PhatNet Monitors, Analyses LANs, WLANs, WANs Using Pocket PCs

Software company PhatWare Corporation today released PhatNet,a new software tool allowing network administrators, IT managers, developers and other IT/network professionals to monitor/decode, filter, capture, diagnose and analyze packet traffic from wired and wireless LANs, and WANs, using Windows Mobile handheld computers running Pocket PC 2002 or later. (No PalmOS version is planned.)

"It turns your Pocket PC into a network sniffer analyzer)," explains Stan Miasnikov, president of PhatWare.

PhatNet is based on CEMyNetwork (originally named CEniffer) which PhatWare acquired from Epiphan Consulting Inc. in September 2003.PhatNet's GUI is built on PhatWare's Windows Mobile interface technology.

PhatNet is available from in two versions: PhatNet Professional Edition, $299, and PhatNet Professional Edition, $99. (PhatWare is offering $50 off both prices through August 31, 2004.)

The Professional Edition supports both Ethernet (wired and unwired) and PPP connections, allowing users to see low-level Ethernet packets, including, in promiscuous mode, all packets on the network segment, not just those sent to the device, notes Miasnikov. "For example, if somebody is using a wireless Access Point to send spam, you can see all those packet." (The Pocket PC will need built-in or add-on Ethernet or 802.11 connectivity, of course.)The Personal Edition supports only PPP; however, if the Pocket PC is connected to a computer via ActiveSync, you can not only see traffic between the two devices but also monitor network traffic, says Miasnikov. On Pocket PC Phone Edition devices, it's also possible to see traffic like GPRS packets.

"PhatNet's filtering lets you select packets based on IP address, UDP or TCP port, hardware address or data string, and supports the creation of advanced filters for difficult-to-diagnose network problems," says Miasnikov. "It also lets you store packets in the standard formats, likeLANWatch's, and export packets to LANwatch for later analysis."

"This is a way for a network administrator to identify the types of information going through their network, as well as who it's going to," suggests Chris de Herrera, wireless/PDA expert and webmaster of CEWindows.Net.

"It's definitely an administrative tool... you could use it to try and find a problem with a specific device, you could monitor what that device is sending out or receiving."

Typical uses for PhatNet, suggests Miasnikov: "You can see traffic at a hot spot, or debug their security settings... this is enough for relatively small networks. Or, thanks to the advanced filtering options, you can leave it unattended on a large network segment...if the filters are set right, you won't lose packets." (When the memory is full, the oldest packets are deleted in favor of newer ones.)Popular programs for real-time data capture of what's goingon a network, notes de Herrera, include LANWatch, which runson Windows (9X and later), and Ethereal, an OpenSource program which runs on Linux, Unix and Windows.

Don't expect a Pocket PC-based program to match tools likeLANWatch or Ethereal for high-end tasks like grabbing all the packets on a 100MB segment, though, de Herrera cautions."It requires pretty hefty performance to capture all the data."

And if you plan to use PhatNet, be sure you have a sufficiently powerful current handheld, de Herrera advises. "you'll want a high-end new Pocket PC, not last year's model -- 400MHz with the latest Intel chip."

PhatNet is not intended for debugging large network segments, Miasnikov acknowledges. "It can only store up to 32,000 packets in internal memory."

While it's possible to use external storage media like CF cards (depending on what your Pocket PC device can accommodate, of course), which offer capacities of up to several gigabytes, "The downside of writing to a storage card is that this is so much slower than wire speed,"points out de Herrera. "At 10MB per second it'll do OK, but not at 100MB.""On a Pocket PC, you'll just get glimpse of what's going on, not every packet, which may not be sufficient for security analyses, or if trying to provide proof for legal things," de Herrera notes. On the other hand, he points out,"PhatNet will let you do captures on things you wouldn't normally do, like GPRS. And it can be useful in ways that some administrators don't think of, like application performance -- you can use it to test a wirelessapp, see how much data is going across and where the bottleneck is."

Upcoming plans for PhatNet, according to Miasnikov,include releasing an OEM version in the fall, for use by developers in embedded systems. Features of the OEMversion will include the ability to write and customizethe user interface to support other device form factors(screen sizes and capabilities, etc.).

(PhatWare Corporation provides software products and professional services for mobile and desktop computers, including CalliGrapher.)