Monitoring Dfs Activity

  • Article

You can use Network Monitor to examine Dfs activity. To do this, you have only to capture the network data and then create a display filter to analyze it.

To create a Dfs-oriented display filter in Network Monitor

  1. Start Network Monitor and view the captured file.

  2. On the Display menu, click Filter .

  3. In the Display Filter window, double-click the Protocol == Any expression.

  4. In the Expression window, click the Property tab.

  5. Locate and expand the SMB container in the left pane.
    Dfs-specific flags include DFS Server Function, DFS Server Function Flags, DFS Server Type, and DFS Servicesite GUID.

  6. Again, under SMB, highlight flags2 in the left pane and includes in the Relation fields. Values of interest include No DFS namespace and Filenames use DFS namespace .

For more information about using Network Monitor, see "Monitoring Network Performance" in Server Operations Guide .