DOCUMENT:Q152643  13-FEB-2002  [sms]
TITLE   :Netmon Does Not Capture Outbound Frames
PRODUCT :Microsoft Systems Management Server
PROD/VER::1.2
OPER/SYS:
KEYWORDS:smsnetmon kbNetworkMon

======================================================================
1.20
WINDOWS
kbnetwork

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Systems Management Server version 1.2 
-------------------------------------------------------------------------------

SUMMARY
=======

When capturing network traffic "to and from" the local computer, network Monitor
captures and displays only one-way traffic (traffic to the computer). Network
Monitor running on systems with network interface cards (NICs) that use
monolithic Ndis 4.0 drivers may exhibit this symptom.

MORE INFORMATION
================

LocalOnly is a new bit that Ndis4.0 supports. It gives Network Monitor the
ability to acquire all the network traffic that is going to and from your
computer without going into Promiscuous Mode, which is very expensive. Some
cards, which are monolithic (non-miniport) or are miniport but implement their
own loopback, indicate that they handle the LocalOnly bit, but actually they do
not.


WORKAROUND
==========

To correct this problem a registry entry needs to be added.

WARNING: Using Registry Editor incorrectly can cause serious, system-wide
problems that may require you to reinstall Windows NT to correct them. Microsoft
cannot guarantee that any problems resulting from the use of Registry Editor can
be solved. Use this tool at your own risk.

1. Run the Registry Editor.

2. From the HKEY_LOCAL_MACHINE subtree, find the key:

\SYSTEM\CurrentControlSet\Services\bh\Parameters

3. On Edit menu, choose Add Key:

   Key Name: ForcePmode

   Class: <leave blank>

4. On the Edit menu, choose Add Value.

5. Add the following:

      Value Name: EPRO1  <example>

   The value should be the same as the name in the
   \SYSTEM\CurrentControlSet\Services\bh\Linkage
   key, under the Bind Value with the leading "\Device\" stripped off.
   There are multiple cards on the same line, space delimited.

      Data Type:  REG_DWORD

      Data: 1

6. Choose OK and quit Registry Editor.

7. Shut down and restart Windows NT.

Note: This does NOT effect Netmon counters within Perfmon because pmode willbe
used.

Additional query words: prodsms 1.10 prodnt 4.00 amd

======================================================================
Keywords          : smsnetmon kbNetworkMon 
Technology        : kbSMSSearch kbSMS120
Version           : :1.2

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2002.