Managing Network Monitor from the command line
Updated: January 21, 2005
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Managing Network Monitor from the command line
By using the start netmon command, you can start the Network Monitor user interface from the command line. You can also specify parameters for capturing and filtering frames from network traffic going to and coming from the computer on which you have Network Monitor installed.
Syntax
start netmon [/net Number] [/capturefilter Path] [/displayfilter Path] [/buffersize Number] [/quickfilter {ATM | ETHERNET | IP | IPX | VINES | TOKENRING | FDDI}, Address] [/quickfiltername FilterName] [/autostart] [/autostop]
Parameters
- /net Number
- Specifies the number of the network from which you want to capture frames. You can specify any of the network segments to which your computer is connected.
- /capturefilter Path
- Specifies a capture filter to be used when Network Monitor starts. You can abbreviate /capturefilter as /cf.
- /displayfilter Path
- Specifies a display filter to be used when Network Monitor starts. You can abbreviate /displayfilter as /df.
- /buffersize: Number
- Specifies the size (in megabytes) of the capture buffer.
- /quickfilter{ ATM| ETHERNET| IP| IPX| VINES| TOKENRING| FDDI} , Address
- Specifies that Network Monitor should capture frames only of a particular type and from a particular address. You can specify up to three types at a time. You can abbreviate /quickfilter as /qf. The IPX/SPX protocol is not available on Windows XP 64-bit Edition (Itanium) and the 64-bit versions of the Windows Server 2003 family.
- /quickfiltername FilterName
- Specifies the name of the filter that you describe with the /quickfilter command. This parameter is ignored if you do not specify any /quickfilter options. You can abbreviate /quickfiltername as /qfn.
- /autostart
- Specifies that Network Monitor should begin to capture data at interface startup.
- /autostop
- Specifies that Network Monitor should stop capturing data when the capture buffer is full.
- /?
- Displays help at the command prompt.
Remarks
-
Network Monitor is not installed by default. To use this command, you must have installed Network Monitor on your computer, and you must run the command from the directory where Network Monitor is installed.
Examples
To set the size of your capture buffer to 4 megabytes, type:
start netmon /buffersize:4
To load a specific capture filter when you start Network Monitor, type:
start netmon /capturefilter d:\captures\http.cf
Formatting legend
| Format | Meaning |
|---|---|
|
Italic |
Information that the user must supply |
|
Bold |
Elements that the user must type exactly as shown |
|
Ellipsis (...) |
Parameter that can be repeated several times in a command line |
|
Between brackets ([]) |
Optional items |
|
Between braces ({}); choices separated by pipe (|). Example: {even|odd} |
Set of choices from which the user must choose only one |
|
|
Code or program output |

