TestTitle

zhanguo

Tips for Getting Started

See Also

This section contains general tips for getting started using Network Monitor.



Installation

During installation, network connectivity can briefly be lost as the driver is installed.



System Resources

Network Monitor can use significant system resources. If memory utilization is a factor, consider using the command-line capture utility, NMCap. For more information, see Network Monitor Tools.



The following are significant items:



Disc space: When capturing, Network Monitor currently stores frames in a sequence of capture files named cap*.tmp in the Local Settings\Temp directory. By default it continues to store a series of these files of 20 MB each until the disc is within 2 percent of being full; then it stops capturing. To change the temporary file size and the disc space limit for capture files, on the Network Monitor Tools menu, click Options, then click Capture. The location for these files is not configurable.





Memory and processor utilization: Conversations are enabled by default. When conversations are enabled, Network Monitor assigns properties to frames and groups them into conversations by using these properties. A conversation is a group of frames that are related to each other at a specific protocol level. Network Monitor displays these conversations and their related frames as a tree in the Network Conversations window. The Network Conversations window can be closed, and conversations can be disabled. On the Tools menu, click Options, click Capture, and then clear the Enable Conversations check box. This reduces memory and processor utilization during capture. However, some higher-level protocol filters require conversation properties and do not work with conversation support turned off.







Windows Parsers

At installation, only a subset of the parsers are enabled. Most Windows parsers have been enabled as stubs only, which means that they do not parse completely.To load the full parsers, take the following steps:



On the Tools menu, click Options, and then click Parser.





Select the Windows row and click Stubs to change the Set column to Full.





Click Save and Reload Parsers and then click OK.







Filtering

The following tips can be useful to get started filtering effectively:



Type a period (.) in the Display Filter or Capture Filter window to get the top-level elements on which you can filter. The most useful are Protocol and Property.





Start with the protocol name, if you know it, or any other item at the top level (Protocol, Property, or Struct), or one level below that.





Right-click any field in the Frame Details window to learn how to filter on that field and find other frames like the one you are looking at.





Right-click any column in the Frame Summary window to add a filter that returns similar frames.





Use the Boolean AND, OR, and NOT operators to combine arguments in a filter.





To follow a single TCP stream, or other stream, right-click a frame, click Find Conversation, and then click TCP.







Configuring the Workspace

The Network Monitor workspace is configurable to meet your current needs. All windows can be resized.

See Also

Other Resources

Getting Started


Tips for Getting Started

See Also

This section contains general tips for getting started using Network Monitor.



Installation

During installation, network connectivity can briefly be lost as the driver is installed.



System Resources

Network Monitor can use significant system resources. If memory utilization is a factor, consider using the command-line capture utility, NMCap. For more information, see Network Monitor Tools.



The following are significant items:



Disc space: When capturing, Network Monitor currently stores frames in a sequence of capture files named cap*.tmp in the Local Settings\Temp directory. By default it continues to store a series of these files of 20 MB each until the disc is within 2 percent of being full; then it stops capturing. To change the temporary file size and the disc space limit for capture files, on the Network Monitor Tools menu, click Options, then click Capture. The location for these files is not configurable.





Memory and processor utilization: Conversations are enabled by default. When conversations are enabled, Network Monitor assigns properties to frames and groups them into conversations by using these properties. A conversation is a group of frames that are related to each other at a specific protocol level. Network Monitor displays these conversations and their related frames as a tree in the Network Conversations window. The Network Conversations window can be closed, and conversations can be disabled. On the Tools menu, click Options, click Capture, and then clear the Enable Conversations check box. This reduces memory and processor utilization during capture. However, some higher-level protocol filters require conversation properties and do not work with conversation support turned off.







Windows Parsers

At installation, only a subset of the parsers are enabled. Most Windows parsers have been enabled as stubs only, which means that they do not parse completely.To load the full parsers, take the following steps:



On the Tools menu, click Options, and then click Parser.





Select the Windows row and click Stubs to change the Set column to Full.





Click Save and Reload Parsers and then click OK.







Filtering

The following tips can be useful to get started filtering effectively:



Type a period (.) in the Display Filter or Capture Filter window to get the top-level elements on which you can filter. The most useful are Protocol and Property.





Start with the protocol name, if you know it, or any other item at the top level (Protocol, Property, or Struct), or one level below that.





Right-click any field in the Frame Details window to learn how to filter on that field and find other frames like the one you are looking at.





Right-click any column in the Frame Summary window to add a filter that returns similar frames.





Use the Boolean AND, OR, and NOT operators to combine arguments in a filter.





To follow a single TCP stream, or other stream, right-click a frame, click Find Conversation, and then click TCP.


Configuring the Workspace

The Network Monitor workspace is configurable to meet your current needs. All windows can be resized.
See Also

Other Resources

Getting Started

zhanguo