Cannot Capture Outbound Frames with Network Monitor 2 on a Token Ring Network

You may not be able to use Network Monitor version 2 to capture outbound frames from the local computer on your Token Ring network. This problem exists because of the following conditions:

• Network Monitor 2 cannot force a network adapter into Promiscuous mode.
• Some Token Ring network adapters must be forced into Promiscuous mode to allow the capturing of local outbound traffic.

The ForcePmode (Force Promiscuous Mode) registry setting was removed from Network Monitor 2.

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: The English version of this fix for Service Pack 2 should have the following file attributes or later: The English version of this fix for Service Pack 3 should have the following file attributes or later:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

How to Edit the Registry to Force Promiscuous Mode

1. Check the Monitor Control tool to determine the permanent Media Access Control (MAC) address for the network adapter.
2. In Registry Editor (RegEdt32.exe), locate and click the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nm\Parameters
3. On the Edit menu, click Add Key.
4. In the Key Name box, type ForcePmode, and then click OK.
5. Click the ForcePmode key in the left pane.
6. On the Edit menu, click Add Value.
7. In the Value Name box, type the MAC address (from step 1), and then click OK.
8. In the String Editor dialog box, type 1.
9. On the Registry menu, click Exit.
10. Restart the Monitor Control tool and reconfigure Security Monitor.

The next time that Network Monitor or the Monitor Control service runs, the network adapter runs in Promiscuous mode.

How to Stop Forcing Promiscuous Mode

1. Use Registry Editor to locate and click the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nm\Parameters\ForcePmode
2. Click the string in the right pane.
3. On the Edit menu, click String.
4. In the String Editor dialog box, remove all text (so that the value is null).
5. On the Registry menu, click Exit.

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base: For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base: