A protocol analyzer is a system which can monitor and interpret data as it moves across a computer bus or network. It usually can collect and store a large amount of this data as well. Certain conditions can often be programmed to automatically start and stop the packet capture process. Electronics and software engineers frequently use protocol analyzers to diagnose problems with computer networks, storage devices and new circuit designs. A network protocol analyzer or sniffer can also help trace security breaches on a wired or wireless network.
These systems come in several forms. Some are completely self-contained devices which cannot be used for any other purpose. Others consist of specialized computer software which runs on a general-purpose laptop or other portable system. A third type of protocol analyzer includes software and hardware that must be used together with a general-purpose logic analyzer. The amount of data storage available and the possible set of conditions which can trigger the data collection vary according to the design of the particular system.
A logic analyzer can monitor a group of signals in an electronic circuit in real time, tracking the logic state of each signal. A protocol analyzer can also interpret the data represented by the signals it is tracking. For example, a network analyzer can decode and display Ethernet hardware addresses, Internet Protocol (IP) addresses and other packet data which passes through the connection being monitored. Analyzers exist for a large number of network and computer bus types and can often interpret dozens of common protocols. Systems can usually identify malformed packets and other types of transmission errors as well.
Network protocols such as IP, Internet Message Access Protocol (IMAP) and Point-to-Point Protocol (PPP) are often recognized by a packet analyzer. File Transfer Protocol (FTP), Secure Socket Layer (SSL) and many other protocols are frequently supported as well. A modern network protocol analyzer can interpret traffic on Ethernet, Fiber Channel or wireless networks, among others. It can often generate both good and erroneous network packets for testing purposes. An analyzer usually connects at a hub or switch, through either a regular network port or a monitoring port which allows it to see traffic on both sides of a switch.
The data exchanged between computer systems and disk drives can be monitored with a special type of protocol analyzer called a bus analyzer. Similar to a network analyzer, it can interpret data on Small Computer System Interface (SCSI), Serial Advanced Technology Attachment (SATA) and other types of storage buses. It can often analyze such data even when it is encapsulated by additional protocols for transport over Fiber Channel, IP or Ethernet. A very complex analyzer can monitor packets moving between servers, switches and storage devices on a high-speed Storage Area Network (SAN). This type of analyzer can help tune performance, optimize resources and identify intermittently failing equipment on a SAN.
Universal Serial Bus (USB), Recommended Standard (RS) 232 serial and Peripheral Component Interconnect (PCI™) also have their own bus analyzers. Like storage device buses, these computer hardware buses include their own unique data transfer protocols and signal timings. A bus-specific protocol analyzer may utilize an existing computer system or a logic analyzer to monitor, decode and store control transfers and data packets. Bus transactions, requests and events can be tracked for later analysis, along with any detected errors and abnormalities.
