$#
Portmon for Windows NT
Copyright © 1998 Mark Russinovich
http://www.sysinternals.com

Introduction

Portmon is a GUI/device driver combination that together monitor and display all serial and parallel port activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way NT works, seeing how applications use ports, or tracking down problems in system or application configurations. 

Portmon works on NT 4.0.

Starting Portmon

Simply run the Portmon GUI (portmon.exe) from the same directory that the driver (Portm.sys) resides in. Note that it must be located on a non-network drive and that you must have administrative privilege to run Portmon. When Portmon is started for the first time it will monitor all serial and parallel. Menus, hot-keys, or toolbar buttons can be used to clear the window, select and deselect monitored ports, save the monitored data to a file, and to filter and search output. 

As events are printed to the output, they are tagged with a sequence number. If Portmon’s  internal buffers are overflowed during extremely heavy activity, this will be reflected with gaps in the sequence number.

Each time you exit Portmon it remembers the position of the window and the widths of the output columns.

Selecting Ports

The Ports menu can be used to select and deselect monitored ports. In the menu you will see the DOS name that NT has given to the port as well as the corresponding name of the device object that represents the port. For example, if the DOS device name COM1 were mapped to the device object \device\serial0 the menu item would be “COM1: Serial0”. Output that displays monitored activity to this port would refer to Serial0. Ports that have no DOS name are not shown in the menu.

In some cases you may not be able to monitor a particular serial or parallel port. Because ports are exclusive devices, if an application or driver has already opened the port Portmon will be unable to open it, and therefore not be able to monitor it.

Viewing the Output

Portmon understands all serial and parallel port I/O control (IOCTLs) commands and will display them along with interesting information regarding their associated parameters. For read and write requests Portmon displays the first 48 bytes of the buffer, using ‘.’ to represent non-printable characters.

Filtering Output

Use the Filter dialog to select what data will be shown in the list view. The ‘*’ wildcard matches arbitrary strings, and the filters are case-insensitive.  Only matches shown in the process include filter, but that are not excluded with the process exclude filter, are displayed. Use ‘;’ to separate multiple strings in a filter (e.g. “*Portmon*;*Explorer*”). 

Limiting Output

The History Depth entry in the Filter dialog allows you to specify the maximum number of lines that will be remembered in the output window. Use a depth of 0 to signify no limit.

Searching the Output

You can search the output window for strings using the Find menu item (or the find toolbar button). Once you have opened a Find dialog and hit the FindNext button, you can repeat the search without changing the focus back to the Find dialog by hitting the F3 key.

To start a search at a particular line in the output, select the desired line by clicking on the far left column (the index number). If no line is selected a new search starts at the first entry in searching down, and at the last entry for searching up.

Time Settings

Portmon can either timestamp events or show their duration. The Events menu and the clock toolbar button let you toggle between the two modes. The button on the toolbar shows the current mode with a clock or a stopwatch. When showing duration the Time field in the output shows the number of seconds it took for the underlying file system to service particular requests.

Viewing Partially Obscured Fields

Fields within a row in Portmon’s output may be partially hidden if the field’s column is not wide enough to fully display the field’s text. If you have a newer version of the Microsoft’s common control dialog DLL then hovering the mouse over an obscured field will cause a tool-tip with the contents of the field to be displayed. If this does not occur, try right-clicking on the field. With old versions of the common control DLLs the only way to reveal an obscured field is to make its column wider.

Controlling Output Width

You can completely close a column by making it have no width and then open it by dragging its separator, which will still be accessible. This is useful for temporarily removing columns that are not of interest.

Reporting Bugs and Feedback

If you encounter a problem while running Portmon, please visit http://www.sysinternals.com to obtain the latest version. If you still have problems, please record all the information in the top few lines of a Blue Screen, as well as the section of addresses and driver names just above the administrative message. Determine if the problem is reproducible, and if so, how, and send this information to:

mark@sysinternals.com