Using Microsoft Network Monitor (Netmon) to capture a network trace

  • Article

1) Download and install Netmon from the following URL.  Note, the password for the .zip is "trace".

ftp://ftp.microsoft.com/pss/tools/netmon/netmon2.zip

2) Start Netmon.

Administrative Tools->Network Analysis Tools->Network Monitor

3) Select the appropriate network interface.

The first time you run Netmon, you'll be asked to select the network interface to trace.  The following command from the command line should help you to identify the approriate interface via the "Physical Address":

ipconfig /all

4) Increase the buffer settings.

By default, Netmon will only trace up to 1Mb of data before it starts to overwrite the capture buffer.  Set the buffer to a larger size (say 10Mb) via Capture->Buffer Settings menu item.

5) Start the trace via Capture->Start menu item.

6) Reproduce the issue.

7) Stop the trace via the Capture->Stop menu item.

8) Save the trace via the File->Save As menu item.

9) To complement the trace, capture network configuration information to a .txt file:
ipconfig /all > %computername%-ipconfig.txt

10) .ZIP up the .cap and .txt files and send to your Microsoft support representative for analysis.