Reducing Netmon trace file size via capturing only a single port using a capture filter

  • Article

This is a handy tip to reduce the file size of your Netmon traces. This is particularlly useful when you need to leave the trace running for an extended period of time. Thanks go to my collegue Andreja Rusjakovski for this tip...

Just before starting the trace go to Capture->Filter->Load button and select a *.cf file. An example of the contents of the .cf file for a Port 80 only trace is as follows. Note, to capture a different port substitue the "0050" for a different value (ie "0050" is hexadecimal for decimal 80).

[CAPTURE FILTER]
VERSION=2
[SAPS ETYPES]
SAPS=1
ETYPES=1
[ADDRESSES]
NLINES=0
[ANDEXP1]
PATTERN1=0, 22, 2,0050
PATTERN2=0, 24, 2,0050