Netcap Syntax

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

NetCap Syntax

NetCap uses the following syntax:

Art Imagenetcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/l: HH:MM:SS] [/tcf: FolderName] [/remove]

Parameters

  • ****/b:Number
    Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 (MB).
  • /t Type Buffer HexadecimalOffset HexadecimalPattern
    Specifies the use of a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t N option continues to capture until the spacebar is pressed, using the buffer as a queue. If the buffer becomes full Netcap will overwrite the oldest entries.
  • Type
    B = Buffer
  • P = Pattern
  • BP = Buffer then pattern
  • PB = Pattern then buffer
  • N = No trigger
  • Buffer
    Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.
  • HexadecimalOffset
    Hexadecimal offset from start of frame. Used with P, BP, PB, but not B.
  • HexadecimalPattern
    Hexadecimal pattern to match. Used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.
  • /f: FilterFile
    Specifies a filter to use during the capture. A filter file is created using Network Monitor in versions 2.x and after. A filter file has a .cf extension.
  • /c: CapturePath
    Specifies a location where Netcap will move the temporary capture files. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.
  • /n: Number
    Specifies which network adapter to capture from, based on the network adapter index number. Run Netcap with the /? parameter to assign index numbers to the network adapters on the computer.
  • /l: HH:MM:SS
    Specifies how long the capture will last in hours, minutes, and seconds (maximum = 99:99:99). Note
    • This option overrides the default 100 percent trigger, unless /t Type is also specified.
  • /tcf: FolderName
    Sets the location where the temporary capture files are stored. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.
  • /remove
    Removes the NetCap instance of the Network Monitor Driver.

Examples

See Netcap Examples

See Also

Concepts

Netcap Overview
Netcap Remarks
Netcap Examples
Alphabetical List of Tools
Spcheck Overview
Nltest Overview
Netdom Overview
Netdiag Overview
Httpcfg Overview
Dnslint Overview
Dnscmd Overview
Dhcploc Overview
Dcdiag Overview
Browstat Overview