Whether your organization has a small or large network, it’s
always a good idea to keep an eye on what traffic is moving across the network.
The ability to analyze network traffic passing through a server can be a
valuable tool for troubleshooting problems with services, client applications,
network access, and other problems. For example, you might need to track access
to unauthorized Web sites that your firewall’s content filter doesn’t block, spot
connection problems, or identify computers that generate an excessive amount of
network traffic.

A network sniffer is a device or application that analyzes
network traffic at the frame (packet) level and provides the means to view
individual frames. Sniffers typically offer the ability to create reports and
perform other tasks with the information they gather. While it’s useful to have
a full-blown network sniffer device or application in some situations, a simple
network monitor will often do the trick for a single server.

Windows 2000 Server includes its own network sniffer.
Network Monitor offers the ability to monitor traffic for the local server; it
can capture frames sent to or from the local server. It does not install by
default, but you can easily add it.

To install Network Monitor, open the Add/Remove Programs
applet from Control Panel, and click Add/Remove Windows Components. Select
Management And Monitoring Tools, click Details, select the Network Monitor
Tools check box, and click OK.

After you install Network Monitor, you can begin capturing
data going to and from the server. You can view the data, filter it to view
only certain packets, and manipulate the data in other ways according to the
problem area you’re trying to resolve.

You can open Network Monitor from the Administrative Tools
folder. When Network Monitor opens, go to Capture | Networks to open the Select
A Network dialog box, where you can choose which interface to monitor. To begin
capturing all traffic to and from the server, go to Capture | Start.

You can also apply a filter to specify which traffic Network
Monitor captures. To do so, go to Capture | Filter to open the Capture Filter
dialog box, where you can specify protocols, addresses, and pattern matches for
the filter.

When you’re satisfied with the configuration, go to Capture
| Start to begin the capture. Traffic statistics appear in the right pane. When
you’ve captured enough data, go to Capture | Stop. To view the captured frames,
go to Capture | Display Captured Data, or press [F12].

The version of Network Monitor included with Windows 2000
Server doesn’t capture network data for client computers or other servers, but
you can use the version of Network Monitor included with Microsoft Systems
Management Server (SMS) to do so.

Miss a tip?

Check out the Windows 2000 Server Archive,
and catch up on the most recent tips from this newsletter.

Want more Win2K tips
and tricks? Automatically
sign up for our free Windows 2000 Server newsletter, delivered each
Tuesday!