Microsoft KB Archive/231920

= How to Filter on TCP Header Information Using Microsoft Network Monitor =

Article ID: 231920

Article Last Modified on 1/24/2007

-

APPLIES TO


 * Microsoft Windows NT Advanced Server 3.1
 * Microsoft Windows NT Server 3.5
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT 4.0 Service Pack 1
 * Microsoft Windows NT 4.0 Service Pack 2
 * Microsoft Windows NT 4.0 Service Pack 3
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT Workstation 3.1
 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows 3.11 Standard Edition
 * Microsoft Windows 95
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows 98 Second Edition

-



This article was previously published under Q231920



SUMMARY
This article describes how to apply filters in Microsoft Network Monitor to view Transmission Control Protocol (TCP) header information in the Capture Summary window.



MORE INFORMATION
When you view a capture using Network Monitor, the "Last Protocol In Frame" is displayed in the Capture Summary window by default. This is true even when you apply filters to view only TCP information. Therefore, a frame that contains Server Message Blocks (SMBs) shows SMB summary information. For example: SMB C write spool file, FID = 0xc005, Write 48 bytes To view the TCP header information, you need to open the frame.

In the following example, several protocols are actually a part of the entire frame: +FRAME: Base frame properties +ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol +IP: ID = 0x7DEC; Proto = TCP; Len: 132 +TCP: .AP..., len:  92, seq: 175699528-175699619, ack: 227842390, win:16500, src: 3221  dst:  139 (NBT Session) +NBT: SS: Session Message, Len: 88 +SMB: C write spool file, FID = 0xc005, Write 48 bytes When viewing a TCP trace, it is more convenient to have the TCP information displayed in the Capture Summary window. This lets you view the TCP header information without having to open the frame.

Use the following steps to view TCP header information in the Capture Summary window:
 * 1) On the Display menu in the Capture Summary window, click Filter (or press F8).
 * 2) In the Display Filter window, double-click Protocol==Any.
 * 3) Click Disable All.
 * 4) In the Disabled Protocols box, click TCP, click Enable, click OK, and then click OK.
 * 5) On the Display menu in the Capture Summary window, click Options.
 * 6) Click Auto (Based on protocols in display filter), and then click OK.

The following example shows the TCP information as viewed in the Capture Summary window after you perform these steps: TCP .AP..., len:  92, seq: 175699528-175699619, ack: 227842390, win:16500, src: 3221  dst:  139 (NBT Session)

Additional query words: sniff trace netmon bloodhound

Keywords: kbinfo kbnetwork KB231920

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.