Microsoft KB Archive/231947

= How to Modify Network Monitor Capture Buffer Settings =

Article ID: 231947

Article Last Modified on 1/24/2007

-

APPLIES TO


 * Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 4
 * Microsoft BackOffice Server 4.0
 * Microsoft BackOffice Server 4.5
 * Microsoft BackOffice Small Business Server 4.0
 * Microsoft BackOffice Small Business Server 4.0a
 * Microsoft BackOffice Small Business Server 4.5
 * Microsoft Cluster Server 1.1
 * Microsoft Windows 3.11 Standard Edition
 * Microsoft Windows 95
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows 98 Second Edition
 * Microsoft Windows NT Advanced Server 3.1
 * Microsoft Windows NT Server 3.5
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT 4.0 Service Pack 1
 * Microsoft Windows NT 4.0 Service Pack 2
 * Microsoft Windows NT 4.0 Service Pack 3
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT Server 4.0 Enterprise Edition
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT Workstation 3.1
 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition

-



This article was previously published under Q231947



SUMMARY
When you use Microsoft Network Monitor to capture network traffic, the capture buffer size must be large enough to save the desired traffic.



MORE INFORMATION
The capture buffer in Network Monitor is based on a first-in, first-out (FIFO) system, and its size is limited to 1 MB by default. Captured data is stored in RAM until you save the capture. If the data is larger than the allocated RAM, data is discarded using FIFO logic.

You can adjust the capture buffer size to as high as 120 MB. However, increasing the capture buffer to a size larger than the available memory can cause the tool to swap data to the hard disk, which may result in lost or dropped frames.

To increase the capture buffer size:
 * 1) Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
 * 2) On the Capture menu, click Buffer Settings.
 * 3) In the Buffer Size (in MB) box, type a value between 1-120, and then click OK.

Network Monitor allocates the necessary memory immediately. You can make the capture buffer larger than available memory, but the following warning message may be displayed:

The buffer size you have requested may cause frames to be dropped due to swapping. Are you sure you want to allocate a buffer of this size?

If you receive this warning message, you can decrease the capture buffer size to a value smaller than the available memory on your computer.

If you experience problems capturing data and have increased the buffer to the maximum limit, you can decrease the frame size to allow for more frames:
 * 1) Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
 * 2) On the Capture menu, click Buffer Settings.
 * 3) In the Frame Size (in bytes) box, click a value from the available frame sizes, and then click OK.

NOTE: If your troubleshooting methodology requires detailed information from each frame, you cannot use this option. An example of when this method is feasible is if you are looking only at Transmission Control Protocol (TCP) header information to analyze TCP traffic. The entire frame is not needed for just the header information.

Additional query words: netmon

Keywords: kberrmsg kbinfo kbnetwork KB231947

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.