Netcap Syntax

Updated: March 28, 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

NetCap Syntax

NetCap uses the following syntax:

Art Image netcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/l: HH:MM:SS] [/tcf: FolderName] [/remove]


/b: Number
Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 (MB).

/t Type Buffer HexadecimalOffset HexadecimalPattern
Specifies the use of a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t N option continues to capture until the spacebar is pressed, using the buffer as a queue. If the buffer becomes full Netcap will overwrite the oldest entries.

B = Buffer

P = Pattern

BP = Buffer then pattern

PB = Pattern then buffer

N = No trigger

Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.

Hexadecimal offset from start of frame. Used with P, BP, PB, but not B.

Hexadecimal pattern to match. Used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.

/f: FilterFile
Specifies a filter to use during the capture. A filter file is created using Network Monitor in versions 2.x and after. A filter file has a .cf extension.

/c: CapturePath
Specifies a location where Netcap will move the temporary capture files. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.

/n: Number
Specifies which network adapter to capture from, based on the network adapter index number. Run Netcap with the /? parameter to assign index numbers to the network adapters on the computer.

/l: HH:MM:SS
Specifies how long the capture will last in hours, minutes, and seconds (maximum = 99:99:99).


  • This option overrides the default 100 percent trigger, unless /t Type is also specified.

/tcf: FolderName
Sets the location where the temporary capture files are stored. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.

Removes the NetCap instance of the Network Monitor Driver.


See Also

Community Additions