Display filters can be created to locate specific types of traffic from a capture. Capture filters can be created to specify the type of information to capture.
Triggers enable certain actions to be performed based on the content of a packet.
When the criteria of a trigger is met, any of the following actions can be configured to occur: the computer can beep, Network Monitor will stop capturing frames , and a command-line program can be executed.
The network monitor driver captures the frames coming to and going from a network adapter. The Network Monitor tool is used to view the captured information.
To prevent unauthorized users from running it, when Network Monitor starts up, it can detect other instances on the network and display information such as the computer name , where the instance is installed, and who is currently logged onto the computer.
Capture filters can be created using the following criteria: protocol, address pairs, and pattern matches.
System Monitor can be used to monitor the real-time performance of the local computer or another computer on the network.
The capability to control which users can view data using the Performance Log Users and Performance Monitor Users groups is a new feature in Windows Server 2003.
Windows Server 2003 supports four service recovery actions: take no action, restart the service, run a program, and restart the computer.
Task Manager is used to view information about the local computer, such as the applications and processes currently running.
System Information is a utility that provides configuration information about a local or remote computer.
Event Viewer is used to view the contents of the event log files.
Every computer running Windows Server 2003 has at least three log files by default: Application, Security, and System.
Shutdown Event Tracker is used to monitor why users shutdown and restart their computers.
