NetCap uses the following syntax:
netcap
[/b:Number]
[/t
Type Buffer HexadecimalOffset HexadecimalPattern]
[/f:
FilterFile]
[/c:
CapturePath]
[/n:
Number]
[/k:
HH:MM:SS]
[/tcf:
FolderName]
-
/b:Number
- Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 MB.
-
/T
Type Buffer HexadecimalOffset HexadecimalPattern
- Specifies to use a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t /n option continues to capture until the spacebar is pressed, using the buffer as a queue.
-
Type
-
B = Buffer
-
P = Pattern
-
BP = Buffer then pattern
-
PB = Pattern then buffer
-
N = No trigger
-
Buffer
- Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.
-
HexadecimalOffset
- Hexadecimal offset from start of frame used with P, BP, PB, but not B.
-
HexadecimalPattern
- Hexadecimal pattern to match used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.
-
/c:
CapturePath
- Temporarily moves the capture path to CapturePath. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.
-
/f:
FilterFile
- Specifies a Network Monitor 2.x-generated capture filter (*.cf).
-
/l:
HH:MM:SS
- Specifies to capture for the given amount of time (max 99:99:99).
Note
- This option overrides the default 100 percent trigger, unless /t
Type is also specified.
-
/tcf:
FolderName
- Sets the default temporary capture folder. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.
-
/remove
- Removes the NetCap instance of the Network Monitor driver.
-
/n:
Number
- Specifies which NIC to use based on the NIC index number for this computer.
Examples
See Example 1: Capture Network Packets for 3 Minutes, Example 2: Monitoring With a Trigger, and Example 3: Remove the Network Monitor Driver.
