NetMon V3.0 adds Windows Vista support, robust data filter

A network capture driver, analyzer and filtering/logging system, NetMon 3.0 is a complete inside-out rewrite of the 2.x version of the program. Its improvements include Vista support and a robust data filter.

Network capture utilities come in all shapes and sizes, from lightweight no-install-needed tools to bulked-out...

analysis suites. Version 3.0 of Microsoft Network Monitor packs quite a bit into its 2.5 MB .MSI installer.

A network capture driver, analyzer and filtering/logging system, NetMon 3.0 is a complete inside-out rewrite of the 2.x version of the program. Its improvements and features include:

  • Vista support. The 2.x version didn't support Vista at all. It made sense to update the program with a new network-capture driver that could take advantage of features available in Vista's NSID 6.0 driver.
  • Sophisticated data-parsing rules that can be customized or edited by the user. They're written in the C-like Netmon Parser Language (NPL). Full documentation for the language is also included with the program.
  • A powerful filtering system that can be used to filter data as it's being captured or filter data for display. Each captured frame can be displayed with a full description of its source and destination hosts, the protocol used to deliver it, a breakdown of the frame's protocol contents and a hex dump of the raw data. Filters can also be applied to each other's results.
  • A command-line version of the program (nmcap.exe), which can be used to perform raw capturing without the overhead of the GUI. It can also be used to filter existing capture files and extract relevant data from them.
  • The ability to reassemble captured frames. Many conversations have their data split across multiple frames, so this feature allows a complete payload to be reassembled from its component frames.
  • "Conversations". Frames that relate to each other on the protocol level can be grouped together to make studying them easier.

Note: Network Monitor 3.0 can be installed side-by-side with the old version on the same system, but needless to say they should not both be run at the same time.

About the author: Serdar Yegulalp is editor of the  Windows Insight, (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of Windows experience under his belt, and contributes regularly to and

More information on this topic:

This was first published in April 2007

Dig Deeper



Find more PRO+ content and other member only offers, here.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:









  • Virtual desktop security guide

    To secure virtual desktops, consider antivirus, certificates and network vulnerabilities. Just remember, VDI doesn't always ...

  • Guide to low-cost desktop virtualization

    In this guide, learn to virtualize desktops without spending more than you would when deploying PCs, and what VDI vendors are ...

  • VDI pilot project guide

    A VDI pilot project should start with a VDI project plan. Know what pitfalls to avoid and test product options to achieve a ...