How to Filter on TCP Header Information Using Microsoft Network Monitor

Article translations Article translations
Article ID: 231920 - View products that this article applies to.
This article was previously published under Q231920
Expand all | Collapse all

SUMMARY

This article describes how to apply filters in Microsoft Network Monitor to view Transmission Control Protocol (TCP) header information in the Capture Summary window.

MORE INFORMATION

When you view a capture using Network Monitor, the "Last Protocol In Frame" is displayed in the Capture Summary window by default. This is true even when you apply filters to view only TCP information. Therefore, a frame that contains Server Message Blocks (SMBs) shows SMB summary information. For example:
SMB C write spool file, FID = 0xc005, Write 48 bytes
				
To view the TCP header information, you need to open the frame.

In the following example, several protocols are actually a part of the entire frame:
+FRAME: Base frame properties
+ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
+IP: ID = 0x7DEC; Proto = TCP; Len: 132
+TCP: .AP..., len:   92, seq: 175699528-175699619, ack: 227842390, win:16500, src: 3221  dst:  139 (NBT Session) 
+NBT: SS: Session Message, Len: 88
+SMB: C write spool file, FID = 0xc005, Write 48 bytes
				
When viewing a TCP trace, it is more convenient to have the TCP information displayed in the Capture Summary window. This lets you view the TCP header information without having to open the frame.

Use the following steps to view TCP header information in the Capture Summary window:
  1. On the Display menu in the Capture Summary window, click Filter (or press F8).
  2. In the Display Filter window, double-click Protocol==Any.
  3. Click Disable All.
  4. In the Disabled Protocols box, click TCP, click Enable, click OK, and then click OK.
  5. On the Display menu in the Capture Summary window, click Options.
  6. Click Auto (Based on protocols in display filter), and then click OK.
The following example shows the TCP information as viewed in the Capture Summary window after you perform these steps:
TCP .AP..., len:   92, seq: 175699528-175699619, ack: 227842390, win:16500, src: 3221  dst:  139 (NBT Session)
				

Properties

Article ID: 231920 - Last Review: January 24, 2007 - Revision: 2.3
APPLIES TO
  • Microsoft Windows NT Advanced Server 3.1
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT 4.0 Service Pack 1
  • Microsoft Windows NT 4.0 Service Pack 2
  • Microsoft Windows NT 4.0 Service Pack 3
  • Microsoft Windows NT 4.0 Service Pack 4
  • Microsoft Windows NT Workstation 3.1
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows 3.11 Standard Edition
  • Microsoft Windows 95
  • Microsoft Windows 98 Standard Edition
  • Microsoft Windows 98 Second Edition
Keywords: 
kbinfo kbnetwork KB231920

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com