NetMon V3.0 adds Windows Vista support, robust data filter

Serdar Yegulalp, Contributor

Network capture utilities come in all shapes and sizes, from lightweight no-install-needed tools to bulked-out analysis suites. Version 3.0 of Microsoft Network Monitor

    Requires Free Membership to View

    Login

packs quite a bit into its 2.5 MB .MSI installer.

A network capture driver, analyzer and filtering/logging system, NetMon 3.0 is a complete inside-out rewrite of the 2.x version of the program. Its improvements and features include:

  • Vista support. The 2.x version didn't support Vista at all. It made sense to update the program with a new network-capture driver that could take advantage of features available in Vista's NSID 6.0 driver.
  • Sophisticated data-parsing rules that can be customized or edited by the user. They're written in the C-like Netmon Parser Language (NPL). Full documentation for the language is also included with the program.
  • A powerful filtering system that can be used to filter data as it's being captured or filter data for display. Each captured frame can be displayed with a full description of its source and destination hosts, the protocol used to deliver it, a breakdown of the frame's protocol contents and a hex dump of the raw data. Filters can also be applied to each other's results.
  • A command-line version of the program (nmcap.exe), which can be used to perform raw capturing without the overhead of the GUI. It can also be used to filter existing capture files and extract relevant data from them.
  • The ability to reassemble captured frames. Many conversations have their data split across multiple frames, so this feature allows a complete payload to be reassembled from its component frames.
  • "Conversations". Frames that relate to each other on the protocol level can be grouped together to make studying them easier.

Note: Network Monitor 3.0 can be installed side-by-side with the old version on the same system, but needless to say they should not both be run at the same time.

About the author: Serdar Yegulalp is editor of the  Windows Insight, (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of Windows experience under his belt, and contributes regularly to SearchWinComputing.com and SearchSQLServer.com.

More information on this topic:

This was first published in April 2007

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top