Network Monitor

Network administrators use Network Monitor to view and detect problems on local area networks (LANs).

  • Before using Network Monitor, see Checklist: Monitoring your network.
  • To find features that have been moved in Windows 2000 Server, see New ways to do familiar tasks.
  • For tips about using Network Monitor, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Monitoring your network

Step | Reference
Review key concepts. Network Monitor overview;
Network Monitor components;
Best practices
Confirm that you are a member of the Administrators group. | Groups overview
Install Network Monitor tools. | To install Network Monitor
Create a capture filter. | Using capture filters
Create a display filter. | Using display filters
Interpret results. | Open Network Monitor. For information about interpreting the results of a network packet capture, click the Help menu in Network Monitor.


New ways to do familiar tasks

The following table compares familiar Windows NT 4.0 network monitoring tasks with the equivalent tasks in Windows 2000.
If you want to | In Windows NT 4.0 use | In Windows 2000 use
Install Network Monitor | Network in Control Panel. | Add/Remove Programs; go to Add/Remove Windows Components. For more information, see To install Network Monitor.
Install the Network Monitor driver | Network in Control Panel. | Network and Dial-up Connections; go to Local Area Connection Properties. For more information, see To install the Network Monitor driver.
Monitor network frames | Network Monitor in Administrative Tools. | Network Monitor in Administrative Tools. For more information, see Manage dynamic volumes.


Best practices

  • Running Network Monitor during low-usage times
    Run Network Monitor at low-usage times or for short periods of time. This decreases the effect on system performance caused by Network Monitor.
  • Capturing minimum amount of network statistics
    Capture only as many statistics as you need for evaluation. This prevents you from capturing too much information to make a reasonably quick diagnosis of the problem.


How to...

  • Install Network Monitor
  • Install the Network Monitor driver
  • Capture network frames


Install Network Monitor

To install Network Monitor

  1. Open Add/Remove Programs.
  2. In Add/Remove Programs, click Add/Remove Windows Components.
  3. In the Windows Components wizard, select Management and Monitoring Tools, and then click Details.
  4. In the Management and Monitoring Tools window, select the Network Monitor check box, and then click OK.
  5. If you are prompted for additional files, insert your Windows 2000 Server compact disc, or type a path to the location of the files on the network.

Notes

  • To open Add/Remove Programs, click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  • Network Monitor is available only on Windows 2000 Server.
  • This procedure automatically installs the Network Monitor driver.
  • For detailed information about using Network Monitor, click the Help menu in Network Monitor.
  • Certain Windows components require configuration before thay can be used. If you installed one or more of these components, but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components wizard, click Components.
Related Topics


Install the Network Monitor driver

To install the Network Monitor driver

  1. Open Network and Dial-up Connections.
  2. In Network and Dial-up Connections, click Local Area Connection, click the File menu, and then click Properties.
  3. In the Local Area Connection Properties dialog box, click Install.
  4. In the Select Network Component Type dialog box, click Protocol, and then click Add.
  5. In the Select Network Protocol dialog box, click Network Monitor Driver, and then click OK.
  6. If you are prompted for additional files, insert your Windows 2000 compact disc, or type a path to the location of the files on the network.

Notes

  • To open Network and Dial-up Connections, click Start, point to Settings, click Control Panel, and then double-click Network and Dial-up Connections.
  • The Network Monitor driver enables Network Monitor to receive packets from a network adapter.
  • The Network Monitor driver can be installed only on computers running Microsoft Windows 2000 Professional or Windows 2000 Server. Network Monitor drivers for operating systems other than Windows 2000 are available in Microsoft Systems Management Server. For more information on Microsoft Systems Management Server, go to the Microsoft Web site. (http://www.microsoft.com/smsmgmt)
  • If you have already installed Network Monitor, Network Monitor Driver does not appear in the Select Network Protocol dialog box, because the driver is installed automatically with Network Monitor.

Related Topics


Capture network frames

To capture network frames

  1. Open Network Monitor.
  2. If you are prompted for a default network on which to capture frames, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Start.
  4. If you are prompted for additional files, insert your Windows 2000 compact disc, or type a path to the location of the files on the network.

Notes

  • To open Network Monitor, click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Network Monitor.
  • For more information about using Network Monitor, click the Help menu in Network Monitor.

Related Topics


Concepts

This section covers:

  • Network Monitor overview
  • Understanding Network Monitor
  • Using Network Monitor
  • Resources


Network Monitor overview

You use Network Monitor to capture and display the frames (also called packets) that a computer running Windows 2000 Server receives from a local area network (LAN). Network administrators can use Network Monitor to detect and troubleshoot networking problems that the local computer might experience. For example, as a network administrator, you might use Network Monitor to diagnose hardware and software problems when the server computer cannot communicate with other computers. Frames captured by Network Monitor can be saved to a file and then sent to professional network analysts or support organizations.

Network application developers can use Network Monitor to monitor and debug network applications as they are developed.

For detailed information about using Network Monitor, including information about capture triggers, capture buffers, protocol parsers, address databases, capture filters, display filters, and interpreting the results of captured data, click the Help menu in Network Monitor.

Microsoft Systems Management Server includes a full version of Network Monitor. In addition to the functionality in Windows 2000 Network Monitor, Systems Management Server Network Monitor can capture frames sent to and from all computers in a network segment, as well as edit and transmit frames. For more information on Microsoft Systems Management Server, go to the the Microsoft Web site. (http://www.microsoft.com/smsmgmt)


Understanding Network Monitor

This section covers:
  • The network data stream
  • Capturing network data
  • Network Monitor components
  • Network Monitor security
  • Protocol parsers included with Network Monitor


The network data stream

Network Monitor monitors the network data stream, which consists of all information transferred over a network at any given time. Prior to transmission, this information is divided by the network software into smaller pieces, called frames or packets.

Frames, whether broadcast, multicast, or directed, are made up of several different pieces that can be analyzed separately. Some of these pieces contain data that Network Monitor can use to troubleshoot networking problems. For example, by examining the destination address, it can be determined whether the frame was a broadcast frame, indicating all hosts had to receive and process this frame, or a directed frame sent to a specific host. By analyzing frames, you can determine the exact cause of the frame, which helps determine whether the service generating these types of frames can be optimized.

The following figure illustrates the portions of an Ethernet frame:

The portions of an Ethernet frame

For detailed information about using Network Monitor, including information about capture triggers, capture buffers, protocol parsers, address databases, capture filters, display filters, and interpreting the results of captured data, click the Help menu in Network Monitor.

For instructions on installing Network Monitor, see To install Network Monitor


Capturing network data

The process by which Network Monitor copies frames is referred to as capturing. You can capture all network traffic to and from the local network card, or you can set a capture filter and capture a subset of frames. You can also specify a set of conditions that trigger an event in a Network Monitor capture filter. By using triggers, Network Monitor can respond to events on your network. For example, you can make Windows start an executable file when Network Monitor detects a particular set of conditions on the network. After you have captured data, you can view it. Network Monitor does much of the data analysis for you by translating the raw capture data into its logical frame structure.

Network Monitor uses a network driver interface specification (NDIS) feature to copy all frames it detects to its capture buffer.

For detailed instructions on capturing network data, see To capture network frames.

Note

  • Because the version of Network Monitor in Windows 2000 uses the local only mode of NDIS instead of promiscuous mode, you can use Network Monitor even if your network adapter does not support promiscuous mode. Networking performance is not affected when you use an NDIS driver to capture frames. (Putting the network adapter in promiscuous mode can add 30 percent or more to the load on the CPU.)


Network Monitor components

Network Monitor is composed of an administrative tool called Network Monitor and a network protocol called the Network Monitor driver. Both of these components must be installed in order for you to capture, display, and analyze network packets (also called frames).

Network Monitor

You use Network Monitor to capture and display the frames that a computer running Windows 2000 Server receives from a local area network (LAN). Network administrators can use Network Monitor to detect and troubleshoot networking problems that the local computer may experience. Network Monitor can be installed only on computers running Windows 2000 Server. When you install Network Monitor, the Network Monitor Driver is installed automatically on the same computer.

For instructions on installing Network Monitor, see To install Network Monitor.

The Network Monitor driver

The Network Monitor driver enables Network Monitor to receive frames from a network adapter, and allows users of the version of Network Monitor provided with Microsoft Systems Management Server (Systems Management Server Network Monitor) to capture and display frames from a remote computer, including those with a dial-up network connection. When the user of a computer running the Systems Management Server Network Monitor connects remotely to a computer on which the Network Monitor driver has been installed, and that user initiates a capture, statistics from the capture are transferred over the network to the managing computer. The Network Monitor driver can be installed only on computers running Microsoft Windows 2000 Professional or Windows 2000 Server.

For instructions on installing the Network Monitor driver, see To install Network Monitor driver.

Note

  • Network Monitor drivers for operating systems other than Windows 2000 are provided with Systems Management Server. In addition to the functionality in the Windows 2000 Network Monitor, the Systems Management Server Network Monitor can capture frames sent to and from all computers in a network segment, as well as edit and transmit frames. For more information on Microsoft Systems Management Server, go to the Microsoft Systems Management Server Web site.
Network Monitor components


Network Monitor security

For security reasons, the version of Network Monitor in Windows 2000 captures only those frames, including broadcast and multicast frames, sent to or from the local computer. Network Monitor also displays overall network segment statistics for broadcast frames, multicast frames, network utilization, total bytes received per second, and total frames received per second.

In addition, to help protect your network from unauthorized use of Network Monitor installations, Network Monitor provides the capability to detect other installations of Network Monitor that are running on the local segment of your network.

Detecting other installations of Network Monitor

To protect your network from unauthorized monitoring, Network Monitor can detect other installations of Network Monitor running on the local segment of your network. Network Monitor also detects all instances of the Network Monitor driver being used remotely (by either Network Monitor from Systems Management Server or System Monitor) to capture data on your network.

When Network Monitor detects other Network Monitor installations running on the network, it displays the following information about them:

  • The name of the computer
  • The name of the user logged on at the computer
  • The state of Network Monitor on the remote computer (running, capturing, or transmitting)
  • The adapter address of the remote computer
  • The version number of Network Monitor on the remote computer

In some instances, your network architecture might prevent one installation of Network Monitor from detecting another. For example, if an installation is separated from yours by a router that does not forward multicasts, your installation cannot detect that installation.


Protocol parsers included with Network Monitor

A protocol parser is a dynamic-link library (.dll) that identifies the protocols used to send a frame on the network. Information about these protocols appears when you display captured frames in the Frame Viewer window. Each protocol that Network Monitor supports has a corresponding parser.

For detailed information about using Network Monitor, including information about capture triggers, capture buffers, protocol parsers, address databases, capture filters, display filters, and interpreting the results of captured data, click the Help menu in Network Monitor.

Following is a list of the protocols that are included with Network Monitor.

Protocol | Description
AARP | AppleTalk Address Resolution Protocol (Atalk.dll)
ADSP | AppleTalk Data Stream Protocol (Atalk.dll)
AFP | AppleTalk File Protocol (Atalk.dll)
AH | IP Authentication Header (Tcpip.dll)
ARP_RARP | Internet Address Resolution Protocol/Reverse Address Resolution Protocol (Tcpip.dll)
ASP | AppleTalk Session Protocol (ATALK.dll)
ATMARP | ATM Address Resolution Protocol (Atmarp.dll)
ATP | AppleTalk Transaction Protocol (Atalk.dll)
BONE | Bloodhound-Oriented Network Entity Protocol (Bone.dll)
BOOKMARK | Network Monitor BOOKMARK Protocol (Trail.dll)
BPDU | Bridge Protocol Data Unit (Llc.dll)
BROWSER | Microsoft Browser (Browser.dll)
CBCP | Callback Control Protocol (Ppp.dll)
CCP | Compression Control Protocol (Ppp.dll)
COMMENT | Network Monitor COMMENT Protocol (Trail.dll)
DDP | AppleTalk Datagram Delivery Protocol (Atalk.dll)
DHCP | Dynamic Host Configuration Protocol (Tcpip.dll)
DNS | Domain Name System (Tcpip.dll)
EAP | PPP Extensible Authentication Protocol (Ppp.dll)
ESP | IP Encapsulating Security Payload (Tcpip.dll)
ETHERNET | Ethernet 802.3 topology (Mac.dll)
FDDI | FDDI topology (Mac.dll)
FINGER | Internet Finger protocol (Tcpip.dll)
FRAME | Base frame properties (Frame.dll)
FTP | File Transfer Protocol (Tcpip.dll)
GENERIC | Network Monitor GENERIC Protocol (Trail.dll)
GRE | Generic Routing Encapsulation Protocol (Ppp.dll)
ICMP | Internet Control Message Protocol (Tcpip.dll)
IGMP | Internet Group Management Protocol (Tcpip.dll)
IP | Internet Protocol (Tcpip.dll)
IPCP | Internet IP Control Protocol (Ppp.dll)
IPX | NetWare Internet Packet eXchange protocol (Ipx.dll)
IPXCP | NetWare Internetwork Packet eXchange Control Protocol (Ppp.dll)
IPXWAN | NetWare Internetwork Packet eXchange Protocol for Wide Area Networks (Ppp.dll)
ISAKMP | Internet Security Association and Key Management Protocol (Ppp.dll)
L2TP | Level 2 Tunneling Protocol (L2tp.dll)
LAP | AppleTalk Link Access Protocol (Atalk.dll)
LCP | Link Control Protocol (Ppp.dll)
LLC | Logical Link Control 802.2 Protocol (LLC.dll)
LPR | BSD Printer (Ppp.dll)
MESSAGE | Network Monitor MESSAGE Protocol (Trail.dll)
MSRPC | Microsoft Remote Procedure Call Protocol (Msrpc.dll)
NBFCP | NetBIOS Frames Control Protocol (Ppp.dll)
NBIPX | NetBIOS on IPX (Ipx.dll)
NBP | AppleTalk Name Binding Protocol (Atalk.dll)
NBT | Internet NetBIOS Over TCP/IP (Tcpip.dll)
NCP | NetWare Core Protocol (Ncp.dll)
NDR | NetWare Diagnostic Redirector (Ipx.dll)
NETBIOS | Network Basic Input/Output System Protocol (Netbios.dll)
NETLOGON | Microsoft Netlogon Broadcasts (Netlogon.dll)
NFS | Network File System (Tcpip.dll)
NMPI | Microsoft Name Management Protocol on IPX (Ipx.dll)
NSP | NetWare Serialization Protocol (Ipx.dll)
NWDP | NetWare WatchDog Protocol (Ipx.dll)
ODBC | Network Monitor ODBC Protocol (Trail.dll)
OSPF | Open Shortest Path First (Tcpip.dll)
PAP | AppleTalk Printer Access Protocol (Atalk.dll)
PPP | Point-to-Point Protocol (Ppp.dll)
PPPCHAP | PPP Challenge Handshake Authentication Protocol (Ppp.dll)
PPPML | Point-to-Point Multilink Protocol (Ppp.dll)
PPPPAP | PPP Password Authentication Protocol (Ppp.dll)
PPTP | Point-to-Point Tunneling Protocol (Ppp.dll)
R_LOGON | Generated RPC for interface logon (Logon.dll)
R_LSARPC | Generated RPC for Interface Lsarpc (Lsarpc.dll)
R_WINSPOOL | Generated RPC for Interface Winspool (Winspl.dll)
RADIUS | Remote Authentication Dial-In User Service Protocol (Ppp.dll)
RIP | Internet Routing Information Protocol (Tcpip.dll)
RIPX | NetWare Routing Information Protocol (Ipx.dll)
RPC | Remote Procedure Call (Tcpip.dll)
RPL | Remote Program Load (Llc.dll)
RSVP | RSVP Protocol (Rsvp.dll)
RTMP | AppleTalk Routing Table Maintenance Protocol (Atalk.dll)
SAP | NetWare Service Advertising Protocol (Ipx.dll)
SMB | Server Message Block Protocol (Smb.dll)
SMT | FDDI MAC Station Management (Mac.dll)
SNAP | Sub-Network Access Protocol (Llc.dll)
SNMP | Simple Network Management Protocol (Snmp.dll)
SPX | NetWare Sequenced Packet eXchange Protocol (Ipx.dll)
SSP | Security Support Provider Protocol (Msrpc.dll)
STATS | Network Monitor Capture Statistics Protocol (Trail.dll)
TCP | Transmission Control Protocol (Tcpip.dll)
TMAC | Token Ring MAC layer (Mac.dll)
TOKENRING | Token Ring 802.5 Topology (Mac.dll)
TPCTL | Test Protocol Control Language (Tpctl.dll)
TRAIL | Network Monitor TRAIL Protocol (Trail.dll)
UDP | User Datagram Protocol (Tcpip.dll)
VINES_FRAG | Banyan Vines Fragmentation Protocol (Vines.dll)
VINES_IP | Banyan Vines Internet Protocol (Vines.dll)
VINES_TL | Banyan Vines Transport Layer Protocols (Vines.dll)
XNS | Xerox Network System (Xns.dll)
ZIP | AppleTalk Zone Information Protocol (Atalk.dll)

Note

  • The full version of Network Monitor (included with Microsoft Systems Management Server) supports additional protocol parsers. If you want to capture data sent in a protocol that is not included with Network Monitor, use the Systems Management Server Network Monitor or add your own parser. To add a protocol parser to Network Monitor, you must write the parser DLL first. The Systems Management Server version 2.0 Toolkit provides complete details for writing and installing parsers for Network Monitor. For more information on Microsoft Systems Management Server, go to the the Microsoft Web site.


Using Network Monitor

This section covers:

  • Using capture filters
  • Using display filters
  • Displaying captured data


Using capture filters

A capture filter functions like a database query—use it to specify the types of network information you want to monitor. For example, to see only a specific subset of computers or protocols, you can create an address database, use the database to add addresses to your filter, and then save the filter to a file. By filtering frames, you save both buffer resources and time. Later, if necessary, you can load the capture filter file and use the filter again.

Designing a capture filter

To design a capture filter, specify decision statements in the Capture Filter dialog box. This dialog box displays the filter's decision tree, which is a graphical representation of a filter's logic. When you include or exclude information from your capture specifications, the decision tree reflects these specifications.

Filtering by protocol

To capture frames sent using a specific protocol, specify the protocol on the SAP/ETYPE= line of the capture filter. For example, to capture only IP frames, disable all protocols and then enable IP ETYPE 0x800 and IP SAP 0x6. By default, all of the protocols that Network Monitor supports are enabled.

Filtering by address

To capture frames from specific computers on your network, specify one or more address pairs in a capture filter. You can monitor up to four specific address pairs simultaneously.

An address pair consists of:

  • The addresses of the two computers you want to monitor traffic between.
  • Arrows that specify the traffic direction you want to monitor.
  • The INCLUDE or EXCLUDE keyword, indicating how Network Monitor should respond to a frame that meets a filter's specifications.

Regardless of the sequence in which statements appear in the Capture Filter dialog box, EXCLUDE statements are evaluated first. Therefore, if a frame meets the criteria specified in an EXCLUDE statement in a filter containing both an EXCLUDE and INCLUDE statement, that frame is discarded. Network Monitor does not test that frame by INCLUDE statements to see if it meets that criterion also.

For example, to capture all the traffic from Joe's computer except the traffic from Joe to Anne, use the following capture filter address section:

Addresses
include   Joe <----> Any
exclude   Joe <----> Anne

If there are no include lines, your_computer <----> Any is used by default.

Filtering by data pattern

By specifying a pattern match in a capture filter, you can:

  • Limit a capture to only those frames containing a specific pattern of ASCII or hexadecimal data.
  • Specify how many bytes (offsets) into the frame the pattern must occur.

When you filter based on a pattern match, you must specify where the pattern occurs in the frame (how many bytes from the beginning or end). If your network medium has a variable size in the media access control protocol, such as Ethernet or Token Ring, specify to count from the end of the topology header.


Using display filters

Like a capture filter, a display filter functions like a database query, allowing you to single out specific types of information. But because a display filter operates on data that has already been captured, it does not affect the contents of the Network Monitor capture buffer.

Use a display filter to determine which frames to display. You can filter a frame by:

  • Its source or destination address.
  • The protocols used to send it.
  • The properties and values it contains. (A property is a data field within a protocol header. A protocol's properties indicate the purpose of the protocol.)


Displaying captured data

Network Monitor simplifies data analysis by interpreting raw data collected during the capture and displaying it in the Frame Viewer window.

To display captured information in the Frame Viewer window, on the Capture menu, click Stop and View while the capture is running. Or, open a capture file (.cap).

Note

  • To display data captured with the Network General Sniffer, open the uncompressed Sniffer files. To view a compressed Sniffer file, open the file in Sniffer and then save the file in uncompressed format. Or, obtain a Sniffer file decompression tool from Network General.

The Frame Viewer window includes the following panes:

Pane | Displays
Summary | General information about captured frames in the order in which they were captured.
Detail | The frame's contents, including the protocols used to send it.
Hex | A hexadecimal and ASCII representation of the captured data.


Resources

  • Network Monitor Help. For information about capture triggers, capture buffers, protocol parsers, address databases, capture filters, display filters, and interpreting the results of captured data, click the Help menu in Network Monitor.
  • Windows 2000 Server family at Microsoft Windows (http://www.microsoft.com/)
  • Microsoft Windows Hardware Compatibility List at Microsoft Web site.(http://www.microsoft.com/)
  • Microsoft TechNet at Microsoft TechNet (http://www.microsoft.com/)
  • Microsoft TechNet compact discs.
  • Microsoft support at Microsoft Web site.(http://www.microsoft.com/)
  • Getting Started for Windows 2000 Server.
  • Windows 2000 Server Resource Kit.
  • Windows 2000 Server Registry.


Troubleshooting

What problem are you having?

After upgrading from Windows NT 4.0 to Windows 2000, Network Monitor version 1.2 does not work, or you get an error message that Nal.dll cannot be found.

Cause: During upgrade, the Network Monitor Agent 1.2 is replaced with the Network Monitor driver 2.0, which is not compatible with Network Monitor 1.2. Network Monitor Agent 1.2 is not supported by Windows 2000.

Solution: Use Network Monitor driver 2.0 or later.

Not enough disk space to create a capture buffer.

Cause: When you set a capture buffer, Network Monitor reserves disk space equal to the size of the capture buffer. If not enough disk space is free, you will get an error.

Solution: Make sure that the temporary capture directory has enough free disk space (at least 1 MB free + buffer size).

Access denied to default capture directory on computers with lockdown policies in place.

Cause: Lockdown systems will not allow you to write to files in the system folder and subfolders, but the default folder for Network Monitor capture files is a subfolder of the system folder (Winnt).

Solution: After you create a capture, save the capture into a folder to which you have read and write access. This folder becomes the new default location for saving capture files.

Network Monitor does not work through Microsoft Terminal Services server.

Cause: Network Monitor will not work through a terminal server client connection.

Solution: Run Network Monitor locally. Or, if you want to run Network Monitor on a remote computer, set up the Network Monitor driver on the remote computer (the one that you will use to capture traffic) and set up the version of Network Monitor that comes with Microsoft Systems Management Server on the local computer. Then use Network Monitor remotely to create the remote capture session.

"No NPPs found" error message.

Cause: Network Monitor and/or the Network Monitor driver are not installed properly.

Solution: Make sure that the Network Monitor components are installed properly.

  1. If the Network Monitor driver is not installed, install it using the steps described in To install the Network Monitor driver.
  2. If the Network Monitor driver is installed, delete it and then reinstall it.
  3. If reinstalling the Network Monitor driver does not solve the problem, remove Network Monitor and then reinstall it using the steps described in To install Network Monitor.


Working with multiple network adapters

If your computer uses multiple network adapters and you want to simultaneously capture and view frames on all network adapters, you must run an instance of Network Monitor for each network adapter. If you want to use only one instance of Network Monitor, you must select network adapters one at a time.

To select the network adapter on which to capture frames, on the Capture menu, click Networks and then select a network adapter.