1 @file
  Executes an indirect command file containing ETHERMON commands.

  Indirect command files may not be nested.

  The command format is

      @filename

1 ADD
  Adds new items to the ETHERMON utility's internal databases.

  The command format is

      ADD item-name [additional parameters]

  where the item-names are specified below.

2 FILTER
  Adds a new entry to the message filter database. The filter can be
  initially enabled or disabled, and can specify protocol type, source
  address, destination address, or a combination thereof for filtering.

  The command format is

      ADD FILTER /qualifier [/qualifier...]
3 Command_Qualifiers
/DISABLE
 Specifies that the filter should initially be disabled; it may be
 enabled later with the SET FILTER command. The default for a new
 filter definition is enabled.

/ENABLE
 Specifies that the filter should initially be enabled; it may be
 enabled later with the SET FILTER command. The default for a new
 filter definition is enabled.

/EXCLUDE=(field=value[,field=value])
 Specifies that messages that match the specified fields should be
 filtered out and not used in the analysis. The fields that can be
 used are:
      ADDRESS=address
      ADDRESS=manufacturer-prefix
      DESTINATION=address
      DESTINATION=manufacturer-prefix
      MULTICAST  (all destinations that are multicast)
      PROTOCOL=aa-bb   (where aa-bb is the hexadecimal protocol type)
      SOURCE=address
      SOURCE=manufacturer-prefix

/ONLY=(field=value[,field=value])
 Specifies that messages that do not match the specified fields 
 should be filtered out and not used in the analysis. The fields
 that can be used are:
      ADDRESS=address
      ADDRESS=manufacturer-prefix
      DESTINATION=address
      DESTINATION=manufacturer-prefix
      MULTICAST  (all destinations that are multicast)
      PROTOCOL=aa-bb   (where aa-bb is the hexadecimal protocol type)
      SOURCE=address
      SOURCE=manufacturer-prefix

1 address
2 assignment_conventions
  The conventions for Ethernet addresses are that the least significant 
  bit of the first byte is clear for a physical address, and set for a 
  multicast address. The first three bytes describe a block of 
  addresses allocated to a particular manufacturer, and the remaining 
  bytes make up an individual ID code for a single node. A short, very
  incomplete list of known physical address ranges are (longer list
  available with the SHOW MANUFACTURERS/ALL command):

    Digital Equipment Corp.: AA-00-03-00-xx-yy (hardware default for
                                                DEUNA network adapters)
                             AA-00-04-00-xx-yy (DECnet logical addresses)
                             08-00-2B-xx-yy-zz (initial hardware addresses
                                                for LANCE-based interfaces,
                                                used for DECservers and
                                                DECbridges)
    Sun Microsystems:        08-00-20-02-xx-yy (hardware default for 
                                                386i workstations; last
                                                2 bytes +1 are host ID)
                             08-00-20-xx-yy-zz (hardware default for
                                                Ethernet interfaces on other
                                                Sun workstations)
    Xyplex Corp.:            08-00-87-00-xx-yy (Ethernet CC's, HIU's, etc.;
                                                yyxx is unit serial #)
    Ungermann-Bass:          00-DD-00-xx-yy-zz (old-style NET-ONE terminal
                                                network controllers,
                                                where xxyy is box #, zz is
                                                board #)
                             00-DD-01-xx-yy-zz (new terminal network boxes,
                                                xxyyzz is 24-bit box #)
                             00-DD-0F-xx-yy-zz (Token Ring terminal network
                                                boxes, xxyyzz is box #)
    CMC:                     02-CF-1F-04-xx-yy (UNIBUS Ethernet interfaces)
                             02-CF-1F-09-xx-yy (UNIBUS Ethernet interfaces)
                             02-CF-1F-70-xx-yy (MULTIBUS II Ethernet
                                                interfaces)

2 formats
  Addresses on the Ethernet can be specified to ETHERMON in four
  different formats. The standard Xerox physical address display format
  is the one always used by ETHERMON on output, and may be used for
  input wherever an Ethernet address is required. It is of the form
  aa-bb-cc-dd-ee-ff, where each pair of letters is a one- or two-digit
  hexadecimal number, and the numbers are separated by hyphens.
  Alternately, Ethernet addresses can be specified as:
     a) DECnet node number, i.e. area.node, where area is a decimal number
        in the range 1 to 63 and node is a decimal number in the range
        1 to 1023;
     b) Internet physical address, i.e. a.b.c.d, where each letter is
        a decimal number in the range 0 to 255, and the total address
        must correspond to an entry in the address table;
     c) DECnet node name, i.e. a 1- to 6-character alphanumeric string
        (starting with a letter) which must match the DECnet name of 
        an entry in the address table.
     d) Ungermann-Bass unit serial number in the form UB#nnnnn, where nnnnn
        is the device serial number.

1 CLEAR
  Removes item definitions from the ETHERMON utility's internal
  databases.

  The command format is

      CLEAR item-name [additional parameters]

  where the item-names are specified below.

2 FILTER
  Removes entries from the Ethernet message filter database, or clears
  the entire filter list (/ALL).

  If only a single filter is to be removed, the number of the desired
  filter must be specified (obtained with the SHOW FILTERS command).

  The command format is

      CLEAR FILTER filter-number
         or
      CLEAR FILTER/ALL

2 FLAGS
  Clears the Internet (IP) flag bits for all address table entries. This
  is primarily available to allow re-deriving of IP addresses for nodes
  when some of the addresses are garbled (generally due to glitchy RIP 
  type IP routing messages detected on the Ethernet). After entering the
  command, automatic IP address derivation will start over from scratch
  (although the address table entries themselves will not be deleted).

  The command format is

      CLEAR FLAGS

1 Control-C
  The control-C character is now recognized by ETHERMON as the internal
  command abort function. The DISPLAY and MONITOR commands can ONLY be
  terminated by control-C; other non-terminatable functions (SUMMARIZE,
  SHOW ADDRESS_NAMES) can now be prematurely stopped by control-C without
  terminating the whole ETHERMON program.

1 Control-Z
  Terminates the ETHERMON utility and returns control to the command
  interpreter. The EXIT command may also be used for this purpose.

1 DEFINE
  Associates an equivalence string and a set of attributes with a  key
  on the terminal keyboard.  The /KEY qualifier is required.

  Format:


    DEFINE/KEY [/qualifiers]  key-name equivalence-string
2 Parameters

 key-name

  Specifies the name of the key that you are defining.  The  following
  table  lists  the  key  names  in  column  one.  The remaining three
  columns indicate the key designations on the keyboards for the three
  different  types  of  terminals  that  allow  key  definitions.  All
  definable keys on VT52 terminals are located on the numeric  keypad.
  On  VT100-type  terminals,  you  can define the LEFT and RIGHT arrow
  keys as well as all the keys on the numeric keypad.  There are three
  types of keys that can be defined on terminals with LK201 keyboards:
  (1) keys on the numeric keypad,  (2)  keys  on  the  editing  keypad
  (except  the  UP  and DOWN arrow keys), and (3) keys on the function
  key row across the top of  the  terminal.   (Note  that  you  cannot
  define function keys F1 through F5.)

       Key-name         LK201            VT100-type     VT52

       PF1              PF1              PF1            [blue]

       PF2              PF2              PF2            [red]

       PF3              PF3              PF3            [gray]

       PF4              PF4              PF4            - -

       KP0, KP1, ..., KP9                0, 1, ..., 9   0, 1,  ...,  9
                                                          0, 1, ..., 9

       PERIOD           .                .              .

       COMMA            ,                ,              n/a

       MINUS            -                -              n/a

       ENTER            Enter            ENTER          ENTER

       Find (E1)        Find             - -            - -

       Insert Here (E2) Insert Here      - -            - -

       Remove (E3)      Remove           - -            - -

       Select (E4)      Select           - -            - -

       Prev Screen (E5) Prev Screen      - -            - -

       Next Screen (E6) Next Screen      - -            - -

       HELP             Help             - -            - -

       DO               Do               - -            - -

       F6, F7, ..., F20 F6, F7, ..., F20 - -            - -

  Some defineable keys  are  enabled  for  definition  all  the  time.
  Others, including KP0 through KP9, PERIOD, COMMA, and MINUS, need to
  be  enabled  for  definition  purposes.  You  must issue  SET KEYPAD 
  APPLICATION command  before using  these keys (although this is done
  automatically at ETHERMON start-up, it may have been cancelled by the
  SET KEYPAD NUMERIC command).

  The LEFT and RIGHT arrow keys and the F6 through F14 VT200 keys  are
  reserved   for  command  line  editing.   You  must  issue  the  SET
  TERMINAL/NOLINE_EDITING  command  at  the DCL level before  defining
  these keys.  You can also press CTRL/V to enable keys F7 through F14.
  Note that CTRL/V will not enable the F6 key.

 equivalence-string

  Specifies the string which is to be processed  when  you  press  the
  key.  The  entire  remaining portion of  the line after the key name
  is accepted as the equivalence string, as-is,  so all qualifiers for
  the DEFINE/KEY command (as  opposed to the equivalence  string) must
  appear before the key-name.

2 Command_Qualifiers
/NOECHO

  Determines whether the  equivalence  string  is  displayed  on  your
  screen  after the key has been pressed.  By default, the equivalence
  string is echoed to the screen when it is pressed.

/IF_STATE=state-name

  Specifies a state which  must be in effect for the key  definition to 
  be in effect.  If you omit the /IF_STATE qualifier, the current state
  is  used.  The state  name  is  an  alphanumeric  string.  States are 
  established with the /SET_STATE qualifier.

/LOCK_STATE

  Specifies that the state set by the /SET_STATE qualifier  remain  in
  effect until  explicitly changed.  If you do not use the /LOCK_STATE
  qualifier, the state set by /SET_STATE is in  effect  only  for  the
  next  defineable key that you press or for the next read terminating
  character that you type.

  The /LOCK_STATE qualifier can only be specified with the  /SET_STATE
  qualifier.

/SET_STATE=state-name

  Causes the specified state-name to be set when the key  is  pressed.
  The state name can be any alphanumeric string.

  If you omit the /SET_STATE qualifier, the current state  that  was 
  locked remains in effect.

/TERMINATE

  Specifies whether the current equivalence string is to be terminated
  (that  is,  processed) when the key is pressed.  Pressing RETURN has
  the same effect as using /TERMINATE.

2 Examples

  ETHERMON> DEFINE/KEY/TERM/NOECHO ENTER TRACE/BINARY/PARAL/INT=:5/OUT=GRABIT
  ETHERMON> 
      .
      .
      .
  %ETHERMON-I-MOPMSG, 11:22:33 08-00-2B-12-34-56 sent MOP DLA msg, t=0508 ln=8
  ETHERMON> <hit keypad ENTER key>
  %ETHERMON-I-ASYNTRCBEG, asynchronous TRACE command started...

  In the first command line, the keypad ENTER key was defined to invoke a
  parallel TRACE command. Later, when an event of interest occurred, the
  user hit the pre-defined keypad key, and was able to start tracing at
  once, without having to type in the lengthy command in a hurry.

1 DELETE

  Deletes key definitions that have been established by the DEFINE/KEY
  command.  The /KEY qualifier is required.

  Format:

    DELETE/KEY [/qualifier] key-name

2 Parameters

 key-name

  Specifies the name of the key whose definition you want to delete.

2 Command_Qualifiers
/STATE=state-name

  Specifies  the  names  of  states  for  which  the   specified   key 
  definitions are to be deleted.  State names can  be any  appropriate 
  alphanumeric string.

  If you omit the /STATE qualifier, key definitions in the default
  state are deleted.

1 DISPLAY
  Generates a dynamically updating status display, similar to the VMS
  MONITOR utility. The display updates continuously at the specified
  update interval (see SET INTERVAL for more details) until control-C is
  typed on the user terminal; at this time, the display will terminate
  and control will return to the ETHERMON prompt.

  The command format is

      DISPLAY displaytype [/qualifier]

  where displaytype is one of the types specified below.

2 DESTINATIONS
  Displays the top (up to 15) destination addresses being specified in
  the Ethernet traffic. For addresses with known meanings, their symbolic
  names will also be displayed.

2 PROTOCOLS
  Displays the top (up to 8) protocol types being specified in the
  Ethernet traffic. For protocol types with known functions, their
  symbolic names will also be displayed.

2 SIZES
  Displays the size distribution of messages being transferred on the
  Ethernet for message size groupings from 1-100 to 1401-1500 bytes.

2 SOURCES
  Displays the top (up to 15) source addresses being specified in the 
  Ethernet traffic. For addresses with known meanings, their symbolic
  names will also be displayed.

2 STATISTICS
  Displays the current counter statistics from the Ethernet port
  (averages, minimums, and maximums not yet implemented).

2 Command_qualifiers
/NOFILTER
  Specifies that the DISPLAY command will display all messages being
  processed by ETHERMON, ignoring any filter settings. By default, the
  DISPLAY command only displays data that has passed the filters.

1 Ethernet_port
  When the ETHERMON program is started, it must be informed as to what
  VAX/VMS device it will use as its interface to the Ethernet. Any DEC
  standard Ethernet port (DEUNA, DEQNA, DEBNT, etc.) or FDDI port (DEMFA)
  may be specified by its VMS device name (XEA0:, ESA0:, etc.) as a 
  command line parameter at DCL level; if the name is not specified (or 
  ETHERMON is not invoked as a foreign command), ETHERMON will search the 
  system for all standard known ports. If only one port is found, ETHERMON 
  will use it, else it will display a list of known available ports for the 
  user to choose from, and prompt for the device name. The unit number 
  is not required, as it will be discarded anyway.

  Note that the user must have PHY_IO, NETMBX, and TMPMBX (or SETPRV) 
  privileges and a large BYTLM quota (minimum varies with local site SYSGEN
  parameters) to run this utility; CMKRNL (or SETPRV) privilege is also 
  required for VAX/VMS V5.4-3 and above.

1 EXIT
  Terminates the ETHERMON utility and returns control to the command
  interpreter. Control-Z may also be used for this purpose.

1 filters
  ETHERMON has the capability of filtering packets, so that only a selected
  subset of network data is processed for the DISPLAY, TRACE, and SUMMARIZE
  commands. Filters may be defined for Ethernet destination addresses,
  source addresses, addresses either source or destination, protocol type,
  packet size, or a combination thereof. ETHERMON supports multiple filters,
  each of which can describe one pair of node addresses (or manufacturer
  prefix codes) and/or a protocol type, and can be independently enabled 
  and disabled. Filters are created with the ADD FILTER command, modified 
  with SET FILTER, removed with CLEAR FILTER, and displayed with SHOW FILTER.

1 HELP
  The ETHERMON utility provides the ability to dynamically monitor
  the state of an Ethernet network connected to a VAX system. It can
  generate dynamic displays of the current state of the cable, or can
  record events occurring on the cable for analysis by another
  program.

  For more information on any command, type

      HELP command [/qualifiers] [parameters]

  at the ETHERMON prompt.

1 Keypad
2 default
 +--------+-----------------+     +--------+--------+--------+--------+
 |        |                 |     |        |  Help  |        |  Set   |
 |  Help  |                 |     |  GOLD  | Keypad |        | Keypad |
 |        |                 |     |        | Default|        |Applicat|
 +--------+-----------------+     +--------+--------+--------+--------+
 +--------+--------+--------+     |Display |Display |Display |        |
 |        |        |        |     |Sources |Destinat|Protocol|        |
 |        |        |        |     |        |        |        |        |
 +--------+--------+--------+     +--------+--------+--------+--------+
 |        |        |        |     |        |        |        |        |
 |        |        |        |     |        |        |        |        |
 |        |        |        |     |        |        |        |        |
 +--------+--------+--------+     +--------+--------+--------+--------+
          |    ^   |              |        |        |        |        |
          |    |   |              |        |        |        |        |
          |        |              |        |        |        |        |
 +--------+--------+--------+     +--------+--------+--------+        |
 |        |        |        |     |Trace/Analyzer=  |        |        |
 |   <--  |    |   |  -->   |     | ETHERPARSE2/Para|        |        |
 |        |    V   |        |     | /Interval=:59:59|        |        |
 +--------+--------+--------+     +-----------------+--------+--------+

2 GOLD
 +--------+-----------------+     +--------+--------+--------+--------+
 |        |                 |     |        |  Help  |        |  Set   |
 |  Help  |                 |     |  GOLD  | Keypad |        | Keypad |
 |        |                 |     |        |  Gold  |        | Numeric|
 +--------+-----------------+     +--------+--------+--------+--------+
 +--------+--------+--------+     |Display |Display |Display |        |
 |        |        |        |     |Sources |Destinat|Protocol|        |
 |        |        |        |     | /NoFilt| /NoFilt| /NoFilt|        |
 +--------+--------+--------+     +--------+--------+--------+--------+
 |        |        |        |     |        |        |        |        |
 |        |        |        |     |        |        |        |        |
 |        |        |        |     |        |        |        |        |
 +--------+--------+--------+     +--------+--------+--------+--------+
          |    ^   |              |        |        |        |        |
          |    |   |              |        |        |        |        |
          |        |              |        |        |        |        |
 +--------+--------+--------+     +--------+--------+--------+        |
 |        |        |        |     |                 |        |        |
 |   <--  |    |   |  -->   |     |                 |        |        |
 |        |    V   |        |     |                 |        |        |
 +--------+--------+--------+     +-----------------+--------+--------+

1 LOAD
  Loads files of equivalence name definitions into the address, filter,
  or protocol name tables.

  The command format is:

      LOAD [/tabletype] [loadfilespec]

2 loadfilespec
  The name of the data file to be loaded into the ETHERMON run-time
  database. If the file specification is missing or incomplete, the
  specification SYS$DISK:[]ETHERMON.ETH_tabletype is used to supply missing
  components. The format of the files is that used by the SAVE command.

2 tabletypes
/ADDRESSES (D)
  Specifies that the file should be merged into the addresses table;
  this is the default if no table type is specified.

/FILTERS
  Specifies that the file should be appended to the filters table;
  note that all filters loaded from a file are initially disabled, 
  and must be enabled with the SET FILTER command to be used.

/INTERNET
  Specifies that any Internet addresses in the address table that do
  not have symbolic names should be looked up from the local Internet
  software. Currently, TGV Multinet, DEC VMS/Ultrix Connection (UCX),
  Network Research's Fusion (NRC Fusion), and Carnegie-Mellon University 
  TCP/IP (CMU TCP/IP) are supported Internet software packages. Note 
  that this command's results are no better than the contents of the 
  Internet software's host table and/or domain name servers. A file 
  specification is not used with this qualifier.

/MANUFACTURERS
  Specifies that the file should be merged with the manufacturers'
  prefix table.

/PROTOCOLS
  Specifies that the file should be merged into the protocols table.

1 MAP
  Attempts to compute a map of Ethernet bridge interconnections for all 
  bridges presently listed in the bridge table (use SHOW BRIDGES to 
  examine the table).

  The command format is

      MAP

2 Operation
  Each bridge is queried for its forwarding table, which is then analyzed 
  to find which side of the bridge each of the other bridges is located on.
  For purposes of analysis, the Ethernet port that ETHERMON is being run on
  is treated as a one-sided bridge.

  Because each bridge only has partial knowledge of the rest of the network,
  and the bridge knowledge base is being constantly updated, it will take
  several invocations of the MAP command to get a database that is close to
  describing the network. Perfect accuracy is not presently obtainable.

2 Supported_bridges
  Presently, the bridges supported are
       - any bridge speaking DEC's LAN Bridge protocol
       - any Ungermann-Bass bridge speaking UB's XNS-based management
              protocol

1 MONITOR
  Generates a dynamically updating status display, similar to the VMS
  MONITOR utility. The display updates continuously at the specified
  update interval (see SET INTERVAL for more details) until any key is
  struck on the user terminal; at this time, the display will terminate
  and control will return to the ETHERMON prompt.

  The command format is

      MONITOR displaytype

  This command is a synonym for the DISPLAY command; use HELP DISPLAY
  for more information.

1 PING
  Attempts to "ping" a message off a remote node on the Ethernet, 
  similar to the Un*x "ping" utility, and reports the turnaround time 
  if successful.

  The command format is:

      PING [/qualifier] [address]

  Note that, on a busy Ethernet, the PING command may fail because the 
  reply packet was discarded because ETHERMON couldn't keep up in 
  order to read it.

2 address
  The address of the remote node, in any of the legal formats. If an 
  address is not supplied, the Broadcast address (FF-FF-FF-FF-FF-FF)
  is assumed; this is the only permitted multicast address for the PING
  command.

2 qualifiers
/IEEE_LOOPBACK (D)
  Specifies that the "ping" message should be sent using IEEE 802.3 
  SNAP protocols for the general loopback protocol type (90-00).

/IEEE_MOP
  Specifies that the "ping" message should be sent using IEEE 802.3 
  SNAP protocols using the DEC MOP Remote Console protocol (60-02) 
  type's Request ID and System ID response message types.

/INTERNET
  Specifies that the "ping" message should be sent using DoD Internet 
  IP (08-00) datagrams using the ICMP Echo Request and Echo Reply 
  message formats. The specified Ethernet address must have an associated
  IP address to use.

/LOOPBACK
  Specifies that the "ping" message should be sent using Ethernet
  protocols for the general loopback protocol type (90-00).

/MOP
  Specifies that the "ping" message should be sent using Ethernet 
  protocols using the DEC MOP Remote Console protocol (60-02) 
  type's Request ID and System ID response message types.

1 QUERY
  Issue queries to one or more Ethernet nodes under a particular protocol 
  and query type. Up to 16777215 nodes may be queried at a time, but the
  command tends to run slowly for large numbers of nodes (approximately
  200 nodes/second on a VAX 6000-series), and can cause bridge congestion.
  The command will verify its address range if more than 1000 nodes are to
  be queried at a time.

  The command format is:

      QUERY/querytype[/qualifier] startaddress [endaddress]

2 querytype
/DECBRIDGE
  Issues a DEC "dump bridge statistics" query using DEC Lan Bridge 
  protocol (80-38)

/DECMOP
  Issues a DEC MOP "Request ID" query using DEC Maintenance Operations
  Protocols' Remote Console protocol (60-02).

/UB_BRIDGE
  Issues an Ungermann-Bass "dump bridge forwarding table B" query using
  XNS protocol.

2 qualifier
/LITTLE2_ENDIAN
  Specifies that the address should be scanned in an order where the last
  two address octets are considered to be in little-byte-first order, and
  collectively are still the littlest bytes in the 6-octet address; an
  example of such addresses are DECnet addresses. By default, the address 
  range is scanned by incrementing the addresses in pure big-endian order.

/LITTLE3_ENDIAN
  Specifies that the address should be scanned in an order where the last
  two address octets are considered to be in little-byte-first order, and
  collectively are still the littlest bytes in the 6-octet address; an
  example of such addresses are DEC bridge "serial number" addresses. By 
  default, the address range is scanned by incrementing the addresses in 
  pure big-endian order.

2 startaddress
  The address of the first remote node to query, in any legal format 
  defined by ETHERMON.

2 endaddress
  The address if the last remote node to query, in any legal format
  defined by ETHERMON. If this parameter is not given, it defaults to
  the same value as the start address, i.e. only one address is queried.

1 SAVE
  Saves files of equivalence name definitions from the address, filter,
  or protocol name tables.

  The command format is:

      SAVE [/tabletype] [savefilespec]

2 savefilespec
  The name of the data file to be written from the ETHERMON run-time
  database. If the file specification is missing or incomplete, the
  specification SYS$DISK:[]tabletype.ETH is used to supply missing
  components. The output files are ASCII data, in a format suitable
  for use by the LOAD command; the files may be edited, but the format
  should remain the same to ensure that the LOAD command works.

2 tabletypes
/ADDRESSES
  Specifies that the addresses table should be saved; this is the
  default if no table type is specified.

/FILTERS
  Specifies that the filters table should be saved.

/MANUFACTURERS
  Specifies that the manufacturers' prefix table should be saved.

/PROTOCOLS
  Specifies that the protocols table should be saved.

1 SET
  Modifies the attributes of internal data items in the ETHERMON
  utility.

  The command format is

      SET item-name value
        or
      SET item-name /qualifier

  where the item-names are specified below.

2 ADDRESS_NAME
  Adds new entries or modifies existing ones in the Ethernet address/
  node name table. An Ethernet address (physical or multicast) may be
  entered with an arbitrary text string (if the string contains blanks,
  lowercase letters, or punctuation marks, it should be enclosed in
  double quotes {"}). Note that, when enabled, additional address names
  may be entered automatically as ETHERMON analyzes received Internet
  ARP messages and similar node identification messages.

  The command format is

      SET ADDRESS_NAME physical_etheraddr name_symbol
            or
      SET ADDRESS_NAME physical_etheraddr "quoted string"
3 physical_etheraddr
  A standard 48-bit Ethernet address in Xerox standard display format,
  i.e., of six 1- or 2-digit hexadecimal numbers, low byte first, 
  with the bytes separated by hyphens. For example: 12-34-56-87-AB-DD.

3 name_symbol
  A name of up to 23 characters, containing only letters, numbers, 
  dollar sign ($), and/or underscore (_). For example: VAX_10.

3 quoted_string
  A string of text, begun and ended with double quote marks ("); the
  quote marks are not included in the string itself, and quote marks
  may not be used as part of the string. Only the first 80 characters
  specified will actually be stored. For example: "My MicroVAX on TCP/IP".

2 FILTER
  Modifies an existing entry in the message filter database. The filter 
  can be enabled or disabled, and can change the protocol type, source
  address, destination address, or a combination thereof for filtering.

  The command format is

      SET FILTER filter_num/qualifier [/qualifier...]
           or
      SET FILTER/SIZE=(sizeoption[,sizeoption...])
3 filter_num
  The identification number the filter was assigned when it was created
  with the ADD FILTER command.

3 Command_Qualifiers
/DISABLE
 Specifies that the filter should be disabled; it may be enabled 
 later with the SET FILTER/ENABLE command. The default for a new
 filter definition is enabled.

/ENABLE
 Specifies that the filter should be enabled; it may be disabled
 later with the SET FILTER/DISABLE command. The default for a new
 filter definition is enabled.

/EXCLUDE=(field=value[,field=value])
 Specifies that messages that match the specified fields should be
 filtered out and not used in the analysis. Any existing EXCLUDE's
 that are not specified here will not be changed. The fields that 
 can be used are:
      ADDRESS=address
      ADDRESS=manufacturer-prefix
      DESTINATION=address
      DESTINATION=manufacturer-prefix
      MULTICAST  (all destinations that are multicast)
      PROTOCOL=aa-bb   (where aa-bb is the hexadecimal protocol type)
      SOURCE=address
      SOURCE=manufacturer-prefix

/NODESTINATION
 Clears any previously defined destination address filtering for the
 filter (whether it was EXCLUDE or ONLY filtering).

/NOPROTOCOL
 Clears any previously defined protocol type filtering for the
 filter (whether it was EXCLUDE or ONLY filtering).

/NOSOURCE
 Clears any previously defined source address filtering for the
 filter (whether it was EXCLUDE or ONLY filtering).

/ONLY=(field=value[,field=value])
 Specifies that messages that do not match the specified fields 
 should be filtered out and not used in the analysis. Any existing
 ONLY's that are not specified here will not be changed. The fields
 that can be used are:
      ADDRESS=address
      ADDRESS=manufacturer-prefix
      DESTINATION=address
      DESTINATION=manufacturer-prefix
      MULTICAST  (all destinations that are multicast)
      PROTOCOL=aa-bb   (where aa-bb is the hexadecimal protocol type)
      SOURCE=address
      SOURCE=manufacturer-prefix

/SIZE=(sizeoption[,sizeoption...])
 Specifies the new characteristics of the message size filter. The
 message size filter is independent of the set of message address and
 protocol filters, and its effects are logically AND'ed with the other
 enabled filters. The size options are:

      DISABLE             disables use of message size filter

      ENABLE              enables use of message size filter

      MAXIMUM=number      sets new maximum message size (must be
                          in the range 46 to 1500)

      MINIMUM=number      sets new minimum message size (must be
                          in the range 46 to 1500)

2 INTERVAL
  Sets the update rate for the DISPLAY command. The command value is
  the number of seconds between updates (initially defaulting to 4
  seconds). The value must be in the range of 2 to 60 seconds.

  The command format is

      SET INTERVAL number-of-seconds

2 KEYPAD
  Sets the functional mode of the terminal's numeric keypad to either
  numeric  or applications  mode.  By  default, ETHERMON switches the
  keypad mode to applications on start-up, and restores its state upon
  exit.

  The command format is

      SET KEYPAD APPLICATIONS
      SET KEYPAD NUMERIC

2 MANUFACTURER
  Adds new entries or modifies existing ones in the Ethernet interface
  manufacturer's table. The first three bytes of the Ethernet address
  identify a manufacturer; the manufacturer's name is displayed before
  any other information that ETHERMON can derive about an address on
  the Ethernet.

  The command format is

      SET MANUFACTURER aa-bb-cc short-name long-name
            or
      SET MANUFACTURER aa-bb-cc short-name "quoted-long-name"

  where aa-bb-cc is the Ethernet address prefix.

3 short-name
  The short name of a manufacturer is a 8-character (max) prefix used for
  the real-time DISPLAY commands.

3 long-name
  The long-name of a manufacturer is up to 28 characters in length and
  may be quoted to allow use of lowercase letters, spaces, and punctuation
  marks in the name.

2 MESSAGES
  Enables or disables display of asynchronous "significant event" 
  messages on the user terminal. By default, asynchronous event 
  messages can interrupt any output on your screen any time while 
  ETHERMON is running; they do not affect output redirected with an
  ETHERMON command's /OUTPUT qualifier. Some event messages can be
  individually enabled or disabled for finer detail.

  The command format is

      SET MESSAGES [msgtype] ON
      SET MESSAGES [msgtype] OFF
      SET MESSAGES DEBUG    {to enable debug-level event messages}

3 msgtype
  The legal optional message types are:

      ARP     - enable/disable reporting of proxy or non-standard ARP
                  and RARP messages (ON by default)
      DUPIP   - check for two nodes using the same Internet IP address
                  which are not routers/gateways (OFF by default)
      IP      - enable/disable reporting of IP events (hosts using multiple
                  IP addresses, and identification of IP routers) messages
                  (ON by default)
      MOP     - enable/disable reporting of DEC MOP protocol messages
                  (ON by default)
      NEWNODE - report each time a new node is added to the address
                  name table (OFF by default)

2 PROTOCOL_NAME
  Adds new entries or modifies existing ones in the Ethernet protocol
  type/node name table. An Ethernet protocol type may be entered 
  with an arbitrary text string (if the string contains blanks,
  lowercase letters, or punctuation marks, it should be enclosed in
  double quotes {"}).

  The command format is

      SET PROTOCOL_NAME ethernet_protocol name_symbol
            or
      SET PROTOCOL_NAME ethernet_protocol "quoted string"
3 ethernet_protocol
  A standard 16-bit Ethernet protocol number of two 1- or 2-digit
  hexadecimal numbers, low byte first, with the bytes separated by
  hyphens. For example: 80-5B.

3 name_symbol
  A name of up to 24 characters, containing only letters, numbers, 
  dollar sign ($), and/or underscore (_). For example: STANFORD.

3 quoted_string
  A string of text, begun and ended with double quote marks ("); the
  quote marks are not included in the string itself, and quote marks
  may not be used as part of the string. Only the first 24 characters
  specified will actually be stored.
  For example: "Stanford V Kernel experiment".

1 SHOW
  Displays status of various internal databases used by the ETHERMON
  utility.

  The format of the command is

      SHOW data-item

  where data-item is one of the names specified below.

2 ADDRESS_NAMES
  Displays the Ethernet address and name association table. This table
  is used to find symbolic meanings of source and destination addresses
  specified in Ethernet messages. Addresses that have been seen on the
  local Ethernet are marked with an 's' (source only), 'd' (destination
  only), or 'b' (source and destination). Only addresses that
  are actually used are displayed unless the /ALL qualifier is used.

  The command format is

      SHOW ADDRESS_NAMES [Enet-address] [Inet-address] [/qualifier ...]

3 Enet-address
  Optionally, an Ethernet address can be specified (either the entire
  address or only the manufacturer prefix) in the form aa-bb-cc-dd-ee-ff.
  Any of the 6 (or 3, for manufacturer prefix only) bytes can be 
  specified as hexadecimal numbers or wildcarded by an asterisk "*". 
  If no Ethernet address is specified, an address of *-*-*-*-*-* is 
  assumed.

3 Inet-address
  Optionally, an Internet physical address can be specified in the
  form a.b.c.d. Any of the 4 bytes can be specified as decimal numbers 
  or wildcarded by an asterisk "*". If no Internet address is specified, 
  none is implied. Note that specifying an Internet address means that 
  only address table entries that HAVE Internet addresses will be 
  displayed (since a node without Internet would always fail on the 
  address matching).

3 qualifiers
/ALL
  Specifies that all known addresses, not just ones seen as active on
  the local cable, will be displayed (subject to restrictions of other
  parameters and qualifiers).

/FULL
  Specifies that, for each displayed address, all the protocol types
  spoken by that address will be displayed in addition to the address
  number and names.

/OUTPUT[=filespec]
  Specifies that the listing should be directed to the specified file.
  By default, the listing is sent to SYS$OUTPUT, the user terminal. If
  the filespec is incomplete or missing, the default filespec is
  SYS$DISK:[]ETHERMON_ADDRESSES.LIS.

/PROTOCOL=aa-bb
  Specifies that the listing should only include addresses which have
  used the specified Ethernet or IEEE 802 extended protocol type.
  By default, addresses are displayed regardless of protocol types
  used.

/SORT=sort-type
  Specifies the display sorting type. The default is /SORT=ETHERNET,
  which sorts by physical Ethernet address; other options available
  include /SORT=INTERNET (sort by IP address; non-IP-speaking nodes
  appear in internal storage order after all IP-using nodes) and /SORT=NONE
  (also available as /NOSORT; displays addresses in internal hash table
  order).

/TYPE=value
  Specifies that the listing should only include address which have the
  attributes specified. The value can be:

     1) a hexadecimal number in the form %Xnnnn, where the numeric values 
        correspond to the internal binary flag codes used in the address 
        table (and seen as the Mxxxx: number in SAVE/ADDRESS files);

     2) one or more symbolic names of the flag bits. if more than one name
        is specified, the names must be separated by commas "," and the
        entire list enclosed in parenthesis "()".

  The symbolic type names are:
         DECBRIDGE    (%X00080) identified as DEC LAN Bridge
         DECNET       (%X00008) running DECnet protocols
         DECSERVER    (%x00100) identified as DEC LAT terminal server
         DESTINATION  (%X00004) node has been a destination
         DNSSERVER    (%X10000) node is an Internet DNS server
         IARP         (%X20000) node's IP address confirmed by ARP
         INETGATEWAY  (%X08000) node is an Internet IP gateway/router
         INETNAME     (%X00800) node has a symbolic Internet name defined
         INTERNET     (%X00010) running DoD Internet IP protocols
         LAVC         (%X00200) running DEC Local Area VAXcluster protocols
         LINE2ADDR    (%X80000) primary address is port 2 on a two-port device
         MACNUM       (%X02000) running AppleTalk protocols
         MACZONE      (%X01000) identified as AppleTalk zone router
         MOP          (%X04000) running DEC MOP protocols
         OTHERADDR    (%X40000) node has two Ethernet addresses
         SOURCE       (%X00002) node has been a source
         UB           (%X00020) node is running Ungermann-Bass (XNS) protocols
         VITALINK     (%X00400) identified as Vitalink bridge
         XYPLEX       (%X00040) running Xyplex terminal net protocols

2 BRIDGES
  Displays a list of all Ethernet bridges that were recognized and
  identified by ETHERMON. Optionally, a map of bridge interconnections
  can be obtained as well.

  The command format is

      SHOW BRIDGES [/qualifier ...]

3 qualifiers
/FULL
  Specifies that, for each displayed bridge, all the protocol types
  spoken by that address, and all the adjacent bridges in the most
  recently computed bridge map will be displayed in addition to the address
  number and names. Note that, if a new bridge has been detected since the
  last use of the MAP command, a warning message will be displayed to
  alert you that your map may be out of date.

/MAP[=filespec]
  Specifies that a PostScript graphical map of the bridged network should 
  be directed to the specified file, instead of generating tabular output.
  By default, the listing is sent to the file SYS$DISK:[]BRIDGE_MAP.PS.
  This map currently is not very accurate, due to the limited resolution
  of the map analysis logic (see the MAP command for details).

/OUTPUT[=filespec]
  Specifies that the listing should be directed to the specified file.
  By default, the listing is sent to SYS$OUTPUT, the user terminal. If
  the filespec is incomplete or missing, the default filespec is
  SYS$DISK:[]ETHERMON_BRIDGES.LIS.

2 FILTERS
  Displays the currently defined Ethernet message filters; the filter
  number (used for SET FILTER and CLEAR FILTER), enable/disable status,
  and the protocol type/source address/destination address (if used) and
  associated matching state(s) are displayed for each filter.

  The command format is

      SHOW FILTERS

2 KEY
  Displays the current key definitions as defined by the DEFINE/KEY command
  (or predefined by ETHERMON).  All defined keys will be displayed. Keys
  with an asterisk (*) before their definition are permanently defined by
  ETHERMON and cannot be changed with the DEFINE/KEY or DELETE/KEY commands.

  The command format is

      SHOW KEY

2 MANUFACTURERS
  Displays the currently known manufacturer prefix codes and associated
  names. Codes that have been seen on the local Ethernet are marked with
  an 's' (source only), 'd' (destination only), or 'b' (source and 
  destination). Only codes that have actually been used on the local
  cable will be displayed unless the /ALL qualifier is used.

  The command format is

      SHOW MANUFACTURERS [/qualifier ...]

3 qualifiers
/ALL
  Specifies that all known manufacturers, not just ones seen as active on
  the local cable, will be displayed.

/OUTPUT[=filespec]
  Specifies that the listing should be directed to the specified file.
  By default, the listing is sent to SYS$OUTPUT, the user terminal. If
  the filespec is incomplete or missing, the default is
  SYS$DISK:[]ETHERMON_MANUFACTURERS.LIS.

2 MESSAGES
  Displays the current setting of the SET MESSAGES command for enabling 
  or disabling output of asynchronous "significant event" messages to 
  the user terminal.

  The command format is

      SHOW MESSAGES

2 PERFORMANCE
  Displays performance statistics of ETHERMON's internal operation.

  Command format:
      SHOW PERFORMANCE [/qualifier]
3 Qualifiers
/INTERVAL=delta-time
 Specifies the period of time the command will run before it stops and 
 analyzes the data. Days may not be specified; only hours, minutes,
 seconds, and hundredths of seconds may be specified.

2 PORT_STATUS
  Displays the current status of ETHERMON's connection to the Ethernet
  interface.
3 Command_qualifiers
/ZERO
  Specifies that, after the port counters are read, they should be
  zeroed.

2 PROTOCOL_NAMES
  Displays the Ethernet protocol type and name association table. This
  table is used to find symbolic meanings of protocol types specified
  in Ethernet messages. Protocol types specified with a preceding '*'
  have been seen on the local Ethernet. Only seen protocols will be
  displayed unless the /ALL qualifier is used.

  The command format is

      SHOW PROTOCOL_NAMES [/qualifier ...]

3 qualifiers
/ALL
  Specifies that all known protocol types, not just ones seen as active 
  on the local cable, will be displayed.

/OUTPUT[=filespec]
  Specifies that the listing should be directed to the specified file.
  By default, the listing is sent to SYS$OUTPUT, the user terminal. If
  the filespec is incomplete or missing, the default is
  SYS$DISK:[]ETHERMON_PROTOCOLS.LIS.

1 SPAWN
  Spawns a DCL subprocess to execute normal DCL commands, leaving
  Ethermon collecting raw address and protocol data in the background.
  While in the SPAWNed subprocess, control-Y trapping is disabled in the
  parent process running ETHERMON (so as to not abort ETHERMON if you
  type control-C or control-Y in the subprocess).

  Format:
      SPAWN [command]

2 command
  A single DCL command may be executed by specifiying it after the
  SPAWN command. If no command is given, the subprocess enters a
  prompting mode until the subprocess logs out.

1 SUMMARIZE
  Tallies up the total number of messages found on the network for each
  address, protocol type, or whatever is being sorted for, over the
  specified sampling interval. Samples are taken for the interval set by
  the SET INTERVAL command (unless the /INTERVAL qualifier is used here
  to override), and then a report is generated, displaying the messages
  counts and associated identifiers sorted in decreasing message count
  order.

  The command format is

      SUMMARIZE group-type [/qualifier]

2 DESTINATIONS
  Specifies that the summary should be over destination addresses.

2 INTERNET
  Specifies that the summary should be over 2nd level protocols used in
  Internet IP (DoD) [06-00] protocol type messages. Additionally, for
  TCP and UDP protocols, the active port numbers are counted.

2 PROTOCOLS
  Specifies that the summary should be over protocol types.

2 SIZES
  Specifies that the summary should be over packet sizes.

2 SOURCES
  Specifies that the summary should be over source addresses.

2 STATISTICS
  Specifies that the summary should be of general interface counters.

2 Command_qualifiers
/INTERVAL=delta-time
 Specifies the period of time the command will runs before it stops and 
 analyzes the data. Days may not be specified; only hours, minutes,
 seconds, and hundredths of seconds may be specified.

/OUTPUT[=filespec]
  Specifies that the listing should be directed to the specified file.
  By default, the listing is sent to SYS$OUTPUT, the user terminal. If
  the filespec is incomplete or missing, the default is
  SYS$DISK:[]ETHERMON.SUM.

1 TRACE
  Collects messages received from the Ethernet into a file, as restricted
  by the currently enabled filter set. The TRACE command runs for the 
  period of time specified by the SET INTERVAL command, unless the /INTERVAL
  qualifier is specified with a different period. The file can be 
  recorded in either binary or printable ASCII format. The trace will only
  record data that passes the currently enabled filters.

  The command format is

      TRACE [/qualifier[/qualifier]]

2 Command_Qualifiers
/ABORT
 Specifies that any running asynchronous TRACE should be closed immediately
 (repeating or not). To terminate a synchronous TRACE command, use control-C.

/ANALYZER=imagename
 Specifies that the output data will be sent in real-time to an analyzer
 subprocess running the specified image. A VMS mailbox created by ETHERMON
 will receive the trace data in old ETHERMON binary format, and will be 
 defined as SYS$INPUT to the subprocess. The imagename is a filename ONLY; 
 filetype is .EXE, and the device and directory are those of the 
 ETHERMON.EXE image file currently being run. If not specified, output 
 is written to a file in old ETHERMON binary format.

/ASCII
 Specifies that the output file will be in ASCII format. If not specified,
 the default is old ETHERMON binary format.

/BINARY
 Specifies that the output file will be in old ETHERMON binary format. If 
 not specified, the default is old ETHERMON binary format.

/INTERVAL=delta-time
 Specifies the period of time the trace will run before it stops and the
 collection file is closed. Days may not be specified; only hours, minutes,
 seconds, and hundredths of seconds may be specified.

/OUTPUT=filespec
 Specifies the name of the output file; if not specified, the filename will
 be ETHERMON.DAT for old binary format, ETHERMON.LIS for ASCII format, and
 ETHERMON.SNIFFER for Sniffer format. If the /ANALYZER qualifier is used, 
 the filespec is given "as is" as the analyzer subprocess's SYS$OUTPUT 
 file, and defaults are interpreted by the analyzer image; by default, the 
 analyzer subprocess gets ETHERMON's SYS$OUTPUT as its own SYS$OUTPUT.

/PARALLEL
 Specifies that an asynchronous trace will be performed, i.e. the trace will
 be started and control will return to the command prompt immediately, not
 waiting for the trace to complete. Messages will be sent to the terminal
 when the trace starts and completes.

/REPEAT[=n]
 Specifies that a repeating asynchronous trace will be performed, i.e. the
 trace will be started and control will return to the command prompt
 immediately, not waiting for the trace to complete. After the specified
 interval, the trace file will be closed, a new file version opened, and
 the trace continued. If the optional number is specified, it specifies
 a version limit for trace files; versions older than (current - N) will
 be deleted automatically as the trace proceeds. /REPEAT implies /PARALLEL.
 Repeating is ignored if /ANALYZER is specified (although the parallel
 aspect is still used).

 A repeating trace should be stopped with the TRACE/ABORT command.

/SNIFFER
 Specifies that the output file will be in Sniffer binary format. If not 
 specified, the default is old ETHERMON binary format.

/STATISTICS
 Specifies that recording statistics should be printed at the end of the
 TRACE session. Can be specified as /NOSTATISTICS. By default, /PARALLEL
 sessions report no statistics at completion, and synchronous sessions
 do report statistics. These qualifiers may also be used on a TRACE/ABORT
 command to change the previously-chosen reporting option.

/TRUNCATE=maxlen
 Specifies for a binary recording session that only the first N bytes of
 the packet body should be recorded; all of the header is always recorded.
 By default, all of the packet body is recorded for every packet. This
 option is useful to improve performance and save disk space when recording
 large amounts of data where only the headers are required.

2 File_formats
3 ASCII
 The ASCII file contains three lines for each received and filter-passed
 Ethernet message. The first line contains the VMS timestamp when the
 message was received, the source and destination addresses in standard
 ASCII-hexadecimal format, the protocol type (also ASCII-hex), and the
 message body's length in bytes. The second line is a hexadecimal dump of
 the first 40 bytes of the received message; the third line is the same
 40 bytes dumped in ASCII (with a space before each actual character, such
 that the ASCII characters line up under their hexadecimal bytes; periods
 are displayed for unprintable characters).

 Preceding the dump lines is a single line reporting when the dump began.

 Following the dump lines are three lines reporting when the dump was
 completed, and the quantity of data bytes and messages processed from
 the Ethernet before and after filtering.

 The file has carriage-return carriage control and variable-length records.

3 Binary
 The binary file contains one variable-length record per received and
 filter-passed Ethernet message. A set of structure definitions for various
 languages are listed below.
4 FORTRAN

    STRUCTURE /BIN_REC/
      INTEGER*4 VMS_DATETIME(2) ! quadword system timestamp
      BYTE      DESTADDR(0:5)   ! beginning of XEDRIVER P5 buffer: dest addr
      BYTE      SRCADDR(0:5)    ! source Ethernet address
      UNION
       MAP
        BYTE    PROTOCOL(0:1)   ! Ethernet protocol type
       END MAP
       MAP
        BYTE    DSAP            ! IEEE 802 destination SAP
        BYTE    SSAP            ! IEEE 802 source SAP
        UNION
         MAP
          BYTE  CTL(0:1)        ! IEEE 802 CTL byte(s)
         END MAP
         MAP
          BYTE  ECTL            ! IEEE extended 802 CTL byte
          BYTE  PID(0:4)        ! IEEE extended 802 Protocol IDentification
         END MAP
        END UNION
       END MAP
      END UNION                 ! end of XEDRIVER P5 buffer (20 bytes)
      INTEGER*2 LENGTH          ! length of message body
      BYTE      BODY(4470)      ! not all of this array may be sent; only
                                ! part actually used is written to file
    END STRUCTURE ! /BIN_REC/

4 MACRO

            $DEFINI REC
    $EQU    REC$Q_TIME       0     ; VAX/VMS binary timestamp
    $EQU    REC$B_DESTADDR   8     ; 6-byte destination address
    $EQU    REC$B_SRCADDR    14    ; 6-byte source address
    $EQU    REC$B_PROTOCOL   20    ; 2-byte Ethernet protocol type
    $EQU    REC$B_DSAP       20    ; 1-byte IEEE 802 DSAP
    $EQU    REC$B_SSAP       21    ; 1-byte IEEE 802 SSAP
    $EQU    REC$B_CTL        22    ; 1- or 2-byte IEEE 802 CTL field
    $EQU    REC$B_ECTL       22    ; 1-byte IEEE extended 802 CTL field
    $EQU    REC$B_PID        23    ; 5-byte IEEE extended 802 protocol ID
    $EQU    REC$W_LENGTH     28    ; word length of message body
    $EQU    REC$T_BODY       30    ; body of message
    $EQU    REC$K_MAXLEN     4500  ; maximum length of file record
            $DEFEND REC

3 Sniffer
 Sniffer format recording files are binary variable-length record files
 which are images of the raw network packets (minus the synchronization
 prologs and CRC trailers).

3 Analyzer
 The input mailbox for an analyzer process receives its data in the old
 binary format (see Binary).

2 Control-C
  A synchronous TRACE command can be aborted prematurely by typing the
  control-C character. A message will be output to report the premature
  termination.

1 V24_Features
2 Control-C
  The control-C character is now recognized by ETHERMON as the internal
  command abort function. The DISPLAY and MONITOR commands can ONLY be
  terminated by control-C; other non-terminatable functions (SUMMARIZE,
  SHOW ADDRESS_NAMES) can now be prematurely stopped by control-C without
  terminating the whole ETHERMON program.

2 Analyzer
  The TRACE command can now feed the traced packet data to an analyzer
  subprocess in real-time. The interface is documented in the user's
  manual, such that any sort of real-time analysis could be implemented
  using ETHERMON as the front-end data collector and filter.

2 VMS-V5.4-3+ Support
  DEC changed the operation of the Ethernet device drivers as of VMS V5.4-3.
  Support for the modified driver interface is included in ETHERMON V2.4.

2 Keypad function keys
  The VT100 numeric keypad can now be used to enter command with single
  keystrokes, similar to other VMS utilities. The DEFINE/KEY, DELETE/KEY,
  and SHOW KEY commands have been added to allow the user to create their
  own function key definitions.

1 WAIT
  Causes ETHERMON to hang for a specified period of time, or until
  re-activated by another process. This is primarily useful in batch
  jobs where the repeating mode of the TRACE command is preferred,
  but where ETHERMON would exit when no longer given any commands.

  The WAIT can be terminated before its specified end time by typing 
  the control-C character (for interactive mode use) or by issuing
  a $WAKE service request at the process running ETHERMON. An appropriate
  message will be output indicating how the WAIT was aborted.

  The command format is

      WAIT delta-time [optional message]
      WAIT FOREVER [optional message]

2 delta-time
 Specifies the period of time the WAIT will hang before it stops and 
 execution is resumed. Days may not be specified; only hours, minutes,
 seconds, and hundredths of seconds may be specified.

2 FOREVER
 Specifies that the WAIT will only be terminated by outside action; if
 no outside abort is entered, the WAIT will last forever.

2 optional message
 Specifies an optional string of text which will be displayed on the
 standard output device (terminal or batch log file) before the WAIT
 begins. This is useful for ETHERMON script files, where the commands
 being executed cannot be seen by the user.
