The Microsoft Bloodhound Tasklist
Welcome to Microsoft Network Monitor Cue Cards

These cue cards provide instructions for using Microsoft Network Monitor to troubleshoot common network problems.

Cue Cards is a friendly online coach that teaches you with step-by-step instructions that remain visible as you do your own work.

  What do you want to do?

   Learn how to use Microsoft Network Monitor.

   I'm not sure. Show me what Network Monitor Can do.


With Microsoft Network Monitor, you can monitor activity on a local area network and effectively troubleshoot network problems.

  What do you want to do?

  Capture information from the network

  Display captured information

  Use Network Monitor's remote capturing capability

  Print captured data

  Customize the Network Monitor display


To identify the highest multicaster on the network, follow these steps:

1. 	Display the Capture window.

2. 	From the Capture menu, select Start.

3. 	While Network Monitor captures data, in the Station Statistics pane (the lowest pane on the screen), double-click on the Multicasts Sent column header.

For the remainder of the current session, the computer generating the highest broadcast level appears at the top of the Station Statistics pane.


To use address pairs in a Capture filter, you should first build an address database. Once this database is built, you can use the addresses listed in the database to specify address pairs in a capture filter.

To create an address list, follow these steps:

1.	From the Capture menu, select Start. Optionally, open a .CAP file in the Frame Viewer window.

2.	When you have finished capturing, select Stop and View from the Capture menu to display the Frame Viewer window.

3.	From the Display menu, select Find All Names.

Network Monitor processes the frames, then adds them to the address database.

4.	Close the Frame Viewer window, and display the Capture window.

5.	From the Capture menu, select Filter to display the Capture filter dialog box.

6.	In the Capture Filter dialog box, double-click on the Address Pairs line. Or, choose Address in the Add groupbox.

Network Monitor displays the address database you've created. You can use the names in this database to specify address pairs in the Capture filter.


To search for frame properties, follow these steps:

1.	From the Display menu, select Find Next Frame to display the Expression Dialog box.

2.	Choose the Property tab.

3.	In the Protocol:Property box, locate the protocol that contains the property. If a plus (+) sign appears next to this protocol, click on the plus sign to display the protocols properties.

4.	In the Protocol:Property box, select the property you want to locate.

5.	In the Relation box, select the appropriate relational operator.

6.	Choose a Hex or ASCII format for the property.

7. 	In the Value box, specify a value. Or, if a box of options is displayed beneath the Values box, select one of the displayed options.

8.	Choose Edit to display the Address database dialog box, which you can use to modify an existing address.

9.	Choose OK.


5.	In the Direction window, of the dialog box, choose one of the symbols:

Choose the <--> symbol to monitor the traffic that passes in either direction  between the addresses that you have selected.

Choose the --> symbol to monitor only the traffic that passes from the address  selected in the left window to the address selected in the right window.

6.	Choose OK.

7.	In the Capture Filter dialog box, choose OK.

8.	From the Capture menu, choose Start.


To monitor traffic between two computers, follow these steps:

1.	From the Capture menu, choose Filter to display the Capture Filter dialog box.

2.	Double-click on the ANY <-> ANY line to display the Address Expression dialog box.

3.	In the left window of the Address Expression dialog box, select the address of a computer.

4.	In the right window of the Address Expression dialog box, select the address of a computer.

When you have done this, choose the Next button at the top of this window for more instructions.


To identify the highest broadcaster on the network, follow these steps:

1.	From the Capture menu, choose the Start option.

Network Monitor begins to capture data.

2.	In the Station Statistics pane (the lowest pane on the screen), double-click on the Broadcasts Sent column header.

 If you want to, you can also:

 Identify the highest multicaster on the network.


The following topics explain common capturing tasks.

  What do you want to do?

   To identify the highest broadcaster on the network

   To identify the highest multicaster on the network

   To minimize the number of frames that Network Monitor drops

   To monitor traffic between two computers

   To create an address list


The following topics explain common tasks that you can perform in the Frame Viewer window.

 What do you want to do?

  Search for frame properties

  Expand or collapse details on a frame


The following topics explain things you can do with Microsoft Network Monitor's Remote Administration capability.

  What do you want to do?

  To use the Network Monitor agent on a remote computer


The following topics explain some of the ways that you can customize your Microsoft Network Monitor display. What do you want to do?

  What do you want to do?

  Color-code protocols in the Frame Viewer window

  Hide or Display the Toolbar


After starting the remote agent on the computer you want to use as a remote capturing site, you must connect to the remote agent, then start capturing.

To use the Network Monitor Agent on a remote computer, follow these steps:

1.	From the Capture menu, select Networks to display the Network Information dialog box.

2.	 In the Network Information dialog box, select the name of the connection that you want to use.

3.	Choose Setup to display the Connect to Network Monitoring Agent dialog box.

4.	In the Agent Name box, specify the name of the agent to which youre connecting.

5.	In the User Comment box, associate a comment with the Agent Name.

This comment is displayed to users who attempt to connect to the remote agent that you are using. Also, it is displayed for you when you attempt to reconnect to this agent.

6.	In the Agent Status Update frequency, specify the frequency, in seconds, that you want the statistics from the remote capture displayed on your local computer.

7.	If you have a very slow connection (2400 baud or less), use the Slow Link option. This option extends the period of time that your connection can be idle before Network Monitor concludes that something has gone wrong with the connection.

8.	Choose OK to disply the Seclected Agent Network Card dialog box. This box displays the network cards available on the remote computer.

9.	In this box, select the network card you want to use , then choose OK.

10.	To begin capturing, select Start from the Capture menu. Or, press F8.

Network Monitor begins capturing on the remote computer and displays capture statistics on your local computer at the interval that you have specified.


The following topics explain some of the ways that you print the information displayed in the Microsoft Network Monitor Frame Viewer window.

  What do you want to do?

  Design a Print Filter


To design a print filter, follow these steps:

1.	Display a capture or capture file in the Frame Viewer window.

2.	From the File menu, choose Print.

The Print dialog box appears.

3.	Choose the Advanced button.

The Print dialog box expands to display advanced printing options. By default, the Apply Display Filter box is checked.

4.	Choose Edit Filter from the Advanced portion of the Print dialog box.

The Edit Display Filter dialog box appears.

5.	When you have finished editing the Display filter, choose OK.

The Print dialog box reappears.

6.	Choose OK.

Microsoft Network Monitor prints the contents of the currently active display window, applying the current display filter to the windows contents.


To color code a protocol, follow these steps:

1.	Display a capture or a capture file (.CAP) in the Frame Viewer window.

2.	From the Display menu, choose Colors to display the Protocol Colors dialog box.

3.	In the Protocols box, highlight the protocol for which you want to specify a color.

4.	From the Foreground box, select the color you want for the lettering of the text.

5.	From the Background box, select the color you want for the background.

6.	If you want the color selection you're making to be applied every time you use Network Monitor, choose Save as Default.

7.	Choose OK.


To minimize the number of frames dropped, follow these steps:

1.	From the Capture menu, select Dedicated Capture Mode.

2.	Select Start from the Capture menu.


Capturing information from the network

	You can use Microsoft Network Monitor to capture frames from your network. When frames are captured, they are copied to a buffer, a reserved storage area in memory, and are represented graphically on your screen.  By default, Network Monitor captures all the frames it detects on your network. To single out a specific subset of frames that you want to capture, design a capture filter. For example, you might use a capture filter to specify that you want to capture only the frames sent between two workstations that you specify.


Displaying captured information

Once frames have been copied to Network Monitor's capture buffer, or saved to a file, they can be displayed in the Frame Viewer window. To view only a subset of the frames that have been captured, you can design a display filter.

The Frame Viewer window is designed to enable you to view the contents of a captured frame, including its source address, destination address, and the protocols that were used to send it.

You can also retransmit capture frames onto the network to test your network's resources, or to reproduce a network problem.


Remotely administer Network Monitor on a remote workstation

	Use Network Monitor's remote administration capability to: Start Network Monitor on a remote workstation and display the capture statistics on your local workstation at intervals that you specify. Start multiple instances of Network Monitor on your workstation, and have them display statistics from multiple agents.


Using Filters

	By default, Network Monitor captures all the frames that it detects and displays all the frames that it captures. To single out a specific subset of data, you can use filters, which function like database queries to locate the information you specify. When you design a capture filter, Network Monitor captures only the frames that you specify. When you design a display filter, Network Monitor displays only a subset of the captured frames.


Transmitting Frames

	Think of transmitting as the opposite of capturing. When frames are captured, they are copied from the network into Network Monitor's capture buffer. Sometimes, to test the strength of your network, or to reproduce a network problem, you may need to re-transmit these frames onto the network.. From the Frame Viewer window, you can retransmit one frame, a range of frames, or an entire capture.


You can expand or collapse details on the frames displayed in the Detail pane of the Frame Viewer window. If a frame has a plus sign next to it, it is collapsed and can be expanded. If a frame has a minus icon next to it, it is expanded and can be collapsed.

To expand or collapse details on a frame, perform the following steps:

1.	Display frames in the Frame Viewer window.

2.	In the Details pane of the Frame Viewer window, do this:

To expand a header that is collapsed, double-click on the plus icon that appears next to it.

To collapse a header that is expanded, double-click on the minus icon that appears next to it.


To hide the toolbar

From the Options menu, choose Show Toolbar if a check mark appears next to the command name.

To display the toolbar

From the Options menu, choose Show Toolbar.