Was this page helpful?
Additional feedback?
1500 characters remaining
Export (0) Print
Expand All

Managing Network Monitor from the command line

Updated: January 21, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Managing Network Monitor from the command line

By using the start netmon command, you can start the Network Monitor user interface from the command line. You can also specify parameters for capturing and filtering frames from network traffic going to and coming from the computer on which you have Network Monitor installed.


start netmon [/net Number] [/capturefilter Path] [/displayfilter Path] [/buffersize Number] [/quickfilter {ATM | ETHERNET | IP | IPX | VINES | TOKENRING | FDDI}, Address] [/quickfiltername FilterName] [/autostart] [/autostop]

/net Number
Specifies the number of the network from which you want to capture frames. You can specify any of the network segments to which your computer is connected.

/capturefilter Path
Specifies a capture filter to be used when Network Monitor starts. You can abbreviate /capturefilter as /cf.

/displayfilter Path
Specifies a display filter to be used when Network Monitor starts. You can abbreviate /displayfilter as /df.

/buffersize: Number
Specifies the size (in megabytes) of the capture buffer.

/quickfilter{ ATM| ETHERNET| IP| IPX| VINES| TOKENRING| FDDI} , Address
Specifies that Network Monitor should capture frames only of a particular type and from a particular address. You can specify up to three types at a time. You can abbreviate /quickfilter as /qf. The IPX/SPX protocol is not available on Windows XP 64-bit Edition (Itanium) and the 64-bit versions of the Windows Server 2003 family.

/quickfiltername FilterName
Specifies the name of the filter that you describe with the /quickfilter command. This parameter is ignored if you do not specify any /quickfilter options. You can abbreviate /quickfiltername as /qfn.

Specifies that Network Monitor should begin to capture data at interface startup.

Specifies that Network Monitor should stop capturing data when the capture buffer is full.

Displays help at the command prompt.

  • Network Monitor is not installed by default. To use this command, you must have installed Network Monitor on your computer, and you must run the command from the directory where Network Monitor is installed.


To set the size of your capture buffer to 4 megabytes, type:

start netmon /buffersize:4

To load a specific capture filter when you start Network Monitor, type:

start netmon /capturefilter d:\captures\http.cf

Formatting legend


Format Meaning


Information that the user must supply


Elements that the user must type exactly as shown

Ellipsis (...)

Parameter that can be repeated several times in a command line

Between brackets ([])

Optional items

Between braces ({}); choices separated by pipe (|). Example: {even|odd}

Set of choices from which the user must choose only one

Courier font

Code or program output

See Also

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

© 2015 Microsoft