Freigeben über

Reducing Netmon trace file size via capturing only a single port using a capture filter

  • Artikel

This is a handy tip to reduce the file size of your Netmon traces. This is particularlly useful when you need to leave the trace running for an extended period of time. Thanks go to my collegue Andreja Rusjakovski for this tip...

Just before starting the trace go to Capture->Filter->Load button and select a *.cf file. An example of the contents of the .cf file for a Port 80 only trace is as follows. Note, to capture a different port substitue the "0050" for a different value (ie "0050" is hexadecimal for decimal 80).

[CAPTURE FILTER]
VERSION=2
[SAPS ETYPES]
SAPS=1
ETYPES=1
[ADDRESSES]
NLINES=0
[ANDEXP1]
PATTERN1=0, 22, 2,0050
PATTERN2=0, 24, 2,0050

Comments

  • Anonymous
    August 15, 2007
    I've been working with a few customers lately that have been experiencing this WebException that has