NMCap: the easy way to Automate Capturing

re: NMCap: the easy way to Automate Capturing

HeatfanJohn — Wed, 25 Oct 2006 21:54:05 GMT

This is great information.

FYI, I had to turn off the "Enable local only" option on a capture to be able to capture packets that weren't addressed to my PC. My guess is that turning this off turns on promiscuous mode for the packet capture. I briefly reviewed the Netmon3 user guide and I didn't see anything on this.

You might want to highlight this somewhere as this is a change from NM2 which I believe ran in promiscuous mode by default.

We were spanning traffic through our Cisco network and I didn't see the traffic by default using NM3, but did with other software and NM2.

The capture only local traffic also shows up in two areas. It shows up under options and also under the capture. I had to uncheck this under capture for it to take effect.

John

re: NMCap: the easy way to Automate Capturing

PaulELong — Tue, 07 Nov 2006 20:17:53 GMT

Thanks John. I've sent a note to our team to try and document this in the release notes.

Paul

re: NMCap: the easy way to Automate Capturing

alicain — Tue, 05 Dec 2006 15:25:59 GMT

Hi,

I like the ability to filter from the command line with "NMCap /InputCapture"

I think there are a couple of typos there...the following seems to work :

NMCap /InputCapture test.cap /capture Ipv4.Address ==10.0.0.1 /file c1.cap

Ali.

re: NMCap: the easy way to Automate Capturing

PaulELong — Tue, 05 Dec 2006 17:33:21 GMT

Ali, thanks for the corrections. I've fixed the typos in the blog.

Paul

EventMon: Stopping a Capture Based on an EventLog Event

Network Monitor — Thu, 22 Feb 2007 23:59:22 GMT

Having worked in Product Support for many years, I’ve had many occasions where a specific Event Log error

re: NMCap: the easy way to Automate Capturing

SuperBfred — Mon, 27 Aug 2007 12:42:10 GMT

Hello,

Do you have plans to provide more sophisticated automation interface. COM or .Net ?

It would be handy. In fact relying on shell commands is not the way to go

Regards

re: NMCap: the easy way to Automate Capturing

PaulELong — Mon, 27 Aug 2007 16:35:51 GMT

One of our goals for the next version is to provide some kind of API so that you can capture, store, and analyze trace data using our engine. As for a COM or .Net interface, we probably will try to provide a managed interface, but I can't be sure if that will be provided at the same time.

Thanks,

Paul

General network errors (GNEs), Timeout expired, SQL Server not found or Access Denied…

Microsoft SQL Server Support Blog — Thu, 06 Sep 2007 16:29:13 GMT

Many times, the key to solving these errors is a network packet trace. The problem is that these errors

NMCap: the easy way to Automate Capturing, .cap file

ilpostino — Mon, 14 Apr 2008 13:38:19 GMT

Hello,

is there a way to read the data from the .cap file for example if i want to get HTTP Headers from captured frames

Thanks.

re: NMCap: the easy way to Automate Capturing

PaulELong — Mon, 14 Apr 2008 16:28:47 GMT

Today, you'd have to use the UI and add a column for the HTTP header. Then you could export that data from the UI by Cut & Pasting, for instance, into Excel. Then you could extract that one column.

In the next version, NM3.2, you'll be able to use the NMAPI to extract that data programmatically.

Thanks,

Paul

re: NMCap: the easy way to Automate Capturing

ilpostino — Tue, 15 Apr 2008 13:34:37 GMT

Hello again,

Do you have a library for all command and parameters?

Thanks,

re: NMCap: the easy way to Automate Capturing

PaulELong — Tue, 15 Apr 2008 16:21:59 GMT

The next version will also contain a NetmonSDK.CHM with information about all the API calls and examples.

Thanks,

Paul

re: NMCap: the easy way to Automate Capturing

ilpostino — Wed, 16 Apr 2008 13:05:40 GMT

Hi,

I am very sorry for disturbing you but i realy need a way to automate capturing, so i need to capture HTTP responses and requests on the port 1000 of my PC

i tried with: /capture "http.port == 1000"

it doesnt work

it wil be ok if i could just specify the port 1000 without the http filter

finaly is there any option for /network so i can limit the capture to my own PC without need to specify my IP address?

Thanks,

re: NMCap: the easy way to Automate Capturing

PaulELong — Wed, 16 Apr 2008 16:26:35 GMT

The port information is part of TCP not HTTP. so waht you want is "/capture tcp.port == 1000".

By default when you capture with NMCap, you only see traffic comming to your machine. You actually have to add an option /DisableLocalOnly, to see traffic that's not destine for you machine.

Thanks,

Paul

The Quick and Easy on Using NMCap to Create Circular Network Traces Based on File Size

Microsoft Enterprise Networking Team — Thu, 28 Aug 2008 00:42:19 GMT

Hello all Networking Blog readers.  My name is Brett Crane and I am an engineer with the Networking