Setting Filter to Capture View Only Browser Frames in Network Monitor

This article describes how to set a capture filter to view only browser frames in Network Monitor.

When you are troubleshooting browsing-related problems, a network trace may help. Because browser traffic is somewhat infrequent, however, the trace may need to run for an extended period of time to gather enough data for analysis. Some browser information is sent only every 15 minutes, making it difficult to capture those packets. Depending on network usage, a Network Monitor trace can quickly become very large (many megabytes).

You can configure Network Monitor to capture only browser frames by using a pattern match to identify these frames. This significantly reduces the size of the capture. To set a capture filter in Network Monitor to capture only browser packets:

1. On the Capture menu, click Filter.
2. Double-click Pattern Matches.
3. In the Offset box, type cb. Click From Start of Frame.
4. In the Pattern box, type 4252. Click Hex.
5. Click OK.
6. Click OK.
7. Start the capture.

For more information about using Network Monitor, see the Network Monitor Help file in the "Systems Management Server Administrator's Guide."