Managing Network Monitor from the command line

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Managing Network Monitor from the command line

By using the start netmon command, you can start the Network Monitor user interface from the command line. You can also specify parameters for capturing and filtering frames from network traffic going to and coming from the computer on which you have Network Monitor installed.

Syntax

start netmon [/net Number] [/capturefilter Path] [/displayfilter Path] [/buffersize Number] [/quickfilter {ATM | ETHERNET | IP | IPX | VINES | TOKENRING | FDDI}, Address] [/quickfiltername FilterName] [/autostart] [/autostop]

Parameters
  • /net Number
    Specifies the number of the network from which you want to capture frames. You can specify any of the network segments to which your computer is connected.
  • /capturefilter Path
    Specifies a capture filter to be used when Network Monitor starts. You can abbreviate /capturefilter as /cf.
  • /displayfilter Path
    Specifies a display filter to be used when Network Monitor starts. You can abbreviate /displayfilter as /df.
  • /buffersize: Number
    Specifies the size (in megabytes) of the capture buffer.
  • /quickfilter{ ATM| ETHERNET| IP| IPX| VINES| TOKENRING| FDDI} , Address
    Specifies that Network Monitor should capture frames only of a particular type and from a particular address. You can specify up to three types at a time. You can abbreviate /quickfilter as /qf. The IPX/SPX protocol is not available on Windows XP 64-bit Edition (Itanium) and the 64-bit versions of the Windows Server 2003 family.
  • /quickfiltername FilterName
    Specifies the name of the filter that you describe with the /quickfilter command. This parameter is ignored if you do not specify any /quickfilter options. You can abbreviate /quickfiltername as /qfn.
  • /autostart
    Specifies that Network Monitor should begin to capture data at interface startup.
  • /autostop
    Specifies that Network Monitor should stop capturing data when the capture buffer is full.
  • /?
    Displays help at the command prompt.
Remarks
  • Network Monitor is not installed by default. To use this command, you must have installed Network Monitor on your computer, and you must run the command from the directory where Network Monitor is installed.
Examples

To set the size of your capture buffer to 4 megabytes, type:

start netmon /buffersize:4

To load a specific capture filter when you start Network Monitor, type:

start netmon /capturefilter d:\captures\http.cf

Formatting legend

Format Meaning

Italic

Information that the user must supply

Bold

Elements that the user must type exactly as shown

Ellipsis (...)

Parameter that can be repeated several times in a command line

Between brackets ([])

Optional items

Between braces ({}); choices separated by pipe (|). Example: {even|odd}

Set of choices from which the user must choose only one

Courier font

Code or program output

See Also

Concepts

Install and Configure Network Monitor
Command-line reference A-Z
Command shell overview