Network Monitor

Network administrators use Network Monitor to view and detect problems on local area networks (LANs).

  • Before using Network Monitor, see Checklist: Monitoring network traffic on your local computer.
  • To find features that have been moved in Microsoft® Windows® Server 2003 family operating systems, see New ways to do familiar tasks.
  • For tips about using Network Monitor, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Monitoring network traffic on your local computer

Step | Reference
Review key concepts. | Network Monitor overview; Best practices
Confirm that you are a member of the Administrators group. | Default local groups;To edit local security settings
Install Network Monitor tools. | To install Network Monitor
(Optional) If you want to make sure your captures do not exceed available memory on your computer, then modify your buffer settings. | To modify capture buffer settings
(Optional) If you want to exclude traffic from a certain network address from being captured, then create a capture filter. | Capture filters;To design a capture filter
(Optional) If you want to trigger a capture when a specific string appears in a frame, then create a capture trigger. | Set a capture trigger
(Optional) If you want to specify certain protocols or addresses that you want to save to file, then create a display filter. | To design a display filter;To load a display filter


New ways to do familiar tasks

The following table lists common tasks for configuring Network Monitor. The user interface for performing these tasks is almost identical in this version of Windows to the way it was in Windows NT version 4.0.

Note

  • XOX
If you want to | In Windows NT 4.0 use | In this version of Windows use
Install Network Monitor | Network in Control Panel. | Open Windows Components wizard. For more information, see To install Network Monitor.
Install the Network Monitor driver | Network in Control Panel. | Open Network Connections; go to Local Area Connection Properties. For more information, see To install the Network Monitor driver.


Best practices

  • Running Network Monitor during low-usage times
    Run Network Monitor at low-usage times or for short periods of time. This decreases the effect that Network Monitor might have on the performance of your computer.
  • Capturing minimum amount of network statistics
    Use capture filters and capture only as many statistics as you need for evaluation. This prevents you from capturing too much information to make a reasonably quick diagnosis of the problem.
  • Viewing Network Monitor captures
    Use display filters when viewing captured frames to omit extraneous captured frames.
  • Capturing frames on token ring networks
    Token ring adapters reject frames larger than a size specified in their configuration settings. If you capture frames on token ring networks, set your network adapter to accept the largest possible token-ring frame size, which is 17 KB. For more information, see the documentation for your network adapter.


How to...

  • Install and configure Network Monitor
  • Capture network data
  • Display network data
  • Print network data


Install and configure Network Monitor

  • Install Network Monitor
  • Modify capture buffer settings
  • Install the Network Monitor driver


Install Network Monitor

Microsoft Windows graphic

To install Network Monitor

  1. Open Windows Components wizard.
  2. In the Windows Components wizard, click Management and Monitoring Tools, and then click Details.
  3. In Subcomponents of Management and Monitoring Tools, select the Network Monitor Tools check box, and then click OK.
  4. If you are prompted for additional files, insert the installation CD for your operating system, or type a path to the location of the files on the network.

Notes

  • XOX
  • XOX
  • XOX
  • This procedure automatically installs the Network Monitor driver.
Related Topics


Modify capture buffer settings

Microsoft Windows graphic

To modify capture buffer settings

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Buffer Settings.
  4. Specify the maximum size of the capture buffer. If necessary, also adjust the maximum size of frames to be captured, and then click OK.

Notes

  • XOX
  • XOX
  • If your buffer setting exceeds the available memory on your computer, frames might be dropped.


Install the Network Monitor driver

Microsoft Windows graphic

To install the Network Monitor driver

  1. Open Network Connections.
  2. In Network Connections, click Local Area Connection, click the File menu, and then click Properties.
  3. In the Local Area Connection Properties dialog box, click Install.
  4. In the Select Network Component Type dialog box, click Protocol, and then click Add.
  5. In the Select Network Protocol dialog box, click Network Monitor Driver, and then click OK.
  6. If you are prompted for additional files, insert the installation CD for your operating system, or type a path to the location of the files on the network.

Notes

  • XOX
  • XOX
  • Network Monitor Driver does not appear in the Select Network Protocol dialog box if the Network Monitor driver is already installed.


Capture network data

  • Capture network frames
  • Save captured frames to a file
  • Set a capture trigger
  • Capture data in dedicated capture mode
  • Identify the largest broadcaster on the network
  • Use a capture filter


Capture network frames

Microsoft Windows graphic

To capture network frames

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Buffer Settings, and then set the buffer and frame size as appropriate.
  4. On the Capture menu, click Start.

Notes

  • XOX
  • XOX
  • If you add a network interface, you must restart Network Monitor before you can capture data on that interface.
  • To pause, stop, or display the data capture, on the Capture menu, click Pause, Stop, or Display Captured Data. You can also stop and display the capture by clicking Stop and View.
  • Network Monitor displays session statistics of the first 100 unique network sessions that it detects. To reset statistics and view information about the next 100 detected network sessions, click the Capture menu, and then click Clear Statistics
    • .
  • If you want to capture data from multiple local networks at the same time, install an adapter and start an instance of Network Monitor for each network. In each instance, specify the network from which you want to capture data by, on the Capture menu, clicking Networks and selecting a network.
  • If prompted for additional files, insert the installation CD for your operating system, or type a path to the location of the files on the network.


Save captured frames to a file

Microsoft Windows graphic

To save captured frames to a file

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Buffer Settings, and then set the buffer and frame size as appropriate.
  4. On the Capture menu, click Start.
  5. To halt the data capture temporarily, on the Capture menu, click Pause.
  6. To stop and view the data capture, on the Capture menu, click Stop and View.
  7. On the File menu, click Save As.
  8. Open the folder in which you want to store the file.
  9. In the File Name box, specify a file name.
  10. If necessary, do one of the following:
    • To save a range of frames, in the From box, type the beginning frame number, and in the To box, type the ending frame number.
    • To save only the frames that appear when the current display filter is in use, select the Filtered check box.
  11. Click Save.

Notes

  • XOX
  • XOX
  • If you add a network interface, you must restart Network Monitor before you can capture data on that interface.
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • To change the default network, on the Capture menu, click Networks, and then choose the network on which you are trying to capture data.
  • If you want to use Network Monitor to load the file you saved, use the .cap file extension. Network Monitor automatically uses this file extension if you do not specify one.
  • Network Monitor cannot open capture files larger than 1 GB (1,024 MB).
  • When you save a range of frames or apply a display filter and then save the filtered frames, Network Monitor renumbers the saved frames, starting with 1. However, you can create a file with the original frame numbers preserved. To do this, on the File menu, click Print, click the General tab, and then select the Print to file check box.


Set a capture trigger

Microsoft Windows graphic

To set a capture trigger

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Trigger.
  4. Do one of the following to specify trigger criteria:
    • To initiate a trigger action when a specific ASCII or hexadecimal string appears in a frame, click Pattern match. In the Pattern box, type the string you want Network Monitor to detect, and then specify whether the pattern is in hexadecimal or ASCII. If you want, specify where Network Monitor should search for the pattern.
    • To initiate a trigger action when a specific percentage of the capture buffer is full, click Buffer space, and then specify the percentage needed.
    • To initiate a trigger action when Network Monitor detects a specific pattern in a frame after a specific percentage of the capture buffer becomes full, click Buffer space then pattern match, and specify the percentage and pattern needed.
    • To initiate a trigger action when a specific percentage of the capture buffer becomes full after Network Monitor detects a specific pattern in a frame, click Pattern match then buffer space, and specify the pattern and percentage needed.
    • To clear any capture triggers that have been set, click Nothing.
  5. Do one of the following to specify a trigger action:
    • To have the computer beep, click Audible Signal Only.
    • To stop the capture, click Stop Capture.
    • To run a command or a program, click Execute Command Line and specify the command or program that runs when the conditions for the trigger are met. To specify a program, type the path and the name of the program file, or click Browse and navigate to the program file. To use an MS-DOS command, such as copy, type CMD /K, and then type the command.

Notes

  • XOX
  • XOX
  • If you click Pattern match then buffer space and set Buffer Space to 100%, Network Monitor starts monitoring the capture buffer size with the frame after the frame that contained the pattern match. This means that when the buffer is 100% full, the frame containing the pattern match has been overwritten. If you use the Pattern match then buffer space option and need to view the frame that contains the pattern match in order to analyze your network traffic issues, set Buffer Space to 75% or smaller.


Capture data in dedicated capture mode

Microsoft Windows graphic

To capture data in dedicated capture mode

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Dedicated Capture Mode.
  4. On the Capture menu, click Start.

Notes

  • XOX
  • XOX
  • If you add a network interface, you must restart Network Monitor before you can capture data on that interface.
  • During the capture, select options in the Dedicated Mode dialog box.
  • In dedicated capture mode, Network Monitor does not display or refresh capture statistics when frames are copied to the temporary capture file. This frees more resources for capturing data.
  • Use dedicated capture mode if Network Monitor drops frames due to a lack of resources.


Identify the largest broadcaster on the network

Microsoft Windows graphic

To identify the largest broadcaster on the network

  1. Open Network Monitor.
  2. On the Capture menu, click Start.
  3. When you finish capturing data, on the Capture menu, click Stop (or Pause).
  4. In the Station Statistics pane (the lowest pane on the screen), double-click the Broadcasts Sent column header.

    5. Or, right-click in the Broadcasts Sent column and then click Sort Column.

Notes

  • XOX
  • XOX
  • If the Graph pane indicates a high percentage of network use and if network operations are unusually slow, an abrupt increase in broadcasts may be the source of the problem.
  • The row containing the highest number of broadcasts that were sent appears at the top of the list. The network address in this row represents the highest broadcaster on your network.


Use a capture filter

  • Design a capture filter
  • Load a capture filter
  • Specify frame data patterns to capture
  • Specify capture filter protocols
  • Save a capture filter
  • Filter data by address


Design a capture filter

Microsoft Windows graphic

To design a capture filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter.
  4. In the Capture Filter dialog box, do the following:
    • Specify capture filter protocols.
    • Specify address pairs in a capture filter.
    • Specify frame data patterns to capture.

Notes

  • XOX
  • XOX
  • Specify capture criteria to identify the frames that you want to capture on the network.
  • Build a complete capture filter expression by specifying the protocols, address pairs, and data patterns of the frames that you want to include or exclude from the capture.


Load a capture filter

Microsoft Windows graphic

To load a capture filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter and then click Load.
  4. Select the capture file you want and then click Open.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The decision tree that appears reflects the contents of the filter file that you have loaded. Network Monitor applies this filter when the data capture begins.


Specify frame data patterns to capture

Microsoft Windows graphic

To specify frame data patterns to capture

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter.
  4. In the capture filter decision tree, double-click the AND (Pattern Matches) line.
  5. Complete the Pattern Match dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • You can define up to four data patterns in a capture filter.
  • To capture frames that match any of multiple patterns, create a logical branch by selecting one of the patterns in the decision tree and clicking OR.
  • To exclude frames that match a pattern, select the pattern in the decision tree and then click NOT.
  • If you specify more than one pattern in the capture filter decision tree, by default, Network Monitor treats each as a logical OR branch.


Specify capture filter protocols

Microsoft Windows graphic

To specify capture filter protocols

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter.
  4. Double-click the SAP/ETYPE= line.
  5. Enable and disable protocols in the Capture Filter SAPs and ETYPES dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • All the protocols that you specified in your filter appear on the SAP/ETYPE= line in the capture filter decision tree.


Save a capture filter

Microsoft Windows graphic

To save a capture filter

  1. Open Network Monitor.
  2. On the Capture menu, click Filter.
  3. When you finish editing the filter, click Save.
  4. In the File name text box, type a name for the filter.
  5. Click Save.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • Use a .cf file name extension for a capture filter or use a .df file name extension for a display filter.


Filter data by address

  • Specify address pairs in a capture filter
  • Create an address database
  • Edit an address in an address database
  • Save the address database to a file
  • Load an address file


Specify address pairs in a capture filter

Microsoft Windows graphic

To specify address pairs in a capture filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter.
  4. Double-click the AND (Address Pairs) line in the decision tree.

    Or, double-click the address pair you want to edit.

  5. In the Address Expression dialog box, specify address pair properties, and then click OK.

Notes

  • XOX
  • XOX
  • You can define up to three address pairs in a capture filter.
  • In a capture filter, EXCLUDE statements take logical precedence over INCLUDE statements. Regardless of the sequence in which statements appear in the Capture Filter dialog box, Network Monitor evaluates EXCLUDE statements first. Therefore, in a filter containing both an EXCLUDE and an INCLUDE statement, if a frame meets the criteria specified in an EXCLUDE statement, Network Monitor discards the frame. Network Monitor does not test that frame against the INCLUDE statement to see if the frame also meets the criteria of the INCLUDE statement.
  • When you close the capture filter, Network Monitor optimizes the logic you used in the (Pattern Matches) branch of the capture filter decision tree. Therefore, when you re-open the capture filter, it might look different from the way it did when you created it. For example, if you define multiple pattern match statements, Network Monitor automatically processes them with an implicit OR operator and removes any explicit OR operators between such statements.


Create an address database

Microsoft Windows graphic

To create an address database

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Start.
  4. On the Capture menu, click Stop and View.
  5. On the Display menu, click Find All Names.
  6. In the Find All Names dialog box, click OK.

Notes

  • XOX
  • XOX
  • After the frames are processed, a message appears telling you how many unique addresses were added to the database. To display a list of the addresses in the database you just created, on the Display menu, click Addresses.


Edit an address in an address database

Microsoft Windows graphic

To edit an address in an address database

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Addresses.
  4. Click the address that you want to edit.
  5. Click Edit.
  6. Edit the address in the Address Information dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • When you include the edited address in a capture or display filter, your changes are reflected in the filter.


Save the address database to a file

Microsoft Windows graphic

To save the address database to a file

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Addresses.
  4. In the Address Database dialog box, click Save.
  5. Specify the file name and location.
  6. Click Save.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The next time that you design a capture or display filter that includes address pairs, you can use this database. If you assign the database the Default.adr file name, it becomes your default address database.


Load an address file

Microsoft Windows graphic

To load an address file

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Addresses.
  4. Click Load.
  5. If a message box that asks you whether you want to cancel your changes and load another address database appears, click Yes.
  6. Specify the file name of the address file (.adr) that you want to load.
  7. Click Open.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • If you load an address database while another address database is open, you will lose unsaved changes made to the open database.


Display network data

  • Open an existing capture file
  • Change the Frame Viewer window label
  • Display network adapter vendor names
  • Display address names
  • Add a comment frame to a capture
  • Specify the protocol header to display
  • Select a protocol color scheme
  • Display frames
  • Use a display filter


Open an existing capture file

Microsoft Windows graphic

To open an existing capture file

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the File menu, click Open.
  4. Select the capture file that you want to open, and then click Open.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • You can open several capture files at one time; Network Monitor opens a separate Frame Viewer window for each capture file.
  • Network Monitor can also open capture files created by some other programs. Some of the other file formats Network Monitor can read are:
    • Ethernet (files with an .ENC extension)
    • Token Ring (files with a .TRC extension)
    • FDDI (files with an .FDC extension)


Change the Frame Viewer window label

Microsoft Windows graphic

To change the Frame Viewer window label

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Window menu, click Label.
  5. In the Label Window dialog box, type the text that you want to appear in the window title bar, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Display network adapter vendor names in Network Monitor

Microsoft Windows graphic

To display network adapter vendor names

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Options menu, click Show Vendor Names.

Notes

  • XOX
  • XOX
  • When Show Vendor Names is active, Network Monitor replaces computer addresses with a twelve-byte code. The first six bytes of the code display the name of the vendor that produced the network adapter on the remote computer. The last six bytes are a host ID.


Display address names in Network Monitor

Microsoft Windows graphic

To display address names

  1. Open Network Monitor.
  2. On the Options menu, click Show Address Names.

Notes

  • XOX
  • XOX
  • When Show Address Names is active, a check mark appears next to the command name.
  • User-assigned address names are displayed.


Add a comment frame to a capture

Microsoft Windows Graphic

To add a comment frame to a capture

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Tools menu, click Insert Comment Frame.
  5. Complete the settings in the Insert Comment Frame dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The comment frame contains the Trail protocol, which includes statistics such as the amount of frames and bandwidth consumed. These statistics are based on a block of frames bounded by the current comment frame and the next comment frame of the same type (or the end of the capture).


Specify the protocol header to display

Microsoft Windows graphic

To specify the protocol header to display

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Display Captured Data when you are done capturing frames.
  4. On the Display menu, click Options.
  5. In the Display Options dialog box, click Auto, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Select a protocol color scheme

Microsoft Windows graphic

To select a protocol color scheme

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Colors.
  5. In the Protocol Colors dialog box, click the protocol names and the color combination you want, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • If you want to specify more than one color combination, repeat this procedure for each protocol color scheme that you want.


Display frames

  • View a specific frame
  • Search for a frame by its properties
  • Expand and collapse frame details
  • Specify the frame time stamp
  • Set the frame data display font


View a specific frame

Microsoft Windows graphic

To view a specific frame

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Go To Frame.
  5. In the Go To dialog box, type the number of the frame that you want to view, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The frame number is listed in the Frame column.
  • Frames are numbered in the order that Network Monitor captures them.


Search for a frame by its properties

Microsoft Windows graphic

To search for a frame by its properties

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Find Next Frame.
  5. In the Find Frame Expression dialog box, do one of the following:

    • To search for a frame on the basis of its source or destination address, open and complete the Address tab.
    • To search for a frame on the basis of the protocols that were used to send it, open and complete the Protocol tab.
    • To search for a frame on the basis of protocol properties, open and complete the Property tab.

  6. To begin searching for the expression displayed near the top of the dialog box, click OK.
  7. To find the next frame that has the specified properties, on the Display menu, click Repeat Find Next Frame.
  8. To find the previous frame that has the specified properties, on the Display menu, click Repeat Find Previous Frame.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • If the property is found, the frame automatically expands to display the property that you specified in your search.
  • The search remains active until you close the active window or begin a new search.


Expand and collapse frame details

Microsoft Windows graphic

To expand and collapse frame details

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. Double-click the frame you want to view.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • To expand or collapse a list of frame data, in the Detail pane, double-click the line you want to expand or collapse.
  • By default, frame data displayed in the Frame Viewer window Detail pane are collapsed.
  • All other lines using the expanded protocol automatically expand as they appear.


Specify the frame time stamp

Microsoft Windows graphic

To specify the frame time stamp

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Options.
  5. In the Display Options dialog box, specify one of the available time options, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The time setting appears under Time in the Frame Viewer window Summary pane.
  • The Seconds From Previous Frame option provides very useful data for troubleshooting performance issues, because it helps you pinpoint gaps in time that can occur in a network transaction.


Set the frame data display font

Microsoft Windows graphic

To set the frame data display font

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Font.
  5. Specify the font settings in the Font dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Use a display filter

  • Design a display filter
  • Load a display filter
  • Modify the display filter decision tree structure
  • Specify address pairs in a display filter
  • Specify display filter protocol properties
  • Specify display filter protocols
  • Save a display filter


Design a display filter

Microsoft Windows graphic

To design a display filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. In the Edit Display Filter dialog box, do the following:
    • Specify display filter protocols.
    • Specify display filter protocol properties.
    • Specify address pairs in a display filter.
  6. If needed, you can modify the display filter decision tree structure.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • A Network Monitor display filter functions like a database query. You can use it to specify the types of captured data you want to examine. You also can use display filters to specify the types of displayed data, such as protocols and computer addresses, that you want to save to a file.
  • You can add only one expression at a time. If you specify an expression and then click another tab in the Expression dialog box, that expression is lost. To save the specified expression and add it to the decision tree, you must click OK.


Load a display filter

Microsoft Windows graphic

To load a display filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. Click Load.
  6. Specify the display filter file (.df), and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • The new display filter decision tree appears in the Edit Display Filter dialog box.
  • If you load a display filter, you will overwrite any unsaved changes to the current display filter.


Modify the display filter decision tree structure

Microsoft Windows graphic

To modify the display filter decision tree structure

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. To add a logical operator to the decision tree in the Edit Display Filter dialog box, click the line below the row where you want to add the operator. Then:
    • To find frames that satisfy all expressions in the branch, click AND.
    • To find frames that satisfy one or more of the expressions in the branch, click OR.
    • To exclude frames that satisfy the expressions in the branch, click NOT.
  6. To change a logical operator, click it and then click Change Operator until the operator you want appears.
  7. To modify an expression, click it and then click Edit Expression.
  8. To add an expression to a branch, click the line beneath the row where you want to insert the new expression. Then, in the Add group, click Expression. You can:
    • Specify display filter protocols.
    • Specify display filter protocol properties.
    • Specify address pairs in a display filter.
  9. To delete a single expression or logical operator, click the line, and then click Line in the Delete group.
  10. To delete a branch, click the top branch that you want to delete, click Branch in the Delete group, and click Yes to confirm that you want to delete the branch and all the branches underneath it.
  11. To clear the decision tree and start over, click All in the Delete group. Click Yes to confirm that you want to start over and clear the decision tree contents.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • When you add an operator, a new decision tree branch appears.


Specify address pairs in a display filter

Microsoft Windows graphic

To specify address pairs in a display filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. In the Add group box, click Expression.
  6. Click the Address tab, specify the address pair, and click OK.
  7. To make the address pair one of many display criteria, click it and then click OR.
  8. To exclude the address pair from the display, click it and then click NOT.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Specify display filter protocol properties

Microsoft Windows graphic

To specify display filter protocol properties

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. In the display filter decision tree, click one row below where you want to add the expression.
  6. In the Add group box, click Expression.
  7. Click the Property tab, specify the protocol property that you want to add to the display filter, and click OK.
  8. To make the protocol property one of many display criteria, click it and then click OR.
  9. To exclude the protocol property from the display, click it and then click NOT.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Specify display filter protocols

Microsoft Windows graphic

To specify display filter protocols

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Filter.
  5. In the Add group box, click Expression.
  6. Click the Protocol tab, specify which protocols in the display filter you want to enable and disable, and click OK.
  7. To make the protocol one of many display criteria, click it and then click OR.
  8. To exclude the protocol from the display, click it and then click NOT.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Save a display filter

Microsoft Windows graphic

To save a display filter

  1. Open Network Monitor.
  2. On the Display menu, click Filter.
  3. When you finish editing the filter, click Save.
  4. In the File name text box, type a name for the filter.
  5. Click Save.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • Use a .cf file name extension for a capture filter or use a .df file name extension for a display filter.


Print network data

  • Print captured frames
  • Print all data in a capture file
  • Set the print filter


Print captured frames

Microsoft Windows graphic

To print captured frames

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the File menu, click Print.
  5. In the Print dialog box, specify the print options, and then click Print.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.
  • When you print frames, columns that do not fit on the page horizontally are truncated. To avoid losing important information, resize the columns before printing so they display only essential information. On the Layout tab, select Landscape. If you resize a column to its smallest possible size, it does not print at all.


Print all data in a capture file

Microsoft Windows graphic

To print all data in a capture file

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Display Captured Data when you are done capturing frames.
  4. On the File menu, click Print.
  5. In the Print dialog box, click All as the print range.
  6. Click the Netmon tab.
  7. Clear the Apply Display Filter check box, and then click Print.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Set the print filter

Microsoft Windows graphic

To set the print filter

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the File menu, click Print.
  5. In the Print dialog box, click the Netmon tab.
  6. Select the Apply Display Filter check box.
  7. Click Edit Filter.
  8. In the Edit Display Filter dialog box, edit the filter, and then click OK.
  9. To print the filtered frames, click Print.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. See Related Topics for more information about setting permissions on files and folders.


Concepts

This section covers:

  • Network Monitor overview
  • Understanding Network Monitor
  • Using Network Monitor
  • Resources


Network Monitor overview

By using Network Monitor, you can gather information that helps you keep your network running smoothly, from identifying patterns to preventing or solving problems. Network Monitor provides information about the network traffic that flows to and from the network adapter of the computer on which it is installed. By capturing and analyzing that information, you can prevent, diagnose, and solve many types of network problems. For more information about troubleshooting networks, see Resources.

You can configure Network Monitor to provide specific types of information that are most relevant to you. For example, you can set up triggers so that Network Monitor starts or stops capturing information when a circumstance or set of circumstances arises. You can also set up filters to control what types of information Network Monitor captures or displays. To make analyzing the information easier, you can modify how information appears on the screen, and you can save or print the information for review at a later time. For more information about customizing Network Monitor, see Capturing data and Filtering data.

The Network Monitor component that ships with Microsoft® Windows® Server 2003 family operating systems can capture frames that are sent to or from the computer on which Network Monitor is installed. If you want to capture frames that are sent to or from a remote computer, you must use the Network Monitor component that ships with Microsoft Systems Management Server, which can capture frames sent to or from any computer on which the Network Monitor driver is installed. For more information on Systems Management Server, go to the Microsoft Web site (http://www.microsoft.com/smsmgmt).

The information that Network Monitor provides comes from the network traffic itself, which is divided into frames. These frames contain information such as the address of the computer that sent the frame, the address of the computer to which the frame was sent, and the protocols that exist within the frame. For more information about frames, see How Network Monitor works.


Understanding Network Monitor

This section covers:
  • How Network Monitor works
  • Capturing data
  • Displaying data


How Network Monitor works

Data sent over a network is divided into frames. Each frame contains the following information:

  • Source address The address of the network adapter from which the frame originated.
  • Destination address The address of the network adapter that is meant to receive the frame. This address can also specify a group of network adapters.
  • Header information Information specific to each protocol used to send the frame.
  • Data The information (or a portion of it) being sent.

Every computer on a network segment receives frames transmitted on that segment. The network adapter in each computer retains and processes only those frames that are addressed to that adapter. The rest of the frames are dropped and no longer processed. The network adapter also retains broadcast (and potentially multicast) frames.

After installing Network Monitor, users can capture to a file all the frames sent to, or retained by, the network adapter of the computer on which it is installed. These captured frames can then be viewed or saved for later analysis. Users can design a capture filter so that only certain frames are captured. This filter can be configured to capture frames based on criteria such as source address, destination address, or protocol. Network Monitor also makes it possible for a user to design a capture trigger to initiate a specified action when Network Monitor detects a particular set of conditions on the network. This action can include starting a capture, ending a capture, or starting a program.

By default, the size of the capture buffer is 1 MB. You can reduce the amount of data you capture by shrinking the capture buffer.


Capturing data

This section covers:

  • The capture process
  • Capture filters
  • Capture triggers


The capture process

The process by which Network Monitor copies frames is referred to as capturing. You can capture all network traffic to and from the local network adapter, or you can set a capture filter and capture a subset of frames. You can also specify a set of conditions that trigger an event. If you create triggers, Network Monitor can respond to events on your network. For example, you can make the operating system start an executable file when Network Monitor detects a particular set of conditions on the network. After you have captured data, you can view it. Network Monitor translates the raw capture data into its logical frame structure.

While Network Monitor captures frames from the network, statistics about the frames appear in the Capture window, which has four panes:

Pane | Displays
Graph | A graphical representation of frames sent to or from the local computer.
Session Statistics | Statistics about current individual sessions.
Station Statistics | Statistics about frames sent to or from the computer running Network Monitor.
Total Statistics | Summary statistics about frames sent to or from the local computer since the capture process began.

Network Monitor uses the Network Driver Interface Specification (NDIS) facility to copy all frames it detects to its capture buffer.

For detailed instructions on capturing network data, see Capture network frames.


Capture filters

A capture filter functions like a database query that you can use to specify the types of network information you want to monitor. For example, to see only a specific subset of computers or protocols, you can create an address database, use the database to add addresses to your filter, and then save the filter to a file. By filtering frames, you save both buffer resources and time. Later, if necessary, you can load the capture filter file and use the filter again.

Designing a capture filter

To design a capture filter, specify decision statements in the Capture Filter dialog box. This dialog box displays the filter's decision tree, which is a graphical representation of a filter's logic. When you include or exclude information from your capture specifications, the decision tree reflects these specifications.

Filtering by protocol

To capture frames sent using a specific protocol, specify the protocol on the SAP/ETYPE= line of the capture filter. For example, to capture only IP frames, disable all protocols and then enable IP ETYPE 0x800 and IP SAP 0x6. By default, all of the protocols that Network Monitor supports are enabled. You can only specify protocols with ETYPE or SAP.

Filtering by address

To capture frames sent from a specific computer on your network to your computer or sent from your computer to a specific computer on your network, specify one or more address pairs in a capture filter. You can monitor up to four address pairs simultaneously.

An address pair consists of:

  • The addresses of the two computers you want to monitor traffic between.
  • Arrows that specify the traffic direction you want to monitor.
  • The INCLUDE or EXCLUDE keyword, indicating how Network Monitor should respond to a frame that meets a filter's specifications.

Regardless of the sequence in which statements appear in the Capture Filter dialog box, EXCLUDE statements are evaluated first. Therefore, if a frame meets the criteria specified in an EXCLUDE statement in a filter containing both an EXCLUDE and INCLUDE statement, that frame is discarded. Network Monitor does not test that frame by INCLUDE statements to see if it meets that criterion also.

For example, to capture all the traffic from Joe's computer except the traffic from Joe to Anne, use the following capture filter address section:

Addresses

include Joe <----> Any

exclude Joe <----> Anne

If there are no INCLUDE lines, YourComputer <----> Any is used implicitly.

Filtering by data pattern

By specifying a pattern match in a capture filter, you can:

  • Limit a capture to only those frames containing a specific pattern of ASCII or hexadecimal data.
  • Specify how many bytes (offsets) of the frame must be ignored before the search begins.

When you filter based on a pattern match, you must specify where, in the frame, the search for the pattern should begin. This setting specifies, in bytes, the distance from the beginning of the frame or the end of the topology header to the point at which the pattern might occur. If your network medium has a variable size in the media access control protocol, such as Ethernet or token ring, specify to count from the end of the topology header.


Capture triggers

If you create capture triggers, Network Monitor can respond to events on your network. By default, no trigger is set.

Types of triggers

Network Monitor can detect how full your capture buffer is, and whether a specific pattern appears in a captured frame. You can create capture triggers that depend on either or both of these criteria.

If you specify a trigger that depends on a specific pattern appearing in a captured frame, Network Monitor performs the action you specify when it detects a frame that contains the pattern you specify. The pattern can be an ASCII string or a hexadecimal string. You can also specify a trigger which depends on a specific pattern appearing in a captured frame and a certain percentage of the capture buffer being filled. You can also specify whether Network Monitor should start its search at the beginning of each frame, after the end of the header of each frame, or some number of bytes after either of these locations. By default, Network Monitor searches the entire frame for the pattern.

Trigger actions

You can choose one of the following actions to occur when the trigger criteria are met:

  • The computer beeps.
  • Network Monitor stops capturing frames.
  • A command that you specify runs.

    To specify a command that starts a program, type the path and the name of the program file, or click Browse and navigate to the program file. To use an MS-DOS command, such as copy, type CMD /K, and then type the command.


Displaying data

This section covers:

  • The Frame Viewer window
  • Filtering data
  • Protocol parsers included with Network Monitor


The Frame Viewer window

Network Monitor simplifies data analysis by interpreting raw data collected during the capture and displaying it in the Frame Viewer window.

The Frame Viewer window includes the following panes:

Pane | Displays
Summary | General information about the captured frames in the order that they were captured in.
Detail | The contents of the frame, including the protocols that were used to send it.
Hexadecimal | Hexadecimal and ASCII representations of the captured data.


Filtering data

Like a capture filter, a display filter helps you to isolate specific types of information. Unlike a capture filter, however, a display filter operates on data that has already been captured. You can use a display filter to configure how much captured data appears in the Frame Viewer window, or you can use it to save data to a capture file.

Use display filters to determine which frame to display. You can filter a frame by:

  • Its source or destination address.
  • The protocols it contains.
  • The properties and values that it contains. The properties of a protocol collectively indicate the purpose of the protocol.

The structure of the display-filter decision tree is flexible. You can define a simple, rather flat structure, or you can make it complex, as your needs dictate.

Protocols Used

When you display captured data, all available information about the captured frames appears in the Frame Viewer window. You can display only the frames which contain a specific protocol by editing the Protocol == line in the Edit Display Filter dialog box.

Network Monitor processes the filter you have designed and applies it to the contents of the Frame Viewer window.

Protocol Properties

You can use a display filter to isolate frames that contain specific protocol properties. Protocol properties consist of the elements of information that define the purpose of a protocol. Because the purposes of protocols vary, properties differ from one protocol to another.

As an example, you might capture a large number of frames with SMB protocol but want to examine only those frames in which the SMB protocol was used to create a directory on a remote computer. In this situation, you could isolate frames that include the Make Directory SMB command property.

Network Monitor identifies the protocols used to send a frame on the network by using a protocol parser. Each protocol that Network Monitor supports has a corresponding parser.

Computer Addresses

When you display captured data, by default all addresses that you capture information from appear in the Frame Viewer window. You can display only those frames that originate or are sent to a specific computer by editing the ANY <--> ANY line in the Edit Display Filter dialog box.

Filtering and address databases

Often, you need to capture only those frames that originate with or are sent to specific computers. To do this, you must know the addresses of the computers on your network.

You can use the ping command to find the IP address of a computer if you know its computer name. For more information, see Testing connections by using ping.


Protocol parsers included with Network Monitor

Each protocol that Network Monitor supports has a corresponding parser. The following is a list of the protocols whose parsers are included with Network Monitor.

Protocol | Description
AARP | AppleTalk Address Resolution Protocol (Atalk.dll)
ADSP | AppleTalk Data Stream Protocol (Atalk.dll)
AFP | AppleTalk File Protocol (Atalk.dll)
AH | IP Authentication Header (Tcpip.dll)
ARP_RARP | Internet Address Resolution Protocol/Reverse Address Resolution Protocol (Tcpip.dll)
ASP | AppleTalk Session Protocol (Atalk.dll)
ATMARP | ATM Address Resolution Protocol (Atmarp.dll)
ATP | AppleTalk Transaction Protocol (Atalk.dll)
BONE | Bloodhound-Oriented Network Entity Protocol (Bone.dll)
BOOKMARK | Network Monitor BOOKMARK Protocol (Trail.dll)
BPDU | Bridge Protocol Data Unit (Llc.dll)
BROWSER | Microsoft Browser (Browser.dll)
CBCP | Callback Control Protocol (Ppp.dll)
CCP | Compression Control Protocol (Ppp.dll)
COMMENT | Network Monitor COMMENT Protocol (Trail.dll)
DDP | AppleTalk Datagram Delivery Protocol (Atalk.dll)
DHCP | Dynamic Host Configuration Protocol (Tcpip.dll)
DNS | Domain Name System (Tcpip.dll)
EAP | PPP Extensible Authentication Protocol (Ppp.dll)
ESP | IP Encapsulating Security Payload (Tcpip.dll)
ETHERNET | Ethernet 802.3 topology (Mac.dll)
FDDI | FDDI topology (Mac.dll)
FINGER | Internet Finger protocol (Tcpip.dll)
FRAME | Base frame properties (Frame.dll)
FTP | File Transfer Protocol (Tcpip.dll)
GENERIC | Network Monitor GENERIC Protocol (Trail.dll)
GRE | Generic Routing Encapsulation Protocol (Ppp.dll)
ICMP | Internet Control Message Protocol (Tcpip.dll)
IGMP | Internet Group Management Protocol (Tcpip.dll)
IP | Internet Protocol (Tcpip.dll)
IPCP | Internet Protocol Control Protocol (Ppp.dll)
IPX | NetWare Internetwork Packet eXchange protocol (Ipx.dll)
IPXCP | NetWare Internetwork Packet eXchange Control Protocol (Ppp.dll)
IPXWAN | NetWare Internetwork Packet eXchange Protocol for Wide Area Networks (Ppp.dll)
ISAKMP | Internet Security Association and Key Management Protocol (Ppp.dll)
L2TP | Level 2 Tunneling Protocol (L2tp.dll)
LAP | AppleTalk Link Access Protocol (Atalk.dll)
LCP | Link Control Protocol (Ppp.dll)
LLC | Logical Link Control 802.2 Protocol (LLC.dll)
LPR | BSD Printer (Ppp.dll)
MESSAGE | Network Monitor MESSAGE Protocol (Trail.dll)
MSRPC | Microsoft Remote Procedure Call Protocol (Msrpc.dll)
NBFCP | NetBIOS Frames Control Protocol (Ppp.dll)
NBIPX | NetBIOS on IPX (Ipx.dll)
NBP | AppleTalk Name Binding Protocol (Atalk.dll)
NBT | Internet NetBIOS Over TCP/IP (Tcpip.dll)
NCP | NetWare Core Protocol (Ncp.dll)
NDR | NetWare Diagnostic Redirector (Ipx.dll)
NETBIOS | Network Basic Input/Output System Protocol (Netbios.dll)
NETLOGON | Microsoft Netlogon Broadcasts (Netlogon.dll)
NFS | Network File System (Tcpip.dll)
NMPI | Microsoft Name Management Protocol on IPX (Ipx.dll)
NSP | NetWare Serialization Protocol (Ipx.dll)
NWDP | NetWare WatchDog Protocol (Ipx.dll)
ODBC | Network Monitor ODBC Protocol (Trail.dll)
OSPF | Open Shortest Path First (Tcpip.dll)
PAP | AppleTalk Printer Access Protocol (Atalk.dll)
PPP | Point-to-Point Protocol (Ppp.dll)
PPPCHAP | PPP Challenge Handshake Authentication Protocol (Ppp.dll)
PPPML | Point-to-Point Multilink Protocol (Ppp.dll)
PPPPAP | PPP Password Authentication Protocol (Ppp.dll)
PPTP | Point-to-Point Tunneling Protocol (Ppp.dll)
R_LOGON | Generated RPC for interface logon (Logon.dll)
R_LSARPC | Generated RPC for Interface Lsarpc (Lsarpc.dll)
R_WINSPOOL | Generated RPC for Interface Winspool (Winspl.dll)
RADIUS | Remote Authentication Dial-In User Service Protocol (Ppp.dll)
RIP | Internet Routing Information Protocol (Tcpip.dll)
RIPX | NetWare Routing Information Protocol (Ipx.dll)
RPC | Remote Procedure Call (Tcpip.dll)
RPL | Remote Program Load (Llc.dll)
RSVP | Resource Reservation Protocol (Rsvp.dll)
RTMP | AppleTalk Routing Table Maintenance Protocol (Atalk.dll)
SAP | NetWare Service Advertising Protocol (Ipx.dll)
SMB | Server Message Block Protocol (Smb.dll)
SMT | FDDI MAC Station Management (Mac.dll)
SNAP | Sub-Network Access Protocol (Llc.dll)
SNMP | Simple Network Management Protocol (Snmp.dll)
SPX | NetWare Sequenced Packet eXchange Protocol (Ipx.dll)
SSP | Security Support Provider Protocol (Msrpc.dll)
STATS | Network Monitor Capture Statistics Protocol (Trail.dll)
TCP | Transmission Control Protocol (Tcpip.dll)
TMAC | Token Ring MAC layer (Mac.dll)
TOKENRING | Token Ring 802.5 Topology (Mac.dll)
TPCTL | Test Protocol Control Language (Tpctl.dll)
TRAIL | Network Monitor TRAIL Protocol (Trail.dll)
UDP | User Datagram Protocol (Tcpip.dll)
VINES_FRAG | Banyan Vines Fragmentation Protocol (Vines.dll)
VINES_IP | Banyan Vines Internet Protocol (Vines.dll)
VINES_TL | Banyan Vines Transport Layer Protocols (Vines.dll)
XNS | Xerox Network System (Xns.dll)
ZIP | AppleTalk Zone Information Protocol (Atalk.dll)

Note

  • XOX


Using Network Monitor

This section covers:

  • Managing Network Monitor from the command line
  • Capture window
  • Frame Viewer window


Managing Network Monitor from the command line

By using the start netmon command, you can start the Network Monitor user interface from the command line. You can also specify parameters for capturing and filtering frames from network traffic going to and coming from the computer on which you have Network Monitor installed.

Syntax

start netmon [/net Number] [/capturefilter Path] [/displayfilter Path] [/buffersize Number] [/quickfilter {ATM | ETHERNET | IP | IPX | VINES | TOKENRING | FDDI}, Address] [/quickfiltername FilterName] [/autostart] [/autostop]

Parameters

/net Number
Specifies the number of the network from which you want to capture frames. You can specify any of the network segments to which your computer is connected.
/capturefilter Path
Specifies a capture filter to be used when Network Monitor starts. You can abbreviate /capturefilter as /cf.
/displayfilter Path
Specifies a display filter to be used when Network Monitor starts. You can abbreviate /displayfilter as /df.
/buffersize:Number
Specifies the size (in megabytes) of the capture buffer.
/quickfilter {ATM | ETHERNET | IP | IPX | VINES | TOKENRING | FDDI}, Address
Specifies that Network Monitor should capture frames only of a particular type and from a particular address. You can specify up to three types at a time. You can abbreviate /quickfilter as /qf. XOX
/quickfiltername FilterName
Specifies the name of the filter that you describe with the /quickfilter command. This parameter is ignored if you do not specify any /quickfilter options. You can abbreviate /quickfiltername as /qfn.
/autostart
Specifies that Network Monitor should begin to capture data at interface startup.
/autostop
Specifies that Network Monitor should stop capturing data when the capture buffer is full.
/?
Displays help at the command prompt.

Remarks

  • Network Monitor is not installed by default. To use this command, you must have installed Network Monitor on your computer, and you must run the command from the directory where Network Monitor is installed.

Examples

To set the size of your capture buffer to 4 megabytes, type:

start netmon /buffersize:4

To load a specific capture filter when you start Network Monitor, type:

start netmon /capturefilter d:\captures\http.cf

XOX


Capture window

This section covers:

  • Panes
  • Dialog boxes


Panes

This section covers:

  • Capture window: Graph pane
  • Capture window: Session Statistics pane
  • Capture window: Station Statistics pane
  • Capture window: Total Statistics pane


Capture window: Graph pane

The Graph pane graphically represents the total capture statistics of the current capture data. This pane appears in the upper-left corner of the Capture window, and it is on by default.

% Network Utilization
The percentage of your network adapter's capacity that the current capture uses. This percentage is calculated by dividing the rate at which your adapter is sending and receiving frames by the maximum rate at which your adapter can process those frames.
Frames Per Second
The number of frames that the adapter is capturing every second.
Bytes Per Second
The number of bytes that the adapter is capturing every second.
Broadcasts Per Second
The number of broadcasts that the adapter is capturing every second.
Multicasts Per Second
The number of multicasts that the adapter is capturing every second.

Other panes in this window: Session Statistics pane, Station Statistics pane, Total Statistics pane


Capture window: Session Statistics pane

A session designates the data that is sent to or from the local computer. The Session Statistics pane displays statistics on a per-session basis. The pane also identifies both participants in a session and displays how much information passed in either direction between them.

This pane appears in the left-center portion of the Capture window, and it is on by default.

Network Address 1
The network address of the first participant in a network session.
1 --> 2
The number of frames sent from the address listed in the Network Address 1 column to the address listed in the Network Address 2 column.
1 <-- 2
The number of frames sent from the address listed in the Network Address 2 column to the address listed in the Network Address 1 column.
Network Address 2
The network address of the second participant in a network session.

Note

  • Network Monitor reflects session statistics of only the first 100 unique addresses that it detects. To gather statistics on a specific workstation, design a capture filter. To reset statistics and view information about the next 100 detected network sessions, click the Capture menu, and then click Clear Statistics.

Other panes in this window: Graph pane, Station Statistics pane, Total Statistics pane


Capture window: Station Statistics pane

The Station Statistics pane displays statistics that describe the network activity of your workstation. This pane appears at the bottom of the Capture window, and it is on by default.

Network Address
The network address of the computer on which the frames were captured.
Frames Sent
The number of frames sent from the address listed in the Network Address column.
Frames Rcvd
The number of frames received by the address listed in the Network Address column.
Bytes Sent
The number of bytes sent by the address listed in the Network Address column.
Bytes Rcvd
The number of bytes received by the address listed in the Network Address column.
Directed Frames Sent
The number of non-broadcast, non-multicast frames transferred over the network from the associated address.
Multicasts Sent
The number of times the address listed in the Network Address column has sent frames to a subset of computers on the network, by sending "FFFFFFFFFFFF."
Broadcasts Sent
The number of times that the address listed in the Network Address column has sent frames to all computers on the network.

Note

  • Network Monitor reflects station statistics of only the first 128 unique addresses that it detects. To gather statistics on a specific workstation, design a capture filter.

Other panes in this window: Graph pane, Session Statistics pane, Total Statistics pane


Capture window: Total Statistics pane

The Total Statistics pane provides an overall view of network traffic sent to or from the local computer. This pane appears in the upper-right corner of the Capture window, and it is on by default.

Network Statistics
The total amount of traffic that has been sent to or from the local computer since the current capture began. These statistics include:
  • The total number of frames sent to or from the local computer.
  • The total number of broadcasts sent to or from the local computer.
  • The total number of multicasts sent to or from the local computer.
  • The total number of bytes sent to or from the local computer.
  • The total number of frames dropped.
  • The network status. On an Ethernet network, this entry will always be Normal. On a token ring network, this entry reflects whether the token is present locally.
Captured Statistics
Total statistics that describe the current capture, including:
  • The total number of captured frames.
  • The total number of frames in the temporary capture file.
  • The number of frames dropped when the buffer was exceeded.
  • The total number of captured bytes.
  • The total number of bytes in the temporary capture file.
  • The percentage of allotted buffer space that is in use.
  • The number of frames dropped by Network Monitor.
Per Second Statistics
Statistical averages of current activity and continual updates of this average to reflect current per-second activity. The statistics in this panel include all frames (even frames that were excluded by a capture filter). Per-second statistics include:
  • The average number of frames per second detected since the capture began.
  • The average number of bytes per second detected since the capture began.
  • The average number of broadcast messages per second detected since the capture began.
  • The average number of multicast messages per second detected since the capture began.
  • The percentage of network utilization. This statistic shows the percentage of your network adapter's capacity that the current capture uses. This percentage is calculated by dividing the rate at which your adapter is sending and receiving frames by the maximum rate at which your adapter can process those frames.
Network Card (MAC) Statistics
Statistics that reflect average activity detected by your network adapter since the current capture began. The statistics in this pane reflect all the network activity that your network adapter can receive. These statistics include:
  • Total frames detected by the network adapter.
  • Total broadcast frames detected by the network adapter.
  • Total multicast frames detected by the network adapter.
  • Total bytes detected by the network adapter.
Network Card (MAC) Error Statistics
Statistics that reflect adapter-related errors that have occurred since the capture began. These statistics include:
  • Number of errors that occurred because the cyclical redundancy check (CRC) did not match the actual bytes received.
  • Number of frames that the network adapter detected but that were dropped because Network Monitor lacked sufficient buffer space.
  • Number of frames that the network adapter detected but that were dropped because of hardware constraints.

Note

  • Not all network adapters support these statistics. If your network adapter does not support a statistic, the value is replaced with Unsupported.

Other panes in this window: Graph pane, Session Statistics pane, Station Statistics pane


Dialog boxes

This section covers:

  • Address Database dialog box
  • Address Expression dialog box
  • Address Information dialog box
  • Capture Buffer Settings dialog box
  • Capture Filter dialog box
  • Capture Filter SAPs and ETYPEs dialog box
  • Capture Trigger dialog box
  • Dedicated Mode dialog box
  • Open File dialog box
  • Pattern Match dialog box
  • Print dialog box: Netmon tab
  • Protocol Parsers dialog box
  • Select a Network dialog box


Address Database dialog box

Use this dialog box to add, delete, or edit address database information. You can also use this dialog box to save the current address database or load a different one.

Name
The user-defined name of the computer.
Address
The 4-byte (IPv4) or 16-byte (IPv6) address of the network adapter.
Type
The network adapter address type (MAC or IP, for example).
Comment
Comments or additional address information.
Vendor
Name of the vendor that created the network adapter.
Add
Click to open the Address Information dialog box, which you can use to add a new computer address to the address database.
Edit
Click to open the Address Information dialog box, which you can use to change the currently selected computer address.
Delete
Click to remove the currently selected computer address from the address database.
Load
Click to open the Open Address file dialog box, which you can use to load a different address database instead of the one currently displayed.
Save
Click to open the Save Addresses as dialog box, which you can use to save the currently displayed address database to a file. Unless you save any changes that you made, you lose them when you load a new address database or close Network Monitor.


Address Expression dialog box

Use this dialog box to create a new address expression that is added to the Address Pairs section of the current capture filter.

Include
Includes capture data that travels between the members of the current address pair. By default, this option is selected.
Exclude
Excludes capture data that travels between the members of the address pair.
Station 1
The list of first addresses in the address pair. Depending on the arrow that you select in Direction, Station 1 can be the originating or the destination address.
Direction
Specify an arrow that indicates the direction of the traffic between the two addresses.
<-->
Click to specify frames that travel in either direction between the computers that you specified in Station 1 and Station 2. By default, this arrow is selected.
-->
Click to specify frames that travel from Station 1 to Station 2.
<--
Click to specify frames that travel from Station 2 to Station 1.
Station 2
The list of second addresses in the address pair. Depending on the arrow that you select in Direction, Station 2 can be the originating or the destination address.
Edit Addresses
Click to open the Address Database dialog box, which you can use to modify the current address database.

Note

  • When you specify Direction, you cannot construct a statement in which the source address is either Broadcast or Multicast because Broadcast and Multicast are always destination addresses.


Address Information dialog box

Use this dialog box to edit individual address entries or add a new entry.

Name
The friendly name (computer name, for example) for the Address.
Permanent Name
Uses the text in the Name text box as the friendly name of the computer in the local address database (.adr). By default, this check box is cleared.
Address
The address that identifies the computer to the network.
Type
The address type that associates with Address. By default, the detected address type appears in this list.

For example, suppose that the network associates a name with an Ethernet address and you want to associate the name with an IP address. You select IP and then type the IP address in the Address text box. Associating a name with a new address type removes its association with the previous address type.

Comment
Any additional information that you want to include in the address description. For example, you might enter the type of CPU or network adapter or mention some problem the computer has exhibited.


Capture Buffer Settings dialog box

Use this dialog box to adjust the size of the data frame and the total amount of frames you want to capture.

Buffer Size (MB)
The size of your capture buffer. By default, the buffer size is set to 1.0 MB.
Frame Size (bytes)
The number of bytes that you want Network Monitor to capture from each frame. By default, the frame size is Full (65,535).

The drop-down list contains numbers in increments of 64, up to 65,472. You can select one of these numbers, or you can type a specific number between 32 and 65,535, inclusive.


Capture Filter dialog box

This dialog box displays the capture filter decision tree and helps you to specify the frames that you want to capture. You can also load filters that were previously designed and saved to a file. By doing this, you avoid creating filters every time you want to capture filtered data.

You can use the following controls to make changes to the decision tree.

SAP/ETYPE =
Double-click this line to specify protocols that you want to capture in frames.
AND (Address Pairs)
Double-click this line to filter on computer address pairs.

You can specify as many as three address pairs.

AND (Pattern Matches)
Double-click this line to capture only frames that contain a specified pattern at a specified offset.

You can specify as many as four pattern matches.

Add
Use the buttons in this group box to add criteria to the capture filter.
Address
Click to open the Address Expression dialog box, which you can use to specify the address pairs of the computers between which you want to capture data.
Pattern
Click to open the Pattern Match dialog box, which you can use to capture only those frames containing a specific pattern of ASCII or hexadecimal data.
Insert
Use the buttons in this group box to add operators to the capture filter.
OR
Click to add an OR branch to the capture filter decision tree. This option is available only for pattern matches.
NOT
Click to add a NOT branch to the decision tree or to remove a branch of the tree. This option is available only for pattern matches.
Edit
Click to edit the line that is currently selected in the capture filter.
Delete
Click to delete the line that is currently selected in the capture filter.
Load
Click to open the Load Capture Filter dialog box, which you can use to replace the current capture filter with one that has been saved to a file.
Save
Click to open the Save Capture Filter dialog box, which you can use to save the current capture filter as a file.

Notes

  • In the address portion of a capture filter, EXCLUDE statements take logical precedence over INCLUDE statements. Regardless of the sequence in which statements appear in the Capture Filter dialog box, Network Monitor evaluates EXCLUDE statements first. Therefore, in a filter containing both an EXCLUDE and an INCLUDE statement, if a frame meets the criteria specified in an EXCLUDE statement, Network Monitor discards the frame without testing it against the INCLUDE statement to see whether the frame also meets the criteria of the INCLUDE statement.
  • When you close the capture filter, Network Monitor optimizes the logic you used in the Pattern Matches branch of the capture filter decision tree. Therefore, when you re-open the capture filter, it might look different from when you created it. For example, if you define multiple pattern match statements, Network Monitor automatically processes them with an implicit OR operator and removes any explicit OR operators between such statements.


Capture Filter SAPs and ETYPEs dialog box

Use this dialog box to specify the protocols that Network Monitor captures while your capture filter runs. The choices that you make in this dialog box are reflected in the line that begins with SAP/ETYPE= in the decision tree in the Capture Filter dialog box. Only protocols that use an SAP or an ETYPE can be filtered in the capture filter.

Enabled Protocols
The protocols that Network Monitor uses to capture frames from the network. By default, all protocols are enabled.

Double-click any protocol in this box to move it to the Disabled Protocols table.

Protocol
The names of all currently enabled protocols.
Comment
A brief description of each enabled protocol.
Type
The enabled protocol ETYPE or SAP.
Values
Possible values of enabled protocols.
Disable
Click to move the protocols that you select in the Enabled Protocols table to the Disabled Protocols table.
Disable All
Click to disable all available protocols.
Enable
Click to move protocols that you selected in the Disabled Protocols table to the Enabled Protocols table.
Enable All
Click to enable all available protocols.
Disabled Protocols
The currently disabled protocols, which will not be used to capture network data.
Protocol
The names of all currently disabled protocols.
Comment
A brief description of each disabled protocol.
Type
The disabled protocol type (ETYPE or SAP).
Values
Possible values of disabled protocols.


Capture Trigger dialog box

Use this dialog box to specify the event that acts as a trigger and the action that results from the event.

Trigger On
Specify the conditions that induce the trigger action. By default, no trigger is set.
Nothing
Turns off trigger actions during data capture.
Pattern match
Engages the trigger when a specified hexadecimal or ASCII pattern match occurs.
Buffer space
Engages the trigger when a capture fills a specific percentage of the capture buffer.
Pattern match then buffer space
Requires Network Monitor to monitor the buffer space after the specific matched pattern occurs and to perform the trigger action when both specified conditions exist.
Buffer space then pattern match
Requires Network Monitor to detect when a capture has filled a specified percentage of the capture buffer and then to perform the trigger action when both conditions exist.
Buffer Space
The percentage of capture buffer that is filled before the trigger action occurs. For example, if you want to trigger action to occur when the capture buffer is three-quarters full, select 75%. The only accepted values are multiples of 25%.
Pattern
The pattern you select for the pattern match.
Offset (Hex)
The number of hexadecimal bytes from the beginning of the frame to where Network Monitor begins looking for a pattern match. By default, the pattern triggers if the pattern occurs anywhere in the frame.

The pattern offset can be measured from the beginning of the frame or from the end of the topology header.

From Start of Frame
Starts the search for the pattern at the beginning of the frame.
From End of Topology Header
Starts the pattern search beyond the topology header.
Pattern
The pattern that you select to engage the trigger.
Hex
A hexadecimal pattern.
ASCII
An ASCII pattern.
Trigger Action
Specify the action that you want to occur when the trigger criteria (pattern match, buffer space, or both) are met.
Audible Signal Only
The computer beeps when the trigger condition is met and the capture process continues without interruption. By default, this option is selected.
Stop Capture
The capture process stops when the trigger condition is met.
Execute Command Line
Runs a command or opens a file when the trigger specifications are met. You can use as many as 259 characters for the command line. Click Browse to specify a file you want to run.

Note

  • If you click the Pattern match then buffer space option and set Buffer Space to 100%, Network Monitor will overwrite the frame that has the pattern match because it does not start counting the buffer space until after the pattern match is found.


Dedicated Mode dialog box

This dialog box appears when you click Dedicated Capture Mode on the Capture menu and start capturing data.

Total Frames Captured
The number of frames that Network Monitor captures.
Stop
Click to stop the capture and return to Network Monitor.
Stop and View
Click to stop the capture and to view the frames in the Network Monitor Frame Viewer window.
Pause (Continue)
Click to stop (or resume) capturing frames temporarily.
Normal Mode
Click to turn off Dedicated Capture Mode and return to the Network Monitor Capture window.

Frame capture continues until you explicitly stop the capture process.


Open File dialog box

Use this dialog box to:

  • Open and view a capture file (.cap) in the Frame Viewer window.
  • Load a capture filter (.cf) in the Capture Filter dialog box.
  • Load a display filter (.df) in the Edit Display Filter dialog box.
  • Load an address file (.adr) in the Address Database dialog box.
  • Specify an executable or command file in the Capture Trigger dialog box to run when capture trigger specifications are met.
Look in
The drive and directory that contains the file you want to open, load, or specify.
File name
The name of the file you want to open, load, or specify.
Files of type
The type of files that you want to see in the list of files.


Pattern Match dialog box

Use this dialog box to specify that you want to capture only those frames that contain a specific pattern of hexadecimal or ASCII data. You can specify that the pattern can start at the beginning of the frame or that it must be a specified number of bytes (offset) away from the beginning of the frame or the end of the topology header. Specify the offset by using the following controls.

Pattern
The hexadecimal or ASCII data pattern that you want captured frames to match.
Hex
The specified pattern is read in hexadecimal format. By default, this option is selected.
ASCII
The specified pattern is read in ASCII format.
Offset (in hex)
The hexadecimal number that specifies where the search should begin. The way Network Monitor interprets this number depends upon whether you click the From Start Of Frame or the From End Of Topology Header option.
From Start of Frame
The offset you specify is measured from the beginning of the frame. By default, this option is selected.
From End of Topology Header
The offset you specify is measured from the end of the topology header.


Print dialog box: Netmon tab

Use this tab to specify printing options specific to your Network Monitor capture file.

Output Detail
Specify the amount of detailed information that you want to print for each frame.
Print Frame Summary Lines
Prints information that appears in the Frame Viewer window Summary pane. By default, this check box is selected.
Print Protocol Details
Prints information that appears in the Frame Viewer window Details pane. By default, this check box is selected.
Indent Levels
Indents each successive protocol level when frames are printed. By default, this check box is selected.
Indent Spaces per Level
The number of spaces that you want to indent each level of detail. By default, this value is set to 0.
Print Same as View
The printed document reflects exactly the structure of the Frame Viewer window.
Expand All Levels
The printed document contains an expanded view of all of the protocols listed in the Frame Viewer window Detail pane. By default, this option is selected.
Print Hex Data
Prints the data that appears in the Hexadecimal pane of the Frame Viewer window. By default, this check box is selected.
Lines of Hex Data to Print
The number of lines of hexadecimal data that you want to print. By default, this value is set to "All."

If you want to print all the data in a frame, set this option to "All." (This is useful if you are printing only a few frames.)

Filtering
Specify whether to print only those frames that match the display filter, which is described in Filtering data.
Apply Display Filter
Applies a display filter to the data that you want to print. By default, this check box is cleared.
Edit Filter
Click to open the Edit Display Filter dialog box, which you can use to edit the display filter before applying it to the data that you want to print.
Add Page Breaks
Adds page breaks to the printed material. By default, this check box is cleared.

Note

  • On the General tab, the following options are specific to Network Monitor:
    • Print Range
    Specify which frames that you want to print.

    Network Monitor preserves the original frame numbers. Saving the filtered frames to a capture (.cap) file causes the original frame numbering to be lost; in a capture file, frame numbers always begin with 1.

    All
    All displayed frames. By default, this option is selected.
    Frame
    A portion of the displayed frames. Specify the range of frames that you want to print in the From and To boxes.


Protocol Parsers dialog box

Use this dialog box to enable or disable the parsers that read and interpret data sent to or from your computer with various protocols. When you disable a parser, Network Monitor does not attach the properties of the disabled parser to the captured data in the associated protocol. Any protocol that follows the disabled protocol in the frame will not be parsed.

Enabled Protocol Parsers
The names and descriptions of all currently enabled parsers. By default, all Network Monitor protocols are enabled.
Name
The names of enabled protocols.
Description
The descriptions of enabled protocols.
Disable
Click to move the protocol selected in the Enabled Protocol Parsers list to the Disabled Protocol Parsers list.
Disable All
Click to move all protocols to the Disabled Protocol Parsers list.
Enable
Click to move the protocol selected in the Disabled Protocol Parsers list to the Enabled Protocol Parsers list.
Enable All
Click to move all protocols to the Enabled Protocol Parsers list.
Disabled Protocol Parsers
All of the parsers that are loaded into the \Parsers subdirectory but that are not enabled. As long as a parser appears in this list, Network Monitor cannot interpret frames using the associated protocol.
Name
The names of disabled protocols.
Description
The descriptions of disabled protocols.
Save as Default
Saves the parsers that appear in the Enabled Protocol Parsers list as your default configuration.

By default, this check box is cleared (Network Monitor enables all parsers in the \Parsers subdirectory).


Select a Network dialog box

This dialog box displays information about the current network configuration. Use this dialog box to:

  • Find information about your local configuration.
  • Use a different network adapter on the local computer to capture network data.

Local Computer

A tree control that displays information about one or more network adapters on the local computer. Select the network adapter for which you want to display information.

Properties

This control describes the following information about the network adapter you selected:

  • whether the network configuration supports delayed capture.
  • whether the network configuration supports Expert Stats (ESP interface).
  • whether the network configuration supports real time capture.
  • whether the network configuration supports network statistics.
  • the type of network connection (for example, a dial-up connection).
  • the manufacturer name and model information for the network adapter.
  • the MAC address of your network adapter. This is the address assigned by the manufacturer of the adapter.
  • the current address of your network adapter. Unless the permanent address of the adapter has been overridden, this listing is identical to the MAC address.
  • the Link speed, in bits per second (bps). This is the rate at which you can transfer bits over the network. This information is supplied by the manufacturer of the network adapter.
  • the type of network (for example, Ethernet) to which the network adapter can connect. This information is supplied by the manufacturer of the network adapter.
  • the maximum number of bytes per frame that the selected network adapter can handle. This information is supplied by the manufacturer of the network adapter.
  • whether the network adapter supports promiscuous mode.


Frame Viewer window

This section covers:

  • Panes
  • Dialog boxes


Panes

This section covers:

  • Frame Viewer window: Summary pane
  • Frame Viewer window: Detail pane
  • Frame Viewer window: Hexadecimal pane


Frame Viewer window: Summary pane

The Frame Viewer window, Summary pane, displays a list of the frames in the order in which they were captured.

Frame
The frame number, which is listed in the order that the frame was captured. Frame numbers begin with 1.
Time
The time that the frame was captured. The way that the capture time is expressed depends on the display options that you specify. The time is expressed as one of the following:
  • The absolute system time that the frame was captured.
  • The time that the frame was captured relative to the beginning of the capture. This value is expressed in microseconds.
  • The time that the frame was captured relative to the capture completion time of the frame that precedes it. This value is specified in microseconds.
Src MAC Addr
The network address of the computer that sent the frame.
Dst MAC Addr
The network address of the computer that the frame was sent to.
Protocol
The primary protocol that was used to send the frame.
Description
A brief description of the contents of the frame.
Src Other Addr
The IP or IPX/XNS address associated with the address displayed in the Src MAC Addr column.
Dst Other Addr
The IP or IPX/XNS address associated with the address displayed in the Dst MAC Addr column.
Type Other Addr
The types of the addresses displayed in the Src Other Addr and Dst Other Addr columns.

Note

  • XOX

Other panes in this window: Detail pane, Hexadecimal pane


Frame Viewer window: Detail pane

The Frame Viewer window Detail pane displays information about the frame that is currently selected in the Summary pane. This information includes details about the selected frame and about the protocols that were used to send it.

You can expand or collapse the levels of detail that appear in this pane by double-clicking the lines that appear next to plus (+) or minus (-) signs.

Frame
The base properties of the selected frame. These properties include:
  • The date and time that the frame was captured.
  • The time (measured in milliseconds) that elapsed between the capture of the current frame and the capture of the frame that precedes it.
  • The frame number in the sequence of total frames captured.
  • The length of the frame (in bytes).
  • The amount of the frame (in bytes) that was captured.
  • The number of bytes in the frame not parsed by the base parser.
Protocol
The protocol section of the Detail pane consists of all information that appears below the end of the Frame section. The length of the section varies, depending on the number of protocols used to send the frame. Network Monitor displays the protocols from the lowest-level protocol to the highest-level protocol.

When you click a line in this pane, Network Monitor selects the raw representation of this line (which appears in the Hexadecimal pane) automatically.

Other panes in this window: Summary pane, Hexadecimal pane


Frame Viewer window: Hexadecimal pane

The Frame Viewer window Hexadecimal pane consists of two sections.

  • The hexadecimal section displays the contents of the frame in hexadecimal form.
  • The ASCII section displays an alphabetical representation of the ASCII contents of the frame.

When you select a line in the Detail pane, the section of the frame that the line represents is selected automatically in both sections of the Hexadecimal pane.

Other panes in this window: Summary pane, Detail pane


Dialog boxes

This section covers:

  • Display Options dialog box
  • Expression dialog box
  • Expression dialog box: Address tab
  • Expression dialog box: Protocol tab
  • Expression dialog box: Property tab
  • Font dialog box
  • Go To dialog box
  • Insert Comment Frame dialog box
  • Label Window dialog box
  • No Networks Found dialog box
  • Protocol Colors dialog box
  • Save dialog box
  • Edit Display Filter dialog box


Display Options dialog box

Use this dialog box to specify the time data and the protocols that you want to appear in the Summary pane of the Frame Viewer window.

Time
Specify how you want the time to display in the Time column of the Summary pane.
Time of day
Display the system time at which the frame was captured (for example, 10:35:48.358).
Seconds from beginning of capture
Display the time (in microseconds) that elapsed between the beginning of the capture and the capture of the frame.

By default, this option is selected.

Seconds from previous frame
Display the time (in microseconds) that elapsed between the capture of a frame and the capture of the frame that precedes it.
Summary Protocol
Specify the protocol summary information that appears in the Protocol column of the Summary pane.
Last protocol in frame
Display information about the final protocol that appears in the captured frame. By default, this option is selected.
Auto (Based on protocols in display filter)
Display the protocol information that Network Monitor selects for you. The selection is based on the current display filter settings.


Expression dialog box

Use this dialog box to:

  • Write or edit an expression in a display filter decision tree. For more information about display filters, see Filtering data.
  • Search for a frame in the Frame Viewer window with criteria that you provide.

The main categories that you can specify options for are represented by tabs.

  • Expression dialog box: Address tab
  • Expression dialog box: Protocol tab
  • Expression dialog box: Property tab

Note

  • Only one expression string at a time can be added to a display filter or be used as a search criterion.


Expression dialog box: Address tab

Use this tab to specify the address you want to find or to add or edit an address expression in a display filter decision tree. The Station 1 and Station 2 boxes display all of the addresses contained in the currently loaded address database. For each address, the friendly name, address, type of address (protocol), and associated comments are included.

Expression
The address expression that you want to locate or to add to a display filter decision tree. The display changes as you select items in other areas of the dialog box. When you click OK, the displayed expression is added to the display filter decision tree or used as the search criteria for frames. Any other changes you make are lost.

The Expression text box appears regardless of which tab you select. You cannot edit the expression directly.

Station 1 (and Station 2)
The computer addresses between which you want to monitor traffic or that you want to locate. If you do not specify the local computer as either Station 1 or Station 2, no data will appear when you apply the filter.
Direction
An arrow that indicates the traffic direction that you want to monitor or locate. For example, to identify traffic that travels from Computer 1 to Computer 2, select the Computer 1 name, the --> symbol, and then the Computer 2 name.
Edit Addresses
Click to open the Address Database dialog box, which you can use to edit the selected address.

Other tabs in this dialog box: Protocol, Property

Note

  • You should specify BROADCAST, MULTICAST, and FUNCTIONAL only as destination addresses. If you construct a statement in which the source address is either broadcast or multicast, you filter out all frames. Broadcast and multicast are always destination addresses.


Expression dialog box: Protocol tab

Use this tab to specify the protocols that you want to find in the Frame Viewer window or to specify protocols in the display filter decision tree.

By default, all protocols are enabled, and the Expression box shows Protocol == Any. The protocols listed in this tab are those whose parsers are currently available to Network Monitor.

Expression
The address expression to search for in frames or to add to a display filter decision tree. As you select items in other areas of the dialog box, the display changes. When you click OK, the displayed expression is added to the display filter decision tree or is used as the frame search criterion. Any other changes you make are lost.

The Expression box appears regardless of which tab you select. You cannot edit the expression directly.

Enabled Protocols
The protocols to include in the display filter or to use to search for a frame.
Disabled Protocols
The protocols excluded from the display filter, which will not be used to search for a frame. If there are protocols in the frame in addition to the disabled protocols, then the frame will still be found. For example, if you disable the SMB protocol, SMB frames will be found if they contain enabled protocols.
Disable
Click to move selected protocols to the Disabled Protocols box.
Enable
Click to move the selected protocols to the Enabled Protocols box.
Disable All
Click to move all protocols to the Disabled Protocols box.
Enable All
Click to move all protocols to the Enabled Protocols box.

Other tabs in this dialog box: Address, Property

Note

  • To exclude all frames that contain the SMB protocol, create a line that states Protocol == SMB and put a "Not" in front of it.


Expression dialog box: Property tab

Use this tab to specify which protocol properties you want to find or to add or edit a protocol property expression in the display filter decision tree.

Expression
The address expression that you want to locate or to add to a display filter decision tree. As you select items in other areas of the dialog box, the display changes. When you click OK, the displayed expression is added to the display filter decision tree or is used as the frame search criterion. Any other changes that you make are lost.

The Expression box appears regardless of which tab you have selected. You cannot edit the expression directly.

Protocol:Property
The names and properties of protocols available to Network Monitor. If a plus (+) sign appears next to a protocol name, you double-click the sign to expand the protocol and select a property.
Relation
A relational operator used to specify the connection between the protocol property and its possible values. The relational value can be one of the following:
==
Equal to
<>
Not equal to
>
Greater than
<
Less than
>=
Greater than or equal to
<=
Less than or equal to
contains
Contains (value)
exists
Exists (value)
Value
The possible values that the highlighted property is compared to.

When the Hex and the Decimal or Ascii options are visible, you can specify whether the number in the Value box is displayed in hexadecimal, decimal, or ASCII form.

Other tabs in this dialog box: Address, Protocol


Font dialog box

Use this dialog box to change the fonts used to display or print captured frame data.

Font
The fonts you can use to display or print captured frame data. You might prefer a monospace font such as Courier or Fixedsys rather than a proportional font such as MS Sans Serif. Depending on your printer configuration, some fonts might not be available for printing. By default, the font is Courier New.
Font Style
The font style, such as bold or italic, that you use to display or print captured frame data. By default, the font style is Regular.
Size
The type size that gives you the best combination of readability and quantity of data per screen. By default, the type size is 8 points. (Other ways to fit data onto the screen include maximizing the window and rearranging columns.)


Go To dialog box

Use this dialog box to open a specific frame in the currently displayed capture file.

Frame Number
The number of the frame that you want to highlight.

Note

  • The second field in the Frame Viewer window status bar lists the number of the frame that is currently highlighted, followed by a slash mark (/) and the total number of frames in the current capture file.


Insert Comment Frame dialog box

Use this dialog box to add a frame that contains comments and other information into a capture file. The comment frame contains the Trail protocol, which includes statistics such as the number of frames and bandwidth consumed. These statistics are calculated for a block of frames bounded by the current comment frame and the next comment frame of the same type (or by the end of the capture).

Frame Number
The frame position in the capture where Network Monitor inserts the comment frame. By default, the frame number is the current location. Network Monitor places the inserted frame in front of the frame number specified and increases the other frame numbers by one.

The maximum frame number ranges from one more than the number of the final frame in the capture.

Type of Frame to Insert
The parser that processes the comment frame after the Trail protocol runs.

If you modify the %netmon%\Parsers\Trail.ini file and map a parser to an integer, you can type that number in this field.

No Statistics
Disables the generating of statistics for the comment frame. When No Statistics is selected, Network Monitor does not use the comment frame to define a block of any other inserted comment frames for statistics. By default, this check box is selected.
Apply Current Filter to Statistics
Uses the current display filter to calculate statistics. By default, this check box is selected.

If you clear this check box, the output shows data for all frames in the capture, including those that have been filtered from the display.

Enter in a comment for this new frame
The text that you attach to the frame by using the protocol specified in Type of Frame to Insert.


Label Window dialog box

Use this dialog box to change the text that appears in the Frame Viewer window title bar.

Description
The new window label.


No Networks Found dialog box

This dialog box appears when Network Monitor cannot find installed network drivers on the local computer or if the Network Monitor driver is not installed.

Do not notify me of this in the future
Hides this message box the next time you open Network Monitor. Select this check box if you plan to work only with existing Network Monitor capture files. By default, this check box is cleared.

If you receive this message, install the Network Monitor Driver.


Protocol Colors dialog box

Use this dialog box to specify colors that appear in the panes in the Frame Viewer window. You can use the colors to highlight frames, properties, and hexadecimal data pertaining to that protocol.

X
Selected protocols apply the current color selection. Click anywhere in the protocol line to select or clear it.
Name
The names of currently supported protocols.
Description
A description of each supported protocol
.
Colors
Specifies the colors of the selected protocols.
Foreground
The color to apply to the protocol text.
Background
The color to apply to the text background.
Select All
Click to select all listed protocols.
Clear All
Click to clear all listed protocols.

This button does not reset the background and foreground colors.

Save as Default
Automatically uses the specified color combination every time you display data in the Frame Viewer window. By default, this check box is cleared.


Save dialog box

Use this dialog box to:

  • Save captured data in a file (.cap) that you can view in Network Monitor at a later time.
  • Save a capture or display filter that you have designed or edited.
  • Save an address database to a file.
  • Save a text file to which you can print frame data.
Save in
The drive and directory that you want to save the file to.
File name
The name to save the file as.
Save as type
The file format of the information that you want to save. Network Monitor uses these default file types and file name extensions:
File type | File name extension
Capture files | .cap
Capture filters | .cf
Display filters | .df
Address files | .adr
Print files | .txt
Range
In the From and To boxes, specify the numerical range of the frames that you want to save in the capture file.

When you save a range of frames to a capture file, the numbers associated with the frames are changed. In a capture file, frame numbers always begin with 1, regardless of the number associated with the original frame. Similarly, if you apply a display filter and then save the filtered frames, the frame numbers in the capture file begin with 1. If, on the other hand, you select Print To File in the Print dialog box, the original frame numbers associated with the frames are preserved.

Filtered
Applies the current display filter to the capture data when the data is being saved. When you select this check box, the saved frames are renumbered so that no gaps appear in the sequence. By default, this check box is cleared.

Note

  • The From, To, and Filtered options are available only when you are saving a capture file from the Frame Viewer window.


Edit Display Filter dialog box

Use this dialog box to limit your display to frames that have the properties that you specify. For example, you can specify the protocols, computer addresses, and protocol properties that you want to display in the Frame Viewer window. The following controls help you to make changes to the display filter decision tree.

Protocol ==
The decision tree branch that lists the protocols that you want to display. By default, this branch is set to Protocol == Any. To modify the protocol list, double-click the branch to open the Expression dialog box: Protocol tab.
address <-> address
The decision tree branch that lists the computer address pairs that you want to display. By default, this branch is set to Any <-> Any. To modify the address pairs list, double-click the branch to open the Expression dialog box: Address tab. You must specify the local computer as the data source or destination.
Add
Decision tree criteria.
Expression
Click to open the Expression dialog box, which enables you to specify the computer address pairs, protocols, and protocol properties that you want to display.
Insert
Logical operators for the decision tree. You can use as many as 4,000 decision tree operators.
AND
Click to add an AND branch to the currently selected branch of the decision tree.
OR
Click to add an OR branch to the decision tree.
NOT
Click to add a NOT branch to the decision tree or to negate a branch of the tree.
Edit Expression (Change Operator)
If you select an expression in the decision tree, the label on the button in this group is Edit Expression. Click this button to open the Expression dialog box, which you can use to edit the selected data.

If you select a logical operator in the decision tree, the label on the button in this group is Change Operator. Click this button to cycle through the logical operators for the selected line.

Delete
Decision criteria that you want to delete from the tree.
Line
Click to delete the selected line in the decision tree.
Branch
Click to delete the currently selected branch in the decision tree.
All
Click to delete the entire decision tree.
Load
Click to open the Open dialog box, which you can use to replace the current display filter with a display filter that has previously been saved to a file.
Save
Click to open the Save Display Filter dialog box, which you can use to save the current display filter as a file (.df). To open this display filter again later, you can click the Load button to open the file.


Resources

For more information about Network Monitor, consult the following resources:

  • Windows Server 2003 Resource Kit at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)
  • Microsoft TechNet at the Microsoft Web site.(http://www.microsoft.com/)
  • Microsoft Product Support Services at the Microsoft Web site.(http://www.microsoft.com/)


Troubleshooting

What problem are you having?

Network Monitor will not start.

Cause: Authenticated Users has been manually removed from the Users group.

Solution: Add the Network Monitor user to the Users group following the steps described in To add a member to a local group. After the user has been added, they must log-off the computer, and then log back on.

Cause: The Discretionary Access Control List (DACL) of the system directory is changed to disallow normal user's access.

Solution: Add the Network Monitor user to the DACL of the system directory and assign permissions to allow normal user access by following the steps described in To assign, change, or remove permissions on Active Directory objects or attributes.

Not enough disk space to create a capture buffer.

Cause: When you set a capture buffer, Network Monitor reserves disk space equal to the size of the capture buffer. If not enough disk space is free, you will get an error.

Solution: Make sure that the temporary capture directory has enough free disk space (at least 1 MB free + buffer size).

Access denied to default capture directory on computers with lockdown policies in place.

Cause: Lockdown computers will not allow you to write to files in the \Windows folder and subfolders, but the default folder for Network Monitor capture files is a subfolder of the \Windows folder.

Solution: After you create a capture, save the capture into a folder to which you have read and write access. This folder becomes the new default location for saving capture files.

"No NPPs found" error message.

Cause: Network Monitor, the Network Monitor driver, or neither is installed properly.

Solution: Make sure that the Network Monitor components are installed properly.

  1. If the Network Monitor driver is not installed, install it using the steps described in To install the Network Monitor driver.
  2. If the Network Monitor driver is installed, delete it and then reinstall it.
  3. If reinstalling the Network Monitor driver does not solve the problem, remove Network Monitor and then reinstall it using the steps described in To install Network Monitor.