Open Software Solutions

When you start a capture session, Network Monitor 3 stores frames in a sequence of capture files that are located in the Temp folder. By default, the size of each capture file is 20 MB. By default, if you do not stop the capture session, Network Monitor 3 continues to store capture files in the Temp folder until the free hard disk space on the computer is less than 2 percent. Then, Network Monitor 3 stops the capture session.

You can configure the capture file size, the location where the capture files are stored, the free hard disk space limit, and other capture options. To do this, on the Tools menu, point to Options, and then click the Capture tab.

In addition to capturing data, Network Monitor 3 assigns properties to frames, and then uses the properties to group the frames into conversations. Network Monitor 3 displays the conversations and the associated frames in a tree structure in the Network Conversations pane.

The Conversations feature of Network Monitor 3 significantly increases memory use. This may cause the computer to become unresponsive. By default, the Conversations feature is turned off. Some higher-level protocol filters require conversation properties. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box.

The Conversations feature of Network Monitor 3 may significantly increase processor utilization when lots of frames are processed. By default, the Conversations feature is turned off, as mentioned in the Memory use section.

As mentioned earlier, Network Monitor 3 may consume lots of system resources. Therefore, if you want to minimize the effect on system resources that may occur when you use Network Monitor 3 to capture data, use the Nmcap.exe command-line tool to capture data.

Network Monitor 3 enables you to collect network data and to view the network data in real time as the data is captured. To start a capture session in Network Monitor 3, click the Start Page tab, click Create a new capture tab, and then either click the Start Capture button, or press F10.

Network Monitor 3 uses a simple syntax that is expression-based to filter frames. All frames that match the expression are displayed to the user. For more information about filters, do any of the following:

By default, the Conversations feature is turned off. This is the default setting because the Conversations feature can consume lots of memory, especially in scenarios when you capture data for long periods of time. To turn on the Conversations feature, click the Start Page tab, and then click to select the Enable Conversations check box.

When you turn on the Conversations feature, frames are grouped and displayed in the Network Conversations pane in a tree structure according to the conversations to which they belong. For example, TCP data that uses the same source port and the same destination port is organized into a group. When you click a node in the Network Conversations pane, the corresponding conversation filter is automatically applied to the frames in the Frame Summary pane. Only frames that belong to that particular conversation are displayed.

The Nmcap.exe command-line tool enables you to configure when you want to start a capture session or to stop a capture session. You can also use the Nmcap.exe command-line tool to created chained captures. Chained captures enable you to create multiple capture files. However, the size of the capture files remains small.

Network Monitor 3 parsers are written in a language specifically to make parser development more straightforward. This also provides a level of protection against potential exploitation from malicious code that may occur if parsers were created as DLL files. NPL provides access to parsers. You can view or modify the parsers that are included in Network Monitor 3.

This issue occurs if either of the following conditions is true:

For more information, see the Network Monitor 3 releases notes or see the Operating on Windows Vista topic in Network Monitor 3 Help.