Note to self - a blog by Lucas Canavan

Ramblings of a .NET web developer, IT generalist and advocate of the Windows Azure cloud platform

Reducing Netmon trace file size via capturing only a single port using a capture filter

Reducing Netmon trace file size via capturing only a single port using a capture filter

  • Comments 1

This is a handy tip to reduce the file size of your Netmon traces.  This is particularlly useful when you need to leave the trace running for an extended period of time.   Thanks go to my collegue Andreja Rusjakovski for this tip...

Just before starting the trace go to Capture->Filter->Load button and select a *.cf file.  An example of the contents of the .cf file for a Port 80 only trace is as follows.  Note, to capture a different port substitue the "0050" for a different value (ie "0050" is hexadecimal for decimal 80).

[CAPTURE FILTER]
VERSION=2
[SAPS ETYPES]
SAPS=1
ETYPES=1
[ADDRESSES]
NLINES=0
[ANDEXP1]
PATTERN1=0, 22, 2,0050
PATTERN2=0, 24, 2,0050

Leave a Comment
  • Please add 5 and 6 and type the answer here:
  • Post
Page 1 of 1 (1 items)