Unlike System Monitor, which is used to monitor anything from hardware to software, Network Monitor focuses exclusively on network activity. Network Monitor allows you to view network activity and detect problems on a network. For example, you can use Network Monitor to diagnose hardware and software problems when two or more computers cannot communicate. You can also copy a log of network activity into a file and then send the file to a professional network analyst or support organization. Network application developers can use Network Monitor to monitor and debug network applications as they are developed.
After this lesson, you will be able to
Estimated lesson time: 35 minutes
Network Monitor tracks network throughput in terms of captured network traffic. Network Monitor monitors traffic only on the local network segment. To monitor remote traffic, you must use the version of Network Monitor that ships with Microsoft Systems Management Server (SMS) version 1.2 or 2.0.
Network Monitor monitors the network data stream, which consists of all information transferred over a network at any given time. Before transmission, this information is divided by the network software into smaller pieces, called frames or packets. Each frame contains the following information:
The process by which Network Monitor copies frames is referred to as capturing. You can use Network Monitor to capture all local network traffic or you can single out a subset of frames to be captured. You can also make a capture respond to events on your network. For example, you can make the network start an executable file when Network Monitor detects a particular set of conditions on the network. This is similar to the system Alerts feature in the Performance Logs And Alerts snap-in.
After you have captured data, you can view it in the Network Monitor user interface. Network Monitor does much of the data analysis for you by translating the raw capture data into its logical frame structure.
For security, Windows 2000 Network Monitor captures only those frames, including broadcast and multicast frames, sent to or from the local computer. Network Monitor also displays overall network segment statistics for broadcast frames, multicast frames, network use, total bytes received per second, and total frames received per second.
To help protect your network from unauthorized use of Network Monitor installations, Network Monitor detects other installations of Network Monitor that are running on the local segment of your network. Network Monitor also detects all instances of the Network Monitor driver being used remotely (by either Network Monitor from SMS or the Network Segment object in System Monitor) to capture data on your network.
When Network Monitor detects other Network Monitor installations running on the network, it displays the following information:
In some instances, your network architecture might prevent one installation of Network Monitor from detecting another. For example, if an installation is separated from yours by a router that does not forward multicasts, your installation cannot detect that installation.
Network Monitor uses a network driver interface specification (NDIS) feature to copy all frames it detects to its capture buffer, a resizable storage area in memory. The default size is 1 MB; however, you can adjust the size manually as needed. The buffer is a memory-mapped file and occupies disk space.
Because Network Monitor uses the Local-only mode of NDIS instead of Promiscuous mode (in which the network adapter passes on all frames sent on the network), you can use Network Monitor even if your network adapter does not support Promiscuous mode. Networking performance is not affected when you use an NDIS driver to capture frames. (Putting the network adapter in Promiscuous mode can add 30 percent or more to the load on the CPU.)
Network Monitor Tools include both the Network Monitor console and the Network Monitor driver. These tools are not installed by default on Windows 2000 Server. You can install them from the Control Panel Add/Remove Windows Programs application. From the Add/Remove Programs window, choose Add/Remove Windows Components and from the Windows Components wizard that appears, choose Management And Monitoring Tools. The Management And Monitoring Tools item contains Network Monitor Tools. Once installed, the Network Monitor console appears in the Administrative Tools program group and Network Monitor Driver is listed in the Local Area Connection Properties dialog box.
To capture frame data, Network Monitor and the Network Monitor driver must be installed on your Windows 2000 computer. The Network Monitor driver (also called the Network Monitor agent) enables Network Monitor to receive frames from a network adapter and allows the Network Monitor provided with SMS to capture and display frames from a remote computer, including those with a dial-up network connection. When the user of a computer running SMS Network Monitor connects remotely to a computer on which the Network Monitor driver has been installed, and that user initiates a capture, network statistics are captured locally on the computer running the network monitor driver and the data from the capture is viewed from the managing computer.
Network Monitor drivers for other Windows operating systems other than Windows 2000 are provided with SMS. When you install Network Monitor on a Windows 2000 computer, the Network Monitor driver is automatically installed.
To capture data, open Network Monitor and select Start from the Capture menu. As frames are captured from the network, statistics about the frames are displayed in the Network Monitor Capture window, as shown in Figure 26.6.
Figure 26.6 Capture window of the Network Monitor interface
Network Monitor displays session statistics from the first 100 unique network sessions it detects. To reset statistics and see information on the next 100 network sessions detected, select Clear Statistics from the Capture menu.
A capture filter functions like a database query. You can use it to specify the types of network information you want to monitor. For example, to see only a specific subset of computers or protocols, you can create an address database, use the database to add addresses to your filter, and then save the filter to a file. By filtering frames, you save both buffer resources and time. Later, if necessary, you can load the capture filter file and use the filter again.
To design a capture filter, specify decision statements in the Capture Filter dialog box (Figure 26.7).
Figure 26.7 Capture Filter dialog box
To open the Capture Filter dialog box, select Filter from the Capture menu, click the funnel toolbar icon (Figure 26.7), or press F8. The dialog box displays the filter's decision tree, which is a graphical representation of a filter's logic. When you include or exclude information from your capture specifications, the decision tree reflects these specifications.
Filtering by Protocol
To capture frames that use a specific protocol, specify the protocol on the SAP/ETYPE= line of the capture filter. For example, to capture only IP frames, disable all protocols and then enable IP ETYPE 0x800 and IP SAP 0x6. By default, all the protocols that Network Monitor supports are enabled.
Filtering by Address
To capture frames from specific computers on your network, specify one or more address pairs in a capture filter. You can monitor up to four specific address pairs simultaneously.
An address pair consists of the following:
Regardless of the sequence in which statements appear in the Capture Filter dialog box, EXCLUDE statements are evaluated first. Therefore, if a frame meets the criteria specified in an EXCLUDE statement in a filter containing both an EXCLUDE statement and an INCLUDE statement, that frame is discarded. Network Monitor does not test that frame by INCLUDE statements to see if it also meets that criterion.
Filtering by Data Pattern
By specifying a pattern match in a capture filter, you can do the following:
When you filter based on a pattern match at a specific point in the data, you must specify where the pattern occurs in the frame (how many bytes from the beginning or end). If your network medium uses variable-sized frames, specify to begin counting in for a pattern match from the end of the topology header.
To simplify data analysis, Network Monitor interprets raw data collected during the capture and displays it in the Capture window. To display captured information in the Capture window, click Stop And View on the Capture menu while the capture is running. You can also display the Capture window by opening a file with the .cap extension. If you have stopped a capture, you can view the data in the Capture window by selecting Display Captured Data from the Capture menu, clicking the glasses toolbar icon, or pressing F12.
Figure 26.8 shows the key elements in the Capture window.
Figure 26.8 Capture window in Network Monitor
You can use a display filter to determine which frames to display. Like a capture filter, a display filter functions like a database query, allowing you to single out specific types of information. But because a display filter operates on data that has already been captured, it does not affect the contents of the Network Monitor capture buffer.
You can filter a frame using the following information:
The capture window must have the focus in Network Monitor for the Display Filter dialog box to appear. Figure 26.9 shows the Display Filter dialog box, which is accessed from the Display menu, by pressing F8, or by clicking the funnel toolbar icon.
Figure 26.9 Display Filter dialog box
To design a display filter, specify decision statements in the Display Filter dialog box. Information in the Display Filter dialog box is in the form of a decision tree, which is a graphical representation of a filter's logic. When you modify display filter specifications, the decision tree reflects these modifications. You must click OK to save the specified decision statement and add it to the decision tree before adding another decision statement.
Although capture filters are limited to four address filter expressions, display filters are not. With display filters, you can also use AND, OR, and NOT logic. When you display captured data, all available information about the captured frames appears in the Frame Viewer window. To display only those frames sent by a specific protocol, edit the Protocol line in the Display Filter dialog box.
Protocol properties are information that defines a protocol's purpose. Because the purpose of protocols varies, properties differ from one protocol to another. Suppose, for example, that you have captured a large number of frames that use the Server Message Block (SMB) protocol but you want to examine only those frames in which the SMB protocol was used to create a directory on your computer. In this instance, you can single out frames where the SMB command property is equal to the Make Directory command.
When you display captured data, all addresses from which information was captured appear in the Frame Viewer window. To display only those frames originating from a specific computer, edit the ANY < - > ANY line in the Display Filter dialog box.
Network Monitor creates a memory-mapped file for its capture buffer. For best results, make sure you create a capture buffer large enough to accommodate the traffic you need.
In addition, although you cannot adjust the frame size, you can store only part of the frame, thereby reducing the amount of wasted capture buffer space. For example, if you are interested only in the data in the frame header, set the frame size (in bytes) to the size of the header frame. Network Monitor discards the frame data as it stores frames in the capture buffer, thereby using less capture buffer space.
Running Network Monitor in the background is a way to reduce the amount of system resources necessary to operate the program. To run Network Monitor in the background, choose Dedicated Capture Mode from the Capture menu. This is one strategy to reduce resource use if network packets are being dropped rather than captured.
In this lesson you learned that Network Monitor allows you to view and detect problems on networks. It tracks network throughput in terms of captured network traffic. Network Monitor monitors the network data stream on the local segment, which consists of all information transferred over the network segment at any given time. To capture frame data, Network Monitor and the Network Monitor driver must be installed on your Windows 2000 computer. The Network Monitor driver enables Network Monitor to receive frames from a network adapter. A capture filter functions like a database query. You can use it to specify the types of network information you want to monitor. To simplify data analysis, Network Monitor interprets raw data collected during the capture and displays it in the Frame Viewer window. You can use a display filter to specify what information you want to view in the Frame Viewer window. Like a capture filter, a display filter functions like a database query, allowing you to single out specific types of information.