Sign in
Microsoft.com
 
Resources for IT Professionals
 
 
 
Resources for IT Professionals > Forums Home > Windows Tools Forums > Network Monitor > How to specify filters in NMcap
Ask a questionAsk a question
Search Forums:
 

AnswerHow to specify filters in NMcap

  • Tuesday, October 20, 2009 2:14 PMIsotonic Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    As in "How to reduce # of lost packets using Net mon 3.3; performance" I type command

    NMCap /network * /capture 'TCP and (ContainsBin(FrameData, 2, "4C 00"))' /file out.cap:500M /DisableConversations

    but I get error:
    Error: '/Capture' - Invalid parameter ''TCP and (ContainsBin(FrameData, 2, 4C 00))''

    And it repeates in any other cases when I try to specify any filter on all computers where I try.
    Where is a mistake?
     

Answers

  • Tuesday, October 20, 2009 2:22 PMPaul E LongMSFT, OwnerUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    1
    Sign In to Vote
    For some reason, you can't use the single quotes around the double quotes.  However, the other way works fine.

    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, '4C 00'))" /file out.cap:500M /DisableConversations

    You can also escape the double quotes inside as in


    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, \"4C 00\"))" /file out.cap:500M /DisableConversations

    Hope that helps,

    Paul
    • Marked As Answer byIsotonic Tuesday, October 20, 2009 3:21 PM
    •  
     

All Replies

  • Tuesday, October 20, 2009 2:22 PMPaul E LongMSFT, OwnerUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    1
    Sign In to Vote
    For some reason, you can't use the single quotes around the double quotes.  However, the other way works fine.

    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, '4C 00'))" /file out.cap:500M /DisableConversations

    You can also escape the double quotes inside as in


    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, \"4C 00\"))" /file out.cap:500M /DisableConversations

    Hope that helps,

    Paul
    • Marked As Answer byIsotonic Tuesday, October 20, 2009 3:21 PM
    •