Network capture utilities come in all shapes and sizes, from lightweight no-install-needed tools to bulked-out analysis suites. Version 3.0 of Microsoft Network Monitor packs quite a bit into its 2.5 MB .MSI installer.
A network capture driver, analyzer and filtering/logging system, NetMon 3.0 is a complete inside-out rewrite of the 2.x version of the program. Its improvements and features include:
- Vista support. The 2.x version didn't support Vista at all. It made sense to update the program with a new network-capture driver that could take advantage of features available in Vista's NSID 6.0 driver.
- Sophisticated data-parsing rules that can be customized or edited by the user. They're written in the C-like Netmon Parser Language (NPL). Full documentation for the language is also included with the program.
- A powerful filtering system that can be used to filter data as it's being captured or filter data for display. Each captured frame can be displayed with a full description of its source and destination hosts, the protocol used to deliver it, a breakdown of the frame's protocol contents and a hex dump of the raw data. Filters can also be applied to each other's results.
- A command-line version of the program (nmcap.exe), which can be used to perform raw capturing without the overhead of the GUI. It can also be used to filter existing capture files and extract relevant data from them.
- The ability to reassemble captured frames. Many conversations have their data split across multiple frames, so this feature allows a complete payload to be reassembled from its component frames.
- "Conversations". Frames that relate to each other on the protocol level can be grouped together to make studying them easier.
Note: Network Monitor 3.0 can be installed side-by-side with the old version on the same system, but needless to say they should not both be run at the same time.
About the author: Serdar Yegulalp is editor of the Windows Insight, (formerly the Windows Power Users Newsletter), a blog site devoted to hints, tips, tricks and news for users and administrators of Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Vista. He has more than 12 years of Windows experience under his belt, and contributes regularly to SearchWinComputing.com and SearchSQLServer.com.
More information on this topic:
