Using Network Monitor to Capture Traffic Using a Remote Agent

• Microsoft Windows NT Server versions 3.1, 3.5, 3.51, 4.0
• Microsoft Windows NT Server, Enterprise Edition version 4.0
• Microsoft Windows NT Workstation versions 3.1, 3.5, 3.51, 4.0
• Microsoft Windows versions 95, 98, 98 Second Edition

SUMMARY

Microsoft Network Monitor gives you the capability to connect to other computers and capture traffic from another computer. You can do this across a router or a Remote Access Service (RAS) connection.

MORE INFORMATION

The two primary components of Network Monitor are the Network Monitor Agent and the user interface. The Network Monitor Agent binds to the user interface and passes traffic up to the program. The Network Monitor Agent can run on any compatible computer while the program is running on a separate computer.

How to Use Network Monitor Agent on a Second Computer

1. Install the Network Monitor Agent (in Control Panel, click Network, click Services, click Add, and then click Network Monitor Agent).



2. In Control Panel, click Services, click Network Monitor Agent, and then click Start. (If you want the Network Monitor Agent to start when the computer starts, click Startup, and then click Automatic.)

1. Start Network Monitor.



2. From the Capture menu, click Networks.



3. Click the name of the remote connection, and then click Connect.
   
   NOTE: Until you make a connection, this entry is REMOTE. After you make a connection, REMOTE is replaced by the NetBIOS name of the remote computer.



4. In the Agent Name box, specify the name of the agent to which you are connecting. This name is the NetBIOS name of the remote computer. A universal naming convention (UNC) path name is not required.



5. In the User Comment box, click a comment to associate with the agent name you specified. This comment is displayed when users attempt to connect to the Network Monitor Agent.



6. In the Agent Status Update Frequency dialog box, specify the frequency (in seconds), in which you want the statistics from the remote capture displayed on your local computer. This number must be between 1-65 (the default is 2).



7. Click the Slow Link option. This option extends the period of time that your connection can be idle before Network Monitor concludes that the connection is unsuccessful and disconnects from the Network Monitor Agent. This option is recommended for all asynchronous connections.



8. Click Connect. If the Network Monitor Agent on the remote computer is password protected, you are prompted to type a password. If the Network Monitor Agent is running on a computer with only one network adapter installed, Network Monitor connects to that network adapter. If the Network Monitor Agent is installed on a computer that is multihomed, a dialog box that lists the network adapters installed is displayed. An asterisk appears next to the network adapter that Network Monitor used to make the connection to the remote computer. This network adapter is connected to the same network segment to which you are connected. Unless you want to capture statistics from your own your local network segment, you should select one of the other network adapters that is displayed.



9. Click Capture/Start to begin capturing data.

REFERENCES

For additional information, please see the following article in the Microsoft Knowledge Base:

Q148942 How to Capture Network Traffic with Network Monitor

Additional query words: netmon nm bh bloodhound sniff trace

Keywords :
Version : WINDOWS:95,98,98 Second Edition; winnt:3.1,3.5,3.51,4.0
Platform : WINDOWS winnt
Issue type : kbinfo