- cannot connect to a remote agent
	- cannot be a remote agent
	- cannot open multiple instances of Bloodhound

*  Capturing RAS traffic on a RAS link (not the same as capturing 
   traffic a LAN over a RAS connection) is only supported on the
   Daytona Beta platform.

*  If you see 'Unsupported' in the Network Card (MAC) Statistics
   section and Network Card (MAC) Error Statistics section of the
   statistics pane in Capture window, don't panic.  These are
   statistics that are provided to Bloodhound from the Network
   Card, also known as the Media Access Control or MAC.  Thus it
   is up to the developer of the network card driver to choose to
   return these stats, or not.  If the developer who wrote the 
   system software driver for your network card chose not to 
   return them, Bloodhound would not be able to display them.  
   It's the driver that determines whether you will get stats in 
   the MAC boxes in the stats pane of the Capture window.

*  Many user interface features are not accessible from the
   keyboard, such as pane and column resizing.

*  You can close all the Frame Viewer Windows, but you can't 
   close the Network Capture Window if you entered Bloodhound
   with the capture capability enabled.

*  If you entered Bloodhound without the capture capability 
   enabled (you used the display password) then you can never
   open the Network Capture Window.

*  Bloodhound can't read Network General sniffs for version 4.30 
   if they have been saved in compressed format.  Re-save the 
   capture on Network General without compression and Bloodhound
   will read it.

*  If you want to use password protection for display and capture 
   mode you must enter at least a capture password, if not both a 
   display password and a capture password.  That is, the capture 
   password should not be blank.

*  If you want to get rid of BROADCAST and MULTICAST at capture
   time, use the NOBROAD.CF capture filter provided in the 
   Bloodhound captures directory, usually c:\bh\captures.

*  If you want to get rid of BROADCAST and MULTICAST at filter
   time, use the NOBROAD.DF display filter provided in the 
   Bloodhound captures directory, usually c:\bh\captures.

*  The boolean NOT in filters cannot be used for address 
   expressions.  If you want to exclude addresses, use the 
   Exclude radio button in the Address Expression dialog and add 
   the address pair as usual.  (Use the NOBROAD.CF as an 
   example.)

*  When you are using a Windows (not Windows NT) machine and do
   not have a mouse installed, and thus have installed the 
   NOMOUSE.DRV driver, AND then try to maximize Bloodhound with
   the keyboard, the keyboard will lock up.  The workaround is to 
   always install a mouse driver, even if a mouse is not hooked 
   up to the system.  

*  When you type a Hex pattern match in Capture Filter, be sure
   you have it in xx xx xx... form.  For example, if you want the
   pattern match to be 0x0006, you will have to enter 06, not 6, 
   in the Pattern entry box.  Similarly, if you want it to be 
   0x0800, you will have to enter 0800, not 800, in the Pattern 
   entry box.

*  Do not comment out or modify the lines that appear in the 
   [BLOODHOUND] section in PROTOCOL.INI, or the registry 
   parameters associated with Bloodhound.  You will not be able
   to logon, some of your Windows applications may not work, or
   mysterious problems will occur.

*  3Com cards, that use 02608C as the first three bytes of their
   MAC-address, are interpreted by BH as having locally
   administered addresses.

*  If when you identify users of Bloodhound on the network, you 
   see "Unknown Query Flags (000E or 0006)", that means that
   that user is using an old build of Bloodhound.  When everyone
   has upgraded to a current build, then this problem will
   disappear.

*  The trigger action "Pause" has been removed.  The problem with
   Pause was that it is very hard to determine what behaviour is 
   expected when you continue capturing:  to trigger repeatedly or 
   not.

*  SMB Properties Help
   For many of the SMB protocol properties, context-sensitive
   help is currently unavailable. Help for all SMB properties 
   will be available in Bloodhound's final release.
   For the properties on which help is available, access help
   in the following manner:
   1. In the Details pane of the Frame Viewer window, select a 
      line that references an SMB command property.
   2. Click once on your secondary mouse button to display a 
      floating menu.
   3. From this menu, select Help on property.

*  If you can only see incoming packets on the machine you are
   capturing on, and your filter is set to include "any <--> 
   machine", you are probably using a card with a driver that
   does not support loopback.  Either get a driver that does
   support loopback, or capture from another machine on the
   same subnet.

*  Untested Parsers
   Our XNS and MSRPC parsers were written by developers outside 
   the Bloodhound group and have not gone through extensive 
   testing.  Please report bugs in these parsers in the normal
   manner.

*  If you are capturing on a remote agent, pause the capture, and
   change the filter, the changes will not take effect until you
   stop and start the capture.  Changing the filter during
   capture on the local machine does work.

*  We don't recommend running NEXUS and Bloodhound at the same
   time.

*  Bloodhound does not work on Chicago yet.

*  If you capture on a remote agent, be sure to save your data
   before you switch back to the local network.  Bloodhound will
   not prompt you to save your information, and it will be lost.

*  When transmitting frames:  your MAC driver may or may not 
   replace the source address in the frame with the current
   address of your network card.

*  Don't exit Bloodhound while still connected to a remote 
   agent.  Select the local network from the Networks dialog
   first.  If you do exit Bloodhound while connected to a remote
   agent, then a copy of Bloodhound will stay around until you
   reboot your machine.  This shouldn't be a problem unless you
   try to reinstall Bloodhound:  you will get a popup saying a 
   file is already in use.  Stop the extra copy of Bloodhound or 
   reboot your system, and try to install again.

*  You need a mouse to use the Protocol Colors dialog, because
   the tab order does not include (temporarily) the column list 
   box.

*  If you want to share captures on the net, you must make the 
   share Read/write.  Bloodhound will not open read-only files.

Features now available
----------------------
*  Bloodhound supports the following protocols:
	LLC, DLC
	SMB, NetBIOS, NBIPX (NetBIOS on IPX)
	TCP, IP, ARP, RARP, ICMP, NFS, RPC (as necessary to
	decode NFS)
	DHCP, DNS, NBT, FTP, RIP, OSPF, UDP, TELNET 
	NCP, IPX, SPX, SAP, RIP
	DDP, NBP, ZIP/RTMP, ATP, ASP, PAP
   We do NOT support Appletalk AFP and ADSP or watchdog and
   diagnostics for IPX in this beta.  We also do not support
   XNS.

*  You can transmit frames onto the network.

*  Online help file complete with links to various dialogs and 
   help on SMB and TCP protocols

*  Cue card scenarios in place.

*  Bloodhound runs over FDDI.

*  Support for R4000, R4400 and Digital Alpha AXP systems in
   now available.

*  All network cards installed on a machine may be accessed with
   Bloodhound.  You can capture on one card at a time per instance
   of Bloodhound.

*  You can now capture on a remote machine that is running the 
   Network Monitor Agent.  The statistics appear on the local 
   machine, and the frames can be viewed after capture on the 
   local machine as well.  You need a NetBIOS session in order to 
   connect to the remote agent, which can be over the net or over
   RAS.

*  Bloodhound provides counters to PerfMon under the category
   "LAN Statistics".

*  Use the Display: Save Configuration menu item to save the 
   following settings:
	Font, Colors
	Zoom State, Active Pane
	Pane settings:  displayed or not, size
	Summary Pane column configuration 
	Toolbar activation
	Vendor ID state
	Enabled parsers
	Print Dialog advanced options

*  Use the Capture: Save Configuration menu item to save the 
   following settings: 
	Zoom State, Active Pane
	Pane settings: displayed or not, size
	Station and Session pane column configuration
	Toolbar activation
	Vendor ID state
	Enabled parsers
	Print Dialog advanced options



Suggestions for future versions of Bloodhound
---------------------------------------------

*  Have 'novice' and 'expert' modes with more or less 
   complication and information.
*  Include a status bar for field information at the bottom of
   each dialog.
*  Add a user-defined summary column in summary pane of display
   window that shows whatever property the user is interested in
*  Be able to append to address files instead of just overwriting
*  New triggers:
	capture for certain amount of time
	capture a certain number of frames
	trigger on selected protocol
*  Allow multiple captures within the same instance of Bloodhound
*  Support for SNMP and SMTP
*  Provide a list of available agents when the user wishes to 
   capture remotely
*  Allow Bloodhound to capture frames until the buffer is full,
   save the buffer, then continue capturing.
*  Sorting columns:
	allow sort in ascending as well as descending order
	periodically resort a column
*  Name resolution by other methods (i.e. querying the machine)
*  Sort/filter by network card vendor
*  Additional statistics available such as percentage of frames
   by protocol
*  Allow free expression types in the display filter
*  Set the maximum number of times a trigger will fire
*  Transmit to specific address instead of to address already
   in frame
*  Send "Trace Tool Present" warnings when running on Token Ring



*****************************************************************
*********  Bloodhound Beta  *********  Bloodhound Beta  *********
*****************************************************************

