How to Modify Network Monitor Capture Buffer Settings

Article translations Article translations
Article ID: 231947 - View products that this article applies to.
This article was previously published under Q231947
Expand all | Collapse all

SUMMARY

When you use Microsoft Network Monitor to capture network traffic, the capture buffer size must be large enough to save the desired traffic.

MORE INFORMATION

The capture buffer in Network Monitor is based on a first-in, first-out (FIFO) system, and its size is limited to 1 MB by default. Captured data is stored in RAM until you save the capture. If the data is larger than the allocated RAM, data is discarded using FIFO logic.

You can adjust the capture buffer size to as high as 120 MB. However, increasing the capture buffer to a size larger than the available memory can cause the tool to swap data to the hard disk, which may result in lost or dropped frames.

To increase the capture buffer size:
  1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
  2. On the Capture menu, click Buffer Settings.
  3. In the Buffer Size (in MB) box, type a value between 1-120, and then click OK.
Network Monitor allocates the necessary memory immediately. You can make the capture buffer larger than available memory, but the following warning message may be displayed:
The buffer size you have requested may cause frames to be dropped due to swapping. Are you sure you want to allocate a buffer of this size?
If you receive this warning message, you can decrease the capture buffer size to a value smaller than the available memory on your computer.

If you experience problems capturing data and have increased the buffer to the maximum limit, you can decrease the frame size to allow for more frames:
  1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
  2. On the Capture menu, click Buffer Settings.
  3. In the Frame Size (in bytes) box, click a value from the available frame sizes, and then click OK.
NOTE: If your troubleshooting methodology requires detailed information from each frame, you cannot use this option. An example of when this method is feasible is if you are looking only at Transmission Control Protocol (TCP) header information to analyze TCP traffic. The entire frame is not needed for just the header information.

Properties

Article ID: 231947 - Last Review: January 24, 2007 - Revision: 2.3
APPLIES TO
  • Microsoft Windows NT Server 4.0, Terminal Server Edition Service Pack 4
  • Microsoft BackOffice Server 4.0
  • Microsoft BackOffice Server 4.5
  • Microsoft BackOffice Small Business Server 4.0
  • Microsoft BackOffice Small Business Server 4.0a
  • Microsoft BackOffice Small Business Server 4.5
  • Microsoft Cluster Server 1.1
  • Microsoft Windows 3.11 Standard Edition
  • Microsoft Windows 95
  • Microsoft Windows 98 Standard Edition
  • Microsoft Windows 98 Second Edition
  • Microsoft Windows NT Advanced Server 3.1
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT 4.0 Service Pack 1
  • Microsoft Windows NT 4.0 Service Pack 2
  • Microsoft Windows NT 4.0 Service Pack 3
  • Microsoft Windows NT 4.0 Service Pack 4
  • Microsoft Windows NT Server 4.0 Enterprise Edition
  • Microsoft Windows NT 4.0 Service Pack 4
  • Microsoft Windows NT Workstation 3.1
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
Keywords: 
kberrmsg kbinfo kbnetwork KB231947

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com