[Filemon Logo]

 Copyright © 1998-1999 Mark Russinovich

 Last Updated January 21, 1998 V2.0
  ------------------------------------------------------------------------

   Introduction  Portmon is a GUI/device driver combination that monitors
                 and displays all serial and parallel port activity on a
                 system. It has advanced filtering and search capabilities
                 that make it a powerful tool for exploring the way NT
                 works, seeing how applications use ports, or tracking
                 down problems in system or application configurations.

                 Portmon works on NT 4.0, 5.0 (Windows 2000), Windows 95
                 and Windows 98.

  Sample Screen  This is a screenshot of Portmon watching a dial-up
           Shot  session.

   Installation  Simply run the Portmon GUI (portmon.exe) from the same
       and Use   directory that the driver (Portm.sys) resides in. Note
                 that it must be located on a non-network drive and that
                 you must have administrative privilege to run Portmon.
                 When Portmon is started for the first time it will
                 monitor all serial and parallel. Menus, hot-keys, or
                 toolbar buttons can be used to clear the window, select
                 and deselect monitored ports, save the monitored data to
                 a file, and to filter and search output.

                 As events are printed to the output, they are tagged with
                 a sequence number. If Portmon's internal buffers are
                 overflowed during extremely heavy activity, this will be
                 reflected with gaps in the sequence number.

                 Use the Filter dialog to select what data will be shown
                 in the list view. The '*' wildcard matches arbitrary
                 strings, and the filters are case-insensitive. Only
                 matches shown in the process include filter, but that are
                 not excluded with the process exclude filter, are
                 displayed. Use ';' to separate multiple strings in a
                 filter (e.g. "*Portmon*;*Explorer*").

                 Portmon understands all serial and parallel port I/O
                 control (IOCTLs) commands and will display them along
                 with interesting information regarding their associated
                 parameters. For read and write requests Portmon displays
                 the first several dozen bytes of the buffer, using '.' to
                 represent non-printable characters. The Show Hex menu
                 option lets you toggle between ASCII and raw hex output
                 of buffer data.

  How it Works:  The Portmon GUI is responsible for identifying serial and
          WinNT  parallel ports. It does so by enumerating the serial
                 ports that are configured under
                 HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm and the
                 parallel ports defined under
                 HKEY_LOCAL_MACHINE\Hardware\DeviceMap\Parallel Ports.
                 These keys contain the mappings between serial and
                 parallel port device names and the Win32-accessible
                 names.

                 When you select a port to monitor, Portmon sends a
                 request to its device driver that includes the NT name
                 (e.g. \device\serial0) that you are interested in. The
                 driver uses standard filtering APIs to attach its own
                 filter device object to the target device object. First,
                 it uses ZwCreateFile to open the target device. Then it
                 translates the handle it receives back from ZwCreateFile
                 to a device object pointer. After creating its own filter
                 device object that matches the characteristics of the
                 target, the driver calls IoAttachDeviceByPointer to
                 establish the filter. From that point on the Portmon
                 driver will see all requests aimed at the target device.
                 A complete source code example of filtering is
                 demonstrated by our Filemon file system monitor.

                 Portmon has built-in knowledge of all standard serial and
                 parallel port IOCTLs, which are the primary way that
                 applications and drivers configure and read status
                 information from ports. The IOCTLs are defined in the DDK
                 file \ddk\src\comm\inc\ntddser.h and
                 \ddk\src\comm\inc\ntddpar.h, and some are documented in
                 the DDK.

  How it Works:  On Windows 95 and 98, the Portmon GUI relies on a
          Win9x  dynamically loaded VxD to capture serial and parallel
                 activity. The Windows VCOMM (Virtual Communications)
                 device driver serves as the interface to parallel and
                 serial devices, so applications that access ports
                 indirectly use its services. The Portmon VxD uses
                 standard VxD service hooking to intercept all accesses to
                 VCOMM's functions. Like its NT device driver, Portmon's
                 VxD interprets requests to display them in a friendly
                 format.

  ------------------------------------------------------------------------

  In order to help us track its use, please download through the link that
                    represents the operating system on
                 which you will use or mostly use Portmon.
     Note that the zip files are identical, and Portmon runs on either
                                 platform.

     Download Portmon (x86 - 52KB) - you plan on using Portmon on Win9x

     Download Portmon (x86 - 52KB) - you plan on using Portmon on WinNT

                      Download Portmon (Alpha - 84KB)

                                  [Image]