Capture Network Traffic with Microsoft Network Monitor

Microsoft Network Monitor is a deprecated network traffic capture and packet analyzer tool. It allows capturing, viewing, and analyzing network data and deciphering network protocols. It can be used to troubleshoot network problems and applications on the network

How to use Network Monitor

  1. Download Microsoft Network Monitor
  2. Perform the installation using the downloaded file.
  3. Open “Microsoft Network Monitor 3.4” and run as “administrator”
run network monitor
  1. Select the ethernet you want to capture by ticking it . If you have multiple ethernets, don’t select all ethernets, choose only ethernets that you will capture network traffic from .

Getting Started Capture Network Traffic

  1. To start capturing network traffic, click the “New Capture” button and then click the “Start” button.
  1. You will see the traffic through the ethernet network that you captured in the “Frame Summary” section.
TOP TUTORIALS:  Prevent Windows 10 Specific Updates
  1. To focus more on analyzing the network, you can add filters. You can filter network traffic based on running applications, destination, port number and so on. For how to write and examples you can see at the end of this article.

Network Monitor Filtering

Network Monitor IPv4 Filtering

Field/ PropertyDescriptionExample
IPv4.AddressFilter on an address in either direction, source or destination.IPv4.Address==192.168.1.1
IPv4.SourceAddressRepresents the source address and is useful for filtering for traffic from a specific source.IPv4.SourceAddress==192.168.1.1
IPv4.DestinationAddressRepresents the destination address and is useful for filtering for traffic to a specific destination.IPv4.DestinationAddress==192.168.2.2
IPv4.PayloadLengthThe entire length of the IP payload. IPv4.PayloadLength == 0
DestinationContains the topmost protocols source address.  So if IPv4 is the last protocol with an address, Property. Destination will contain the string representation of that address.  This is the same property used to populate the Source column in the UI.Destination==”192.168.2.2″
SourceSimilar to DestinationSource.Contains(“192.”)
IPPayloadLengthRepresents the IP Payload Size in bytesIPPayloadLength > 1000

Network Monitor Conversation Filtering

Field/ PropertyDescriptionExample
ProcessNameThe process associated with the current frame.  This is collected when Network Monitor 3.4 is used to capture a trace.  If using NMCAP, you need to add the /CaptureProcesses.ProcessName.Contains(“iexpl”)
ProcessIDThe process ID associated with the current frame.  This is collected when Network Monitor 3.4 is used to capture a trace.  If using NMCAP, you need to add the /CaptureProcesses.ProcessID == 1234

Network Monitor Wireless Filtering

Field/ PropertyDescriptionExample
Wifi.AddressFilter on an address in either direction, source or destination.Ethernet.Address==0x123456AABBCC
wifi.Management.SARepresents the source address and is useful for filtering for traffic from a specific source.wifi.Management.sA==0x123456AABBCC
wifi.Management.DARepresents the destination address and is useful for filtering for traffic to a specific destination.wifi.Management.DA==0x123456AABBCC
WiFi.MetaData.PhyTypeThe Physical Layer Type value. Each value represents a different layer. These are described in the WiFiPhyType table in wireless.npl. 4=a, 5=b, 6=g, and 7=n.WiFi.MetaData.PhyType == 0x6
property.WiFiDestinationContains the top most protocols source address.  So if WiFi is the last protocol with an address, Property. Destination will contain the string representation of that address.  This is the same property used to populate the Source column in the UI.WiFiDestination == 0xFFFFFFFFFFFF
property.WifiChannelWireless Channelproperty.WifiChannel==14
property.WiFiSourceSimilar to DestinationWiFiSource == 0xFFFFFFFFFFFF
DestinationContains the top most protocols source address.  So if WiFi is the last protocol with an address, Property. Destination will contain the string representation of that address.  This is the same property used to populate the Source column in the UI.Destination.Contains(“123456”)
SourceSimilar to DestinationSource.Contains(“123456”)

Network Monitor TCP Filtering

Field/ PropertyDescriptionExample
TCP.PortFilters on the Source or Destination port.  Used to find traffic based on port which is often associated with an application.TCP.Port==80
TCP.Flags.ResetCan be used to test and see if the reset flag is set.TCP.Flags.Reset==1
TCP.WindowWindow Size of the current TCP frame, but ignoring the scale factor. See Property.TCPWindowSize below.TCP.Window == 0
TCPRetransmitA property that is set when a TCP retransmit is found.  Retransmits are often an indication of a network infrastructure problem and network congestion.Property.TCPRetransmit == 1
TCPPayloadLengthRepresents the TCP Payload Size.TCPPayloadLength == 0
TCPCheckSumStatusThis is a string that represents if the checksum is valid or not.  This could be “Good” or “Bad”.TCPCheckSumStatus != “Good”
TCPDescriptionA property to show the TCP Description for the current frame as opposed to the top most protocol description.  This is useful as a frame summary column.  You can also use it to search for specific retransmitted frames by searching for the text in the TCP summary, as the example shows.TCPDescription.Contains(“#472”)
TCPAckNumberThe current frame’s Acknowledgement NumberTCPAckNumber==1234
TCPSeqNumberThe current frame’s Sequence NumberTCPSeqNumber==1234
TCPSeqeunceRangeThe TCP Sequence range, as a string, which is the current seq number to the current seq plus the length of the TCP payload.TCPSequenceRange.Contains(“1234”)
TCPShortAckNumberA WORD representation of the Ack number to make it easy to compare and remember.TCPShortAckNumber==1000
TCPShortSeqNumberA WORD representation of the Seq number to make it easy to compare and remember.TCPShortSeqNumber==1000
TCPFlagsA string representation of the various TCP flags for the frame: CWR, ECE, Urgent, Ack, Push, Reset, Syn, Fin.TCPFlags.Contains(“R”)
TCPWindowSizeThe Window Size for the current frame including the scaling factor if the 3 way handshake is available in the same trace.TCPWindowSize==0
Ads Blocker Image Powered by Code Help Pro
Ads Blocker Detected!!!

We have detected that you are using extensions to block ads. Please support us by disabling these ads blocker.

I Have Disabled The AdBlock, Reload Now
Powered By
CHP Adblock Detector Plugin | Codehelppro