Monitoring Network Traffic

Network Monitor is an administrative tool that lets you monitor network traffic as it crosses the wire. Protocol parsers built in to the tool organize traffic into packets for ease of analysis and give you information you can use to track down problems with network applications, misconfigured workstations, and unnecessary protocols installed on workstations, printers, and servers. Network Monitor's features include display filters, which can help you locate specific information in large network traces; capture filters, which can narrow down the information the tool captures; and triggers, which let you tell your system to take a certain action based upon a packet's contents.

Network Monitor for Windows 2000 comes in two versions: a lite version, which ships with Win2K, and a full version, which is part of Systems Management Server (SMS) 2.0 and which you can also install on Windows NT 4.0. The lite version monitors only local traffic. The full version captures all traffic on the network and, when you connect to another server or workstation on which you've installed the Network Monitor driver, lets you monitor remote systems. The Network Monitor driver ships with Win2K and doesn't require installation of SMS. To use the full version of Network Monitor without installing SMS, execute the setup.exe program from the \nmext directory on the Microsoft Systems Management Server 2.0 CD-ROM.

Manually Capturing Traffic
To start Network Monitor, go to Start, Programs, Administrative Tools, Network Monitor. To run the tool, you first need to select a network to enable the Capture menu (if your machine has only one network card, the Capture menu will already be enabled).

Before you begin a capture, you should check the buffer configuration. Select Buffer Settings from the Capture menu to display the Capture Buffer Settings dialog box. By default, the maximum capture buffer size that Win2K allows is 1GB; NT's default maximum buffer size is 8MB less than the amount of RAM installed on the machine.

Although you can use virtual memory for the capture buffer, doing so can cause your capture not to include crucial frame information. To determine the maximum reliable buffer setting, use Task Manager to check the available physical memory, then don't exceed that size. For impromptu network sniffing, I typically use a 4MB capture buffer—large enough to give me a good deal of information but small enough to zip into a reasonably sized email attachment.

The Capture Buffer Settings dialog box also lets you select the size of the frames you want to capture. You can use this capability to prevent capturing extraneous frame data and wasting space. How much of the frame you decide to capture depends on the particular protocol you're investigating. For example, you can set a frame size of 14 bytes to capture only Ethernet headers. A 14-byte frame size lets you capture 73,142 frames in a 1MB capture buffer. To capture IP headers, you'd use a 34-byte frame size—14 bytes for the Ethernet header plus 20 bytes for the IP header. Tailoring the frame size is an especially useful technique for investigating problems with file transfers, which often generate frames that contain 1200 bytes or more of user data and quickly fill up your capture buffer.

To start a manual capture, simply select Start from the Capture menu. Alternatively, you can press F10 or click the Record button on Network Monitor's toolbar. Network Monitor will immediately begin capturing frames and will continue to do so until you stop the capture or until the buffer fills up.

Working with a Data Set
After you've captured data, select Display Captured Data from the Capture menu to display the captured data set. Figure 1 shows a sample display. The summary (top) pane contains the following columns, which you can rearrange by dragging a column head to a new location:

• Frame—the number Network Monitor assigns to the frame for tracking purposes.
• Time—the time of day, the number of seconds since the beginning of the capture, or the number of seconds since the previous frame. To configure which of these three options Network Monitor displays, select Options from the Display menu. I prefer to display the time of day so that I can match the captured information to events in the Windows event log.
• Src MAC Addr—the source media access control (MAC) address of the device that generated the frame. You can select Show Address Names or Show Vendor Names from the Options menu to display the name assigned to the MAC address in the Network Monitor address book or the vendor name associated with the first 6 bytes of the MAC address, respectively. (This option affects the display of all addresses in the capture file.) The Show Vendor Name option can be helpful if you're trying to find an unknown device on the network.
• Dst MAC Addr—the name assigned to the MAC address of the packet's destination device.
• Protocol—the main (i.e., highest-level) protocol in the frame.
• Description—summary information about the frame. The Description column often contains enough information for you to follow what happened in the capture session. You can easily spot the TCP three-way handshake from the description; TCP flag information also shows up in this column. From Display, Options, you can configure this column to display Last protocol in frame or Auto (Based on protocols in display filter). If you choose the last-protocol option, the Protocol column will contain the highest-level protocol in the frame. For example, for a TCP/IP frame that contains Ethernet, IP, and TCP protocols, the last-protocol option displays TCP in the Protocol column. If you select Auto and you've configured a display filter to show only IP-based traffic, the Protocol column will display IP for the same TCP/IP frame. In most cases, you can obtain the most useful information by selecting Last protocol in frame.
• Src Other Addr—the other protocol address that the frame contains. For example, if you're on an IP-based network, this column contains the IP address that matches the MAC address listed in the Src MAC Addr column. (To see the Src Other Addr column and those that follow, you might need to move the scroll bar at the bottom of the summary pane.)
• Dst Other Addr—the other protocol address that the frame for the destination machine contains.
• Type Other Addr—the protocol that the Src Other Addr and Dst Other Addr fields refer to.

The middle pane in the Network Monitor window is the detail pane. You can toggle this pane on or off by clicking the Toggle Detail Pane button in Network Monitor's toolbar. (The Toggle Detail Pane button is the second of the three pane-toggle buttons, which appear as a group above the Src MAC Addr column in Figure 1.) In this pane, Network Monitor provides detailed information that it obtains by parsing protocols.

To parse protocols, Network Monitor uses .dll files and .ini files, which it stores in the parser directory (by default, this directory is \winnt\system32\netmonfull\ parsers for the SMS version of Network Monitor and \winnt\system32\netmon\ parsers for the lite version). As shipped, Network Monitor can parse 40 protocols, including new ones such as Layer 2 Tunneling Protocol (L2TP). If you want to analyze protocols that Network Monitor doesn't understand (e.g., ICA), you need to either write or buy additional parser .dll and .ini files.

The hexadecimal (bottom) pane in the Network Monitor window provides specific information about the frame in the detail pane. If you understand how to read the hex trace, you can create very specific custom capture filters, as I explain later. To toggle this pane on and off, click the Toggle Hex Pane button in the toolbar.

   Previous  [1]  2  3  Next