Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

Tomarenz — Thu, 17 Jan 2008 22:55:17 GMT

Very interesting, but after a sort trial using two hosts with Tomcat and a browser - I was unable to see any HTTP protocol name. Frames were captured, but they are all marked as TCP.

Installation on XP out-of-the-box, no filters. How can I get HTTP frames being properly recognized ?

Thansk.

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

PaulELong — Fri, 18 Jan 2008 20:44:28 GMT

What port is the HTTP traffic on? By default the NPL for NM3 uses ports 80 and 8080. But you can add other ports if the app is using a non-standard HTTP port.

Thanks,

Network Monitor Team

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

Tomarenz — Mon, 21 Jan 2008 12:06:46 GMT

Ah, I suspected that. Indeed port is 8180. I tried to spot where I could set it up, no success.

How/where do I add non-standard ports to a protocol ?

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

PaulELong — Mon, 21 Jan 2008 18:10:54 GMT

You have to modify TCP.NPL and add the port. Please reference this BLOG for more info: http://blogs.technet.com/netmon/archive/2006/10/04/NPL-_1320_-The-Power-Behind-the-Parsers.aspx.

Thanks,

Network Monitor Team

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

Tomarenz — Mon, 28 Jan 2008 20:43:16 GMT

Hi, a tricky question: is there any way to sniff packets intramachine ? I mean process-to-process, e.i. when browser and web server are on the same host.

Very useful while developing, as the last chance when things go wrong.

I have XP and MS loopback installed on 192.168.02. but I can't see any packet over there. All flow over the wireless on 192.168.0.3

From net info (e.i. Ethereal world) I understand that I definitely cannot sniff intramachine in the Windows world, but who knows with Netmon ...

re: Understanding HTTP Flow with Netmon 3 - By Yuri Diogenes

PaulELong — Tue, 29 Jan 2008 00:33:20 GMT

This is not possible today. We've been looking at this as a feature for future versions of NM, but we have not solid plans to implement this soon.

There are ways of getting this information with Vista and above OS's so we may be able to find a way to leverage those methods with the API available in NM3.2 When we have time to investigate this further we might be able to provide a separate tool to capture local traffic.

Thanks,

Network Monitor Team

Netmon Trace & HTTP Requests

Siva's IIS Blog — Thu, 27 Mar 2008 19:24:31 GMT

While browsing on the technet portal for details on Netmon drivers for Vista, happened to visit a blog

Interesting Links - 6/3/2008

Matt Johnson's Technical Adventures — Wed, 04 Jun 2008 04:39:48 GMT

This week's collection of interesting links! Understanding HTTP Flow with Netmon 3 - Interesting article