busTRACE This WEB page comes from the busTRACE 8.0 User's Manual. (Table of Contents)

Previous Topic Next Topic

Within the Capture Settings pane, you can adjust the selected device's Capture Parameters. The available parameters will vary depending on whether you have selected a USB device or a storage device.

Sample Storage Device Capture Parameters
Sample USB Device Capture Parameters

Capture Parameters (Any Device Type)

Apply to All After you have configured the capture settings, for the selected device, you may want all devices to share those same settings. When you select this field, a button will appear in the rightmost position of the field. Simply click the button to have this device's capture parameters and trigger points applied to all devices.
Maximum Capture Size

Each I/O that is occurring within your system might transfer a large amount of data. For example, let's say an I/O is sent to read 128 sectors from the hard drive. Sectors typically store 512 bytes. That would mean that the system is attempting to read 512*128 bytes which is 64K. busTRACE can capture the entire data, if so configured.

You may find that you are not interested in storing the entire amount of data transferred with each I/O. Perhaps you are only interested in the first 16 bytes or no bytes at all. Perhaps you're only looking for error information and do not care about the data. Alternatively, if you're doing Data Corruption Analysis, you probably want to store all the data transferred so that you have it available for your analysis.

Simply enter in the maximum number of bytes you would like captured per I/O. The smaller the value, the more I/O activity busTRACE will be able to capture into memory (as less space would be used to store any data transferred). busTRACE defaults to storing up to the first 512 bytes of transfer in the capture buffer.

You can enter the data in hex format if you like. Simply append the data with 'h'. For example, to submit 256 decimal bytes as the value, in hex, you would enter 100h.

Capture Power IRPs This field specifies whether or not you want Power Management I/O Request Packets (IRPs) captured for any devices that appear while a busTRACE capture is active.
Capture PnP IRPs This field specifies whether or not you want Plug and Play IRPs captured for any devices that appear while a busTRACE capture is active.
Capture IOCTLs This field specifies whether or not you want IOCTL requests captured for any devices that appear while a busTRACE capture is active.

Capture Parameters (Storage Devices)

Capture SRB with SPTI

This feature can only work if you have our Advanced Filtering feature enabled.

Windows storage port drivers (e.g. SCSIPORT.SYS, ATAPI.SYS, USBSTOR.SYS, etc.) can be sent two types of requests. One is a SCSI Request Block (SRB). SRBs allow another device driver to send down a request to a device. The other is a SCSI Pass Through IOCTL (SPTI). SCSI Pass Through IOCTLs are accessible to ring 3 applications that want to send down a CDB to a storage device. busPROBE, for example, uses SCSI Pass Through to send down CDBs.

When a port driver receives a SCSI Pass Through IRP, many will internally create an SRB IRP and send it to the device. The contents of the SRB IRP are usually identical to the SCSI Pass Through IRP. It is for this reason that busTRACE defaults to only showing you the SCSI Pass Through IRP.

If you place a checkmark on this option, busTRACE will attempt to capture any SRB IRPs that are being created in order to process the SCSI Pass Through IRP. Our ability to do this is dependent on the port driver.

As an example, consider this screenshot:

In this sample, we have enabled busTRACE's Viewing Interleaved I/O Activity feature. This sample capture is for a single Inquiry CDB being sent to a USB Flash Drive. There are four entries in the sample above; each one described below.

  1. The first line shows an SPTI request (IOCTL_SCSI_PASS_THROUGH_DIRECT) with an Inquiry command embedded within the structure.
  2. The SPTI request is received by Microsoft's USBSTOR.SYS driver. In order to process the IOCTL, USBSTOR.SYS internally creates an SRB IRP.
  3. The SRB IRP has now finished. Here, you can see that the overall time for the SRB IRP was 513 usec.
  4. Now that USBSTOR.SYS has the SRB IRP finished, it has the information necessary to complete the initial SPTI request. Here, you can see that the overall time for the SPTI IRP to finish was 538 usec.
Double Capture Data Out

By enabling this option, you are requesting busTRACE to take a snapshot of an outbound data buffer (e.g. Write CDB) when the I/O starts (i.e. going down the I/O stack) as well as when the I/O finishes (i.e. going back up the I/O stack). This feature can be useful to help determine if some software is altering the buffer in the middle of a write sequence. When this feature is enabled, and you perform a data corruption analysis, busTRACE will automatically compare both buffers and flag the I/O with a bookmark and comment if the buffers do not match. The comment will state "Buffer altered during write sequence." In the Raw Data pane, you can use the "Split Vertical View" or "Split Horizontal View" toolbar button to have both buffers appear at the same time.

CDB Filter This feature allows you to set a kernel mode Kernel Mode CDB Filter.

Capture Parameters (USB Devices)

There are no additional capture parameters for USB devices.

See Also: