Network Monitor Conversation Filtering
Data Fields:
We will consider Conversation members as properties because data fields represent data on the wire for a frame.
Properties:
To avoid name collisions, each field should be prefaced by "Conversation.". To save space, we've left this out in the Field column.
| Property | Description | Example |
| ProcessName | The process associated with the current frame. This is collected when Network Monitor 3.4 is used to capture a trace. If using NMCAP, you need to add the /CaptureProcesses. |
ProcessName.Contains("iexpl") |
| ProcessID | The process ID associated with the current frame. This is collected when Network Monitor 3.4 is used to capture a trace. If using NMCAP, you need to add the /CaptureProcesses. |
ProcessID == 1234 |