Microsoft KB Archive/310875

= Description of the Network Monitor Capture Utility =

Article ID: 310875

Article Last Modified on 10/19/2001

-

APPLIES TO


 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional Edition

-



This article was previously published under Q310875





SUMMARY
This article describes how to use the Network Monitor Capture Utility (Netcap.exe) that you can use to capture network traffic in Network Monitor.



MORE INFORMATION
Netcap provides capture abilities only from a command prompt; to open the resulting capture (.cap) files, you must use the full Network Monitor interface.

Netcap is installed when you install the Support tools that are on the Windows XP CD-ROM.

For additional information about how to install these tools, click the article number below to view the article in the Microsoft Knowledge Base:

306794 How to Install the Support Tools from the Windows XP CD-ROM

Network Monitor is provided with Windows Server products and Microsoft Systems Management Server (SMS).

Netcap provides capture abilities that are similar to the version of Network Monitor that is included with the Windows Server products; however, you must use Netcap at a command prompt. Netcap installs the Network Monitor driver and binds it to all adapters when you first run the Netcap command.

The full syntax for Netcap is the following syntax:

 Usage: NetCap.exe [/B:#] [/T    ] [/F:] [/C: ] [/N:#] [/L:HH:MM:SS] [/TCF:]

Example: NetCap /B:20 /N:2 /T BP 100 0a ff1f /F:d:\IPFilter.CF

/B:# - Buffer, capture size to take, from 1MB to 1000MB default is 1Mb

/T  - Trigger, stop capturing when the given buffer and/or pattern is reached If no trigger is given, the capture will stop when the buffer is full Use &quot;/T N&quot; to continue capturing even if the buffer fills Oldest frames in capture will be over written once the buffer is full Note: With &quot;/T N&quot; you will have to hit space bar to stop capturing

     - 'B' = buffer, 'P' = Pattern, 'BP' = Buffer then Pattern, 'PB' = Pattern then Buffer 'N' = No Trigger

   - % Buffer Size '25', '50', '75', '100' used with B, BP, PB (NOT P)

 - Hex Offset from start of frame used with P, BP, PB (NOT B)

- Hex Pattern to match used with P, BP, PB (NOT B)                    The Pattern must be an even number of hex digits

/C: - Move temporary capture to full path and/or file name This can be any valid local or remote path If &quot;/C&quot; is not specified the capture file will remain in the default temporary capture folder

/F:<filterfile.cf>- A Network Monitor 2.x generated capture filter (*.cf)

/L:<HH:MM:SS>    - Capture for given amount of time (max 99:99:99) Note: This option overrides the default 100% trigger unless &quot;/T &quot; is also specified

/TCF:<Folder Name>- Permanently changes the temporary capture folder Warning the path must be on a fixed local hard drive Once set you only need to use the switch again to change the directory

/Remove          - Removes the NetCap instance of the Network Monitor driver

/N:<#>           - NIC Index number, for this computer

To determine the network interface card (NIC) index number, you can use the netcap /? command. Under the syntax information, you can view a list of the adapters that are installed on the computer. From this list, you can select the correct adapter for capture. For example, if you want to capture traffic for a dial-up connection on a computer with the following adapters, use NIC index 0:

<pre class="fixed_text"> Use the following index numbers for these adapters: (default) 0 = ETHERNET (2C3D20524153) WAN (PPP/SLIP) Interface 1 = ETHERNET (000039139635) Local Area Connection 2 2 = ETHERNET (0000390E118E) Local Area Connection

The following commands are sample Netcap commands: <ul> <li>To capture traffic on NIC 1 BY using a 10 megabyte (MB) buffer, use the following command:

netcap /n:1 /b:10

</li> <li>Netcap typically stops capturing when the buffer is full. To capture traffic with &quot;First In First Out&quot; (FIFO) buffering, which is the default for Network Monitor, you can use the following command:

netcap /t n

Note that if you want to stop the capture, press the SPACEBAR.</li> <li>To capture traffic for one hour by using a 1-MB FIFO buffer, use the following command:

netcap /L:01:00:00

</li> <li>To remove the Network Monitor driver, use the following command:

netcap /remove

</li></ul>

Capture files that you create by using Netcap are placed in the UserProfile\Local Settings\Temp folder, by default, where UserProfile is the name of the user profile. You can change the default folder by using either the /c or /tcf switches.

For additional information about how to capture network traffic or the concepts or terms that are used in this article, click the article number below to view the article in the Microsoft Knowledge Base:

148942 How to Capture Network Traffic with Network Monitor

Additional query words: netmon

Keywords: kbinfo KB310875

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.