How to Modify Network Monitor Capture Buffer Settings (231947)


The information in this article applies to:

  • Microsoft Windows NT Server 4.0 Terminal Server Edition SP4
  • Microsoft BackOffice Server 4.0
  • Microsoft BackOffice Server 4.5
  • Microsoft BackOffice Small Business Server 4.0
  • Microsoft BackOffice Small Business Server 4.0a
  • Microsoft BackOffice Small Business Server 4.5
  • Microsoft Cluster Server
  • Microsoft Windows 3.11
  • Microsoft Windows 95
  • Microsoft Windows 98
  • Microsoft Windows 98 Second Edition
  • Microsoft Windows NT Server 3.1
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server 4.0 SP1
  • Microsoft Windows NT Server 4.0 SP2
  • Microsoft Windows NT Server 4.0 SP3
  • Microsoft Windows NT Server 4.0 SP4
  • Microsoft Windows NT Server, Enterprise Edition 4.0
  • Microsoft Windows NT Server, Enterprise Edition 4.0 SP4
  • Microsoft Windows NT Workstation 3.1
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Workstation 4.0 SP1
  • Microsoft Windows NT Workstation 4.0 SP2
  • Microsoft Windows NT Workstation 4.0 SP3
  • Microsoft Windows NT Workstation 4.0 SP4
This article was previously published under Q231947

SUMMARY

When you use Microsoft Network Monitor to capture network traffic, the capture buffer size must be large enough to save the desired traffic.

MORE INFORMATION

The capture buffer in Network Monitor is based on a first-in, first-out (FIFO) system, and its size is limited to 1 MB by default. Captured data is stored in RAM until you save the capture. If the data is larger than the allocated RAM, data is discarded using FIFO logic.

You can adjust the capture buffer size to as high as 120 MB. However, increasing the capture buffer to a size larger than the available memory can cause the tool to swap data to the hard disk, which may result in lost or dropped frames.

To increase the capture buffer size:
  1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
  2. On the Capture menu, click Buffer Settings.
  3. In the Buffer Size (in MB) box, type a value between 1-120, and then click OK.
Network Monitor allocates the necessary memory immediately. You can make the capture buffer larger than available memory, but the following warning message may be displayed:
The buffer size you have requested may cause frames to be dropped due to swapping. Are you sure you want to allocate a buffer of this size?
If you receive this warning message, you can decrease the capture buffer size to a value smaller than the available memory on your computer.

If you experience problems capturing data and have increased the buffer to the maximum limit, you can decrease the frame size to allow for more frames:
  1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
  2. On the Capture menu, click Buffer Settings.
  3. In the Frame Size (in bytes) box, click a value from the available frame sizes, and then click OK.
NOTE: If your troubleshooting methodology requires detailed information from each frame, you cannot use this option. An example of when this method is feasible is if you are looking only at Transmission Control Protocol (TCP) header information to analyze TCP traffic. The entire frame is not needed for just the header information.
Modification Type:MinorLast Reviewed:12/20/2004
Keywords:kberrmsg kbinfo kbnetwork KB231947
©2004 Microsoft Corporation. All rights reserved.