Portmon for Windows v3.03

By Mark Russinovich

Published: January 12, 2012

Download Portmon (226 KB)
Run now from Sysinternals Live.

Introduction

Portmon is a utility that monitors and displays all serial and parallel port activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way Windows works, seeing how applications use ports, or tracking down problems in system or application configurations.

Portmon 3.x

Version 3.x of Portmon marks the introduction of a number of powerful features.

• Remote monitoring: Capture kernel-mode and/or Win32 debug output from any computer accessible via TCP/IP — even across the Internet. You can monitor multiple remote computers simultaneously. Portmon will even install its client software itself if you are running it on a Windows NT/2K system and are capturing from another Windows NT/2K system in the same Network Neighborhood.
• Most-recent-filter lists:Portmon has been extended with powerful filtering capabilities and it remembers your most recent filter selections, with an interface that makes it easy to reselect them.
• Clipboard copy: Select multiple lines in the output window and copy their contents to the clipboard.
• Highlighting: Highlight debug output that matches your highlighting filter, and even customize the highlighting colors.
• Log-to-file: Write debug output to a file as its being captured.
• Printing: Print all or part of captured debug output to a printer.
• One-file payload:Portmon is now implemented as one file.

The on-line help-file describes all these features, and more, in detail.

Installation and Use

Simply execute the Portmon program file (portmon.exe) and Portmon will immediately start capturing debug output. To run Portmon on Windows 95 you must get the WinSock2 update from Microsoft. Note that if you run Portmon on Windows NT/2K portmon.exe must be located on a non-network drive and you must have administrative privilege. Menus, hot-keys, or toolbar buttons can be used to clear the window, save the monitored data to a file, search output, change the window font, and more. The on-line help describes all of Portmon’s features.

Portmon understands all serial and parallel port I/O control (IOCTLs) commands and will display them along with interesting information regarding their associated parameters. For read and write requests Portmon displays the first several dozen bytes of the buffer, using ‘.’ to represent non-printable characters. The Show Hex menu option lets you toggle between ASCII and raw hex output of buffer data.

How it Works: WinNT

The Portmon GUI is responsible for identifying serial and parallel ports. It does so by enumerating the serial ports that are configured under HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm and the parallel ports defined under HKEY_LOCAL_MACHINE\Hardware\DeviceMap\Parallel Ports. These keys contain the mappings between serial and parallel port device names and the Win32-accessible names.

When you select a port to monitor, Portmon sends a request to its device driver that includes the NT name (e.g. \device\serial0) that you are interested in. The driver uses standard filtering APIs to attach its own filter device object to the target device object. First, it uses ZwCreateFile to open the target device. Then it translates the handle it receives back from ZwCreateFile to a device object pointer. After creating its own filter device object that matches the characteristics of the target, the driver calls IoAttachDeviceByPointer to establish the filter. From that point on the Portmon driver will see all requests aimed at the target device.

Portmon has built-in knowledge of all standard serial and parallel port IOCTLs, which are the primary way that applications and drivers configure and read status information from ports. The IOCTLs are defined in the DDK file \ddk\src\comm\inc\ntddser.h and \ddk\src\comm\inc\ntddpar.h, and some are documented in the DDK.

How it Works: Windows 95 and 98

On Windows 95 and 98, the Portmon GUI relies on a dynamically loaded VxD to capture serial and parallel activity. The Windows VCOMM (Virtual Communications) device driver serves as the interface to parallel and serial devices, so applications that access ports indirectly use its services. The Portmon VxD uses standard VxD service hooking to intercept all accesses to VCOMM’s functions. Like its NT device driver, Portmon‘s VxD interprets requests to display them in a friendly format. On Windows 95 and 98 Portmon monitors all ports so there is no port selection like on NT.

Download Portmon (226 KB)

Run now from Sysinternals Live.

Serial Monitor

Serial Port Monitor

This software allows you to monitor the data that devices and apps exchange over serial ports. The program facilitates the development, debugging and analysis of software and hardware solutions that use serial communications for data exchange. It has full set of tools for successful decoding of serial protocols and analyzing packets data. The application’s various editions include features for filtering, browsing, searching, recording, and data playback.

Serial Monitor provides not only a wide range of visualization tools for popular serial protocols (including PPP, MODBUS, BACnet MSTP) and raw data, but also utilities for creating your own custom visualizers, allowing you to parse any data and custom protocols in a convenient way. In addition to visualizers, product includes tools for data exporting, reproducing data from previously recorded log files, redirecting this data to COM ports, advanced serial port terminal, utility for sending MODBUS Commands and built-in scripting for tools automation.

This is entirely a software COM port analyzing and serial port data logging solution that allows you to avoid using hardware equipment, null-modem cable, additional DB-25 or DE-9 connectors and so on.

Our serial port data capturing software has been developed and constantly improved for more than 20 years. It has an intuitive user interface, detailed documentation with examples and requires no special programming skills to start using it. Download this COM port analyzer now and start spying serial ports in a few seconds!

Serial Monitor works by installing a filter driver on top of a serial device driver. A filter driver intercepts all I/O requests issued by application. There are control requests that configure port parameters as well as data transfer requests that pass data between application and serial device. Each request is captured and passed to a running monitoring session within Serial Monitor for further analysis.

Serial Monitor includes a large set of data protocols to parse each intercepted data transfer request. The user can add his own protocols using the simple yet powerful protocol definition language.

Each monitored data packet is parsed according to the configured protocols. An optional capture filter can be used to locate data of interest. A wide set of built-in and custom data visualizers and exporters are provided to give the user powerful insight on the monitored data.

The built-in powerful Serial Terminal module provides a versatile terminal emulation environment which can be used in collaboration with a running monitoring session.

Serial Monitor provides rich support for MODBUS protocol and devices, including specialized data visualizers, MODBUS Send window (MODBUS packet builder and sender) and full MODBUS protocol definition.

Virtually every component of the Serial Monitor may be programmatically controlled by a running script, written in TypeScript (superset of JavaScript).

Download this software rs232/rs422/rs485 serial protocol analyzer now!

Serial port monitoring and data processing algorithms are extremely optimized in order to provide you with slick user experience and eliminate all negative impact on operating system performance, stability, computer resources consumption, and introduction of communication delays even at high non-standard data transfer rates. This makes our non-intrusive rs485/rs422, rs232 data tracer different from any competing products.

Our serial protocol analyzer supports all standard Data bits, Stop bits, Parity (odd/even/mark/space), software XON/XOFF and hardware flow control, Bit rates of 75, 110, 300, 1200, 2400, 4800, 9600, 19200, 38400, 57600 and 115200 bit/s and more.

It monitors data from plug and play I/O ports (COM Ports) interfaced by 16550 UART: COM1, COM2, COM3, COM4 . COMN, custom and virtual serial ports correctly registered within Windows operating system and visible in device manager under standard «Ports (COM & LPT)» device class. It displays all I/O Control Code Requests (IOCTLs), I/O Request Packets (IRPs) from data terminal equipment (DTE) and data circuit-terminating equipment (DCE) devices, logs data from RS-232, RS-422 or RS-485 interfaces and analyzes serial port data streams.

Being used with our Virtual Serial Port Tools, rs232 port sniffer may intercept, capture and trace serial port traffic which flows via named pipes.

It allows you to view, explore and export parsed data in a majority of binary and text formats: Hex, Binary, Decimal data, text: ASCII, ANSI, OEM, UNICODE UTF16, UTF8, ISO, CSV

Powerful display and capture filter features may be used if you want to customize serial port monitor data output.

You may successfully use this serial communications viewer and debugger for:

• Development of RS232, RS485 and RS422 peripheral devices and serial device drivers
• Serial protocol development, system integration / diagnostics
• Analyzing of data transferred between any RS232/422/485 device and Windows application
• Debugging any serial port software or hardware
• Snooping serial data, I/O request packets (IRPs) and control requests
• Researching functionality of any third-party software applications and hardware devices
• Detecting errors in asynchronous data transmission
• Debugging and testing different MODBUS devices
• Parsing and analyzing of MODBUS RTU / MODBUS ASCII protocol packets
• Transmitting commands to developed device/app, view responses and test it for failures
• Testing and troubleshooting serial protocols between serial device and device driver
• Analyzing and reverse-engineering RS-232/RS-422/RS-485 serial protocols

Using custom protocol feature you can parse any SCADA industrial protocol which is transmitted over RS485, RS422 or RS232 serial connection, dial up/radio modem or TCP/IP, UDP/IP network.

The following target groups may found our software serial port logic analyzer useful:

• Serial port device drivers and software developers
• EIA RS-232, RS-422, RS-485 hardware developers, vendors / manufacturers
• Lab and field engineers
• Programmers, app testers and other IT specialists
• SCADA software system engineers
• Science technicians and university students
• Industrial control equipment support specialists
• Consultants and system integrators

Download our rs232/422/485 port monitor and serial datalogger/parser/decoder now!

Our serial port analyzer and rs232 serial data logger supports all modern desktop/server Windows platforms starting from Windows XP (32-bit / 64-bit), including Windows 2019 server and Windows 10 (x86 / x64) operating systems.

Our serial port monitoring software allows you to capture communication data transmitted between serial applications and the following devices*:

• Mini-ATS, Dial-up Modems, Fax-Modems, Computer terminals, teletypes
• Industrial automation systems, RS232/485/422 industrial equipment
• POS terminals, shop till systems, Bar code scanners and other point of sale devices
• Network equipment, NPort servers, Wireless LAN equipment, Serial device servers
• Diagnostic equipment, remote software debuggers
• Routers, Multiplexers, Switches, Hubs, console ports, firewalls, load balancers
• Serial to fiber converters, RS-232 to RS-422/485 converters, multiport serial boards
• Scientific instruments, test instruments, printers, lamps, relays, telescopes
• Test and measuring equipment, multimeters, manometers, oscilloscopes, sensors
• Network-enable serial devices, uninterruptible power supply, serial device controllers
• Low-speed satellite modems, satellite phones, GPS equipment, other satellite based transceiver devices
• Echo sounder, sonars, anemometer, gyrocompass, autopilot, GPS receivers and other instruments
• Servo drives, PLCs, VFDs, CNC equipment programmable via serial RS232/422/485 interface
• MIDI-serial devices, Entertaining equipment, simulators
• Door entry systems, HVAC, security systems
• Cash registers, Bar-code readers, Card readers

* Connected to the computer via legacy / PnP RS-232, RS-422, RS-485 serial ports, serial to usb converters and usb to serial adapters.

Additionally, it supports monitoring of serial data from devices connected to the PC using wireless bluetooth serial ports. Software-based Virtual COM ports are also supported.

Our serial port data snooping software application supports the following Serial Major I/O Requests:

• IRP_MJ_POWER
• IRP_MJ_CREATE
• IRP_MJ_PNP
• IRP_MJ_DEVICE_CONTROL
• IRP_MJ_INTERNAL_DEVICE_CONTROL
• IRP_MJ_QUERY_INFORMATION
• IRP_MJ_READ
• IRP_MJ_WRITE
• IRP_MJ_SET_INFORMATION
• IRP_MJ_FLUSH_BUFFERS
• IRP_MJ_SYSTEM_CONTROL

Serial port snooper and data logger also supports the following Serial Device Control Requests or Input/Output Control Code Requests (IOCTLs):

• IOCTL_SERIAL_GET_BAUD_RATE
• IOCTL_SERIAL_GET_CHARS
• IOCTL_SERIAL_GET_COMMSTATUS
• IOCTL_SERIAL_GET_DTRRTS
• IOCTL_SERIAL_GET_HANDFLOW
• IOCTL_SERIAL_GET_LINE_CONTROL
• IOCTL_SERIAL_GET_MODEM_CONTROL
• IOCTL_SERIAL_GET_MODEMSTATUS
• IOCTL_SERIAL_GET_PROPERTIES
• IOCTL_SERIAL_GET_STATS
• IOCTL_SERIAL_GET_TIMEOUTS
• IOCTL_SERIAL_GET_WAIT_MASK
• IOCTL_SERIAL_SET_BAUD_RATE
• IOCTL_SERIAL_SET_BREAK_OFF
• IOCTL_SERIAL_SET_BREAK_ON
• IOCTL_SERIAL_SET_CHARS
• IOCTL_SERIAL_SET_DTR
• IOCTL_SERIAL_SET_FIFO_CONTROL
• IOCTL_SERIAL_SET_HANDFLOW
• IOCTL_SERIAL_SET_LINE_CONTROL
• IOCTL_SERIAL_SET_MODEM_CONTROL
• IOCTL_SERIAL_SET_QUEUE_SIZE
• IOCTL_SERIAL_SET_RTS
• IOCTL_SERIAL_SET_TIMEOUTS
• IOCTL_SERIAL_SET_WAIT_MASK
• IOCTL_SERIAL_SET_XOFF
• IOCTL_SERIAL_SET_XON
• IOCTL_SERIAL_APPLY_DEFAULT_CONFIGURATION
• IOCTL_SERIAL_CLEAR_STATS
• IOCTL_SERIAL_CLR_DTR
• IOCTL_SERIAL_CLR_RTS
• IOCTL_SERIAL_CONFIG_SIZE
• IOCTL_SERIAL_IMMEDIATE_CHAR
• IOCTL_SERIAL_LSRMST_INSERT
• IOCTL_SERIAL_PURGE
• IOCTL_SERIAL_RESET_DEVICE
• IOCTL_SERIAL_WAIT_ON_MASK
• IOCTL_SERIAL_XOFF_COUNTER

Our serial protocol analyzer supports the following serial protocols:

• MODBUS RTU Protocol
• MODBUS ASCII Protocol
• BACnet MSTP Protocol
• PPP Point-to-Point Protocol
• BVLC BACnet Virtual Link Control Protocol
• ARP Protocol
• CCP CAN Calibration Protocol
• CHAP Challenge Handshake Authentication Protocol
• DHCP, DHCPv6 Dynamic Host Configuration Protocol
• DNS Domain Name System Protocol
• GRE Generic Routing Encapsulation Protocol
• HTTP Protocol
• ICMP, ICMPv6 Internet Control Message Protocol
• IPCP, IPCP6 Internet Protocol Control Protocol
• IPv4, IPv6 Protocol
• LCP Link Control Protocol
• LLMNR Link-Local Multicast Name Resolution Protocol
• LQR Protocol
• MODBUS TCP/IP (MODBUS-TCP) Protocol
• MSRPC Protocol
• NetBIOS Protocol
• NetBIOS Datagram Service Protocol
• NBSS NetBIOS Session Service Protocol
• PPTP Point-to-Point Tunneling Protocol
• SMB2, SMB Server Message Block Protocol
• SMB over TCP Protocol
• TCP Protocol
• UDP Protocol
• Custom Protocols

Download this serial port packets analyzer now!