Microsoft KB Archive/152643

= Network Monitor Does Not Capture Outbound Frames =

Article ID: 152643

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Systems Management Server 1.2 Standard Edition

-



This article was previously published under Q152643



Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SUMMARY
When capturing network traffic "to and from" the local computer, Network Monitor captures and displays only one-way traffic (traffic to the computer). Network Monitor running on systems with network interface cards (NICs) that use monolithic Ndis 4.0 drivers may exhibit this symptom.



MORE INFORMATION
LocalOnly is a new bit that Ndis4.0 supports. It gives Network Monitor the ability to acquire all the network traffic that is going to and from your computer without going into Promiscuous Mode, which is very expensive. Some cards, which are monolithic (non-miniport) or are miniport but implement their own loopback, indicate that they handle the LocalOnly bit, but actually they do not.



WORKAROUND
To work around this behavior, add the  registry subkey.

Warning Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.

Network Monitor 1.0
 Run Registry Editor. Locate and then click the following registry subkey:

 On Edit menu, click Add Key, and then add the following key:

Key Name: ForcePmode

Class:

 On the Edit menu, click Add Value, and then add the following:

Value Name: EPRO1

Data Type: REG_DWORD

Data: 1

The value should be the same as the name in the  key, under the Bind Value with the leading "\Device\" stripped off. There are multiple cards on the same line, space delimited. Click OK, and then quit Registry Editor. Shut down and then restart Windows NT.</li></ol>

Note This does NOT effect Network Monitor counters within Perfmon because pmode will be used.

Network Monitor 2.0
<ol> Run Registry Editor.</li> Locate and then click the following registry subkey:

</li> On Edit menu, click Add Key, and then add the following key:

Key Name: ForcePmode

Class:

</li> On the Edit menu, click Add Value, and then add the following:

Value Name: EPRO1

Data Type: REG_DWORD

Data: 1

The value should be the same as the name in the  key, under the Bind Value with the leading "\Device\" stripped off. There are multiple cards on the same line, space delimited.</li> Click OK, and then quit Registry Editor.</li> Shut down and then restart Windows 2000.</li></ol>

Additional query words: prodsms 1.10 prodnt 4.00 amd 1.20 WINDOWS kbnetwork

Keywords: kbnetworkmon KB152643

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.