Microsoft Network Monitor 3.1說明文檔.doc

昨天在抓蝦的時(shí)候，有個(gè)博主推薦了好軟件：Microsoft Network Monitor 3.1，聽說是很好用，于是今天在微軟官方網(wǎng)站上下了一個(gè)，裝上一看，不會(huì)用（以前沒用過之類的軟件），于是點(diǎn)擊help，一看，全是英文，雖然小弟我英語學(xué)得還不賴，但是這些都是專業(yè)詞匯啊，沒辦法，查：翻譯如下：該如何用網(wǎng)絡(luò)顯示器取得網(wǎng)絡(luò)流量在這一個(gè)制品的信息適用于: 微軟公司 Windows 2000 服務(wù)器微軟公司 Windows 2000 高階服務(wù)器微軟公司 Windows 2000 職業(yè)的微軟公司 Windows 2000 資料處理中心服務(wù)器微軟公司視窗 NT 服務(wù)器 3.1微軟公司視窗 NT 服務(wù)器 3.5微軟公司視窗 NT 服務(wù)器 3.51微軟公司視窗 NT 服務(wù)器 4.0微軟公司視窗 NT 工作站 3.1微軟公司視窗 NT 工作站 3.5微軟公司視窗 NT 工作站 3.51微軟公司視窗 NT 工作站 4.0微軟公司視窗 NT 增加了服務(wù)器 3.1微軟公司 Windows 95微軟公司 Windows 98微軟公司 SNA 服務(wù)器作為視窗 NT 2.1微軟公司 SNA 服務(wù)器作為視窗 NT 2.11微軟公司區(qū)域網(wǎng)絡(luò)經(jīng)理對(duì)視窗 NT 高階服務(wù)器升級(jí)微軟公司系統(tǒng)管理服務(wù)器 1.0微軟公司系統(tǒng)管理服務(wù)器 1.1微軟公司系統(tǒng)管理服務(wù)器 1.2微軟公司區(qū)域網(wǎng)絡(luò)經(jīng)理 2. x微軟公司傳輸控制協(xié)議/IP-32 作為 Windows for Workgroups 3.11微軟公司傳輸控制協(xié)議/IP-32 為 Windows for Workgroups 3.11 一微軟公司傳輸控制協(xié)議/IP-32 作為 Windows for Workgroups 3.11 b微軟公司 Windows for Workgroups 3.11微軟公司英特網(wǎng)信息服務(wù)器 1.0這一個(gè)制品先前依據(jù) Q148942 規(guī)定被公布一覽這一個(gè)制品的目的將提供不可或缺的使用微軟公司的網(wǎng)絡(luò)顯示器取得來自一個(gè)區(qū)域網(wǎng)絡(luò)的網(wǎng)絡(luò)流量的信息給您。 這一個(gè)制品的主文直接地從網(wǎng)絡(luò)被提出顯示器的輔助文件而且應(yīng)該是叁考的作為比較詳細(xì)的指令。 較多的信息網(wǎng)絡(luò)顯示器是監(jiān)督區(qū)域網(wǎng)絡(luò)，而且提供一個(gè)網(wǎng)絡(luò)統(tǒng)計(jì)表的圖解式顯示裝置的一個(gè)網(wǎng)絡(luò)診斷的工具。 網(wǎng)絡(luò)系統(tǒng)管理師能使用這些統(tǒng)計(jì)表執(zhí)行例行的故障排除任務(wù),像是設(shè)置下的一個(gè)服務(wù)器, 或那正在收到一個(gè)土木工程請(qǐng)求的不成比例數(shù)目。 當(dāng)收來自網(wǎng)絡(luò)的數(shù)據(jù)流的信息的時(shí)候, 網(wǎng)絡(luò)監(jiān)察顯示器信息的下列類型: 在網(wǎng)絡(luò)之上寄送了一個(gè)架框的計(jì)算機(jī)的根源位址。 (這位址是一個(gè)獨(dú)特的十六進(jìn)位 (或堿-16) 數(shù)目認(rèn)明在網(wǎng)絡(luò)上的那一部計(jì)算機(jī).) 計(jì)算機(jī)的目標(biāo)位址哪一收訖架框。 協(xié)定過去習(xí)慣于派遣架框。 數(shù)據(jù), 或信息的一個(gè)嫁奩被寄送。 程序在哪一個(gè)之前網(wǎng)絡(luò)顯示器收這信息被呼叫捕獲。 預(yù)先設(shè)定地，網(wǎng)絡(luò)顯示器在它進(jìn)入一個(gè)捕獲緩沖區(qū),在存儲(chǔ)器是一個(gè)用作儲(chǔ)備的儲(chǔ)存區(qū)之內(nèi)在網(wǎng)絡(luò)上發(fā)現(xiàn)的所有的架框上收集統(tǒng)計(jì)表。 為了要在只有一個(gè)架框的特定子集上取得統(tǒng)計(jì)表，您能藉由設(shè)計(jì)一個(gè)捕獲濾波器選出這些架框。 當(dāng)您已經(jīng)最后加工取得信息的時(shí)候, 您能設(shè)計(jì)一個(gè)顯示裝置濾波器敘述多少信息，您已經(jīng)取得遺囑在網(wǎng)絡(luò)被顯示顯示器的架框檢視器窗囗。 為了要使用網(wǎng)絡(luò)顯示器，您的計(jì)算機(jī)一定有一個(gè)支援雜亂的模態(tài)的網(wǎng)絡(luò)卡。 如果您正在一個(gè)間接的機(jī)器上使用網(wǎng)絡(luò)顯示器，局部的工作站不需要網(wǎng)絡(luò)轉(zhuǎn)接器支援雜亂的模態(tài)的卡，但是間接的計(jì)算機(jī)做。 在整個(gè)網(wǎng)絡(luò)捕獲, 或保護(hù)地方資源, 使用網(wǎng)絡(luò)顯示器代理程式使用一部間接的視窗 NT 計(jì)算機(jī)取得信息。 當(dāng)您很遠(yuǎn)地捕獲的時(shí)候，網(wǎng)絡(luò)顯示器代理程式收集來自一部間接的計(jì)算機(jī)的統(tǒng)計(jì)表, 然后將這些統(tǒng)計(jì)表派遣到他們?cè)谝粋€(gè)局部的網(wǎng)絡(luò)顯示器窗囗中被顯示的您的局部計(jì)算機(jī)。 一經(jīng)數(shù)據(jù)已經(jīng)被地方性地或很遠(yuǎn)地取得，數(shù)據(jù)能被把一個(gè)主文或者一個(gè)捕獲文件存檔到, 而且能在稍后被開啟而且審訊。 注意: 網(wǎng)絡(luò)顯示器的核心部官能性質(zhì),在輔助被描述,被微軟公司產(chǎn)品支援服務(wù)支援。 網(wǎng)絡(luò)-依賴的任務(wù)，像是解釋您從您的網(wǎng)絡(luò)捕獲的數(shù)據(jù)，沒被支援。 網(wǎng)絡(luò)顯示器代理程式為視窗 NT 被支援, 但是在 Windows 3.1 和 Windows for Workgroups 工作站上被不支持。 創(chuàng)造位址列表為了要在一個(gè)捕獲濾波器中使用位址對(duì), 您應(yīng)該第一建造一個(gè)位址數(shù)據(jù)庫。 一經(jīng)這一個(gè)數(shù)據(jù)庫被建造，您能使用在數(shù)據(jù)庫中的位址面市的在一個(gè)捕獲濾波器中敘述位址對(duì)。 為了要產(chǎn)生一個(gè)位址列表, 遵從這些踏步: 從捕獲畫面，選擇啟動(dòng)。 可選擇地，開啟一。在架框檢視器窗囗中加帽于文件。 當(dāng)您已經(jīng)最后加工捕獲的時(shí)候，選擇從捕獲畫面阻塞而且檢視顯示架框檢視器窗囗。 從顯示裝置畫面，選擇找所有的名字。 網(wǎng)絡(luò)顯示器處理架框,然后把他們加入位址數(shù)據(jù)庫。 關(guān)閉架框檢視器窗囗, 而且顯示捕獲窗囗。 從捕獲畫面，選擇過濾顯示捕獲濾波器對(duì)話盒。 在捕獲濾波器對(duì)話盒中，在位址對(duì)線上點(diǎn)兩下。 或, 在添加 groupbox 中選擇位址。 網(wǎng)絡(luò)監(jiān)察顯示器位址您已經(jīng)建立的數(shù)據(jù)庫。 您能使用在這一個(gè)數(shù)據(jù)庫中的名字在捕獲濾波器中敘述位址對(duì)。 取得在二部計(jì)算機(jī)之間的數(shù)據(jù)為了要監(jiān)督在二部計(jì)算機(jī)之間的流量, 遵從這些踏步: 從捕獲畫面，選擇濾波器顯示捕獲濾波器對(duì)話盒。 在 ANYANY 線上點(diǎn)兩下顯示位址展示語句對(duì)話盒。 在位址展示語句對(duì)話盒的左窗囗中，選擇計(jì)算機(jī)的位址。 在位址展示語句對(duì)話盒的正確窗囗中，選擇計(jì)算機(jī)的位址。 當(dāng)您已經(jīng)做這的時(shí)候，在這一個(gè)窗囗的頂選擇最近的按鈕作為較多的指令。 在對(duì)話盒的方向窗囗中選擇符號(hào)之一: 選擇符號(hào)監(jiān)督在您已經(jīng)選擇的位址之間的任一方向通過的流量。 選擇那 - 符號(hào)只監(jiān)督從對(duì)在右邊的窗囗中被選擇的位址在左窗囗中被選擇的位址通過的流量。選擇全對(duì)。 在捕獲濾波器對(duì)話盒中，選擇好。 從捕獲畫面，選擇開始。 儲(chǔ)存取得了數(shù)據(jù)當(dāng)做指令使用節(jié)省把對(duì)一個(gè)捕獲文件的捕獲統(tǒng)計(jì)表存檔而且把改變存檔取得文件您已經(jīng)修改。 稍后, 檢視架框把銼存檔, 您能在網(wǎng)絡(luò)顯示器架框檢視器窗囗開啟這一個(gè)文件而且顯示統(tǒng)計(jì)表。 把那存檔取得了對(duì)一個(gè)捕獲文件或文字檔的架框: 做跟隨之一: 在工具欄上，點(diǎn)一下文件節(jié)省按鈕。-或- 從文件畫面，選擇節(jié)省當(dāng)做。做一跟隨: 把對(duì)在文件名字方格的目前磁盤和目錄的文件存檔敘述一個(gè)文件名字和一個(gè)擴(kuò)充。 如果您正在儲(chǔ)存您已經(jīng)修改的一個(gè)文件，您依據(jù)相同的目錄它的原來名字規(guī)定不能夠把它存檔。 把對(duì)您不被連接到,選擇網(wǎng)絡(luò)按鈕的一個(gè)網(wǎng)絡(luò)股份的文件存檔, 然后使用那連接網(wǎng)絡(luò)磁盤對(duì)話盒創(chuàng)立聯(lián)接。 為了要把對(duì)一個(gè)不同的磁盤或者目錄的文件存檔, 做跟隨: 在磁盤方格中，選擇一個(gè)新的磁盤。 在目錄方格中，選擇一個(gè)新的目錄。 鍵入文件名字。只把那些架框統(tǒng)計(jì)表存檔哪一會(huì)目前顯示裝置濾波器的規(guī)范, 選擇過濾。只有當(dāng)如果您正在儲(chǔ)存來自架框檢視器窗囗的數(shù)據(jù)，這選擇項(xiàng)是有效的。 為了要把一個(gè)特定類型的架框存檔, 鍵入開始和終止架框編號(hào)在那從和對(duì)方格。 選擇全對(duì)。 注意: 當(dāng)多種的架框被把一個(gè)捕獲文件存檔到的時(shí)候，與架框的非正式會(huì)員的數(shù)目被改變; 在一個(gè)捕獲文件中，架框編號(hào)總是由 1 開始,不管與原來的架框一起非正式會(huì)員的數(shù)目。 同樣地，如果您提出申請(qǐng)一個(gè)顯示裝置濾波器, 然后把被過濾的架框存檔, 在捕獲文件的架框編號(hào)由 1 開始. 如果, 然而，您使用紋在紋對(duì)話盒中銼選擇項(xiàng)，與架框的非正式會(huì)員的原來的架框編號(hào)被保護(hù)。 廣域網(wǎng)環(huán)境的圖底有時(shí)，您可能被要求作在被一或較多路由器分開的二部特定的計(jì)算機(jī)之間的一個(gè)網(wǎng)絡(luò)流量的捕獲。 在這些情況，支援職業(yè)的可能想要分析第一部計(jì)算機(jī)和它最近的路由器、和第二部計(jì)算機(jī)和它最近的路由器之間的所有的網(wǎng)絡(luò)流量之間的所有的網(wǎng)絡(luò)流量。 大部份的時(shí)間, 這是完成了核對(duì)是否網(wǎng)絡(luò)小包正在路由器之間被某處遺失或使腐化。 為了要使這些掃掠線一致和能夠同時(shí)發(fā)生地讀這些掃掠線，系統(tǒng)時(shí)鐘在制造掃掠線之前一定在這二部計(jì)算機(jī)之間被同步化。 使用的下列步驟同步化在二部計(jì)算機(jī)之間的時(shí)間: 選擇計(jì)算機(jī)防止哪一個(gè)同步化時(shí)間。 從另一個(gè)計(jì)算機(jī)，鍵入指令凈時(shí)間 ComputerName/組 /贊成票在 ComputerName 是來自第 1 踏步的計(jì)算機(jī)的名字的地方。 確認(rèn)計(jì)算機(jī)藉由在每一個(gè)打字時(shí)間有同一個(gè)時(shí)間。 繼續(xù)掃掠線。 調(diào)查結(jié)果廣告媒介使用控制位址如果要監(jiān)督的計(jì)算機(jī)正在運(yùn)行: 一個(gè)以 MS-DOS 為基礎(chǔ)的網(wǎng)絡(luò)用戶端,在那一部計(jì)算機(jī)運(yùn)行 MSD 。 Windows for Workgroups 3.11(正在運(yùn)行中的傳輸控制協(xié)議/IP), 鍵入 IPCONFIG/全部從指令行。 Windows 95,在局部的工作站運(yùn)行來自指令行的 WINIPCFG 。 MacOS, 開啟蘋果電腦區(qū)域網(wǎng)路控制板。 來自編輯畫面的選擇從屬模態(tài), 改變模態(tài)到增加。 蘋果電腦區(qū)域網(wǎng)路控制板現(xiàn)在揭露信息按鈕。 點(diǎn)一下這一個(gè)按鈕獲得雨衣位址在局部的控制臺(tái)的視窗 NT 使用這些選擇項(xiàng)之一: 來自指令行的網(wǎng)絡(luò)配置服務(wù)器IPCONFIG/所有的從指令行來自指令行的 IPXROUTE 配置arp-一從指令行來自視窗 NT 資源套件的 Getmac.exeWinMSD視窗 NT ，很遠(yuǎn)地，運(yùn)行來自視窗 NT 的 Getmac.exe 資源套件幫助原文如下：How to Capture Network Traffic with Network MonitorThe information in this article applies to: Microsoft Windows 2000 Server Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server Microsoft Windows NT Server 3.1 Microsoft Windows NT Server 3.5 Microsoft Windows NT Server 3.51 Microsoft Windows NT Server 4.0 Microsoft Windows NT Workstation 3.1 Microsoft Windows NT Workstation 3.5 Microsoft Windows NT Workstation 3.51 Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Advanced Server 3.1 Microsoft Windows 95 Microsoft Windows 98 Microsoft SNA Server for Windows NT 2.1 Microsoft SNA Server for Windows NT 2.11 Microsoft LAN Manager to Windows NT Advanced Server Upgrade Microsoft Systems Management Server 1.0 Microsoft Systems Management Server 1.1 Microsoft Systems Management Server 1.2 Microsoft LAN Manager 2.x Microsoft TCP/IP-32 for Windows for Workgroups 3.11 Microsoft TCP/IP-32 for Windows for Workgroups 3.11a Microsoft TCP/IP-32 for Windows for Workgroups 3.11b Microsoft Windows for Workgroups 3.11 Microsoft Internet Information Server 1.0This article was previously published under Q148942 SUMMARYThe purpose of this article is to provide you with the information needed to capture network traffic from a local area network using Microsofts Network Monitor. The text of this article comes directly from the Network Monitors Help file and should be referenced for more detailed instructions. MORE INFORMATIONNetwork Monitor is a network diagnostic tool that monitors local area networks and provides a graphical display of network statistics. Network administrators can use these statistics to perform routine trouble- shooting tasks, such as locating a server that is down, or that is receiving a disproportionate number of work requests. While collecting information from the networks data stream, Network Monitor displays the following types of information: The source address of the computer that sent a frame onto the network. (This address is a unique hexadecimal (or base-16) number that identifies that computer on the network.) The destination address of the computer that received the frame. The protocols used to send the frame. The data, or a portion of the message being sent. The process by which Network Monitor collects this information is called capturing. By default, Network Monitor gathers statistics on all the frames it detects on the network into a capture buffer, which is a reserved storage area in memory. To capture statistics on only a specific subset of frames, you can single out these frames by designing a capture filter. When you have finished capturing information, you can design a display filter to specify how much of the information that you have captured will be displayed in Network Monitors Frame Viewer window. To use Network Monitor, your computer must have a network card that supports promiscuous mode. If you are using Network Monitor on a remote machine, the local workstation does not need a network adapter card that supports promiscuous mode, but the remote computer does. To capture across networks, or to preserve local resources, use the Network Monitor Agent to capture information using a remote Windows NT computer. When you capture remotely, the Network Monitor Agent gathers statistics from a remote computer, and then sends these statistics to your local computer, where they are displayed in a local Network Monitor window. Once data has been captured either locally or remotely, the data can be saved to a text or a capture file, and can be opened and examined at a later time. NOTE: The core functionality of Network Monitor, described in Help, is supported by Microsoft Product Support Services. Network-dependent tasks, such as interpreting data that you capture from your network, are not supported. The Network Monitor Agent is supported for Windows NT, but is unsupported on Windows 3.1 and Windows for Workgroups workstations. Creating an Address ListTo use address pairs in a Capture filter, you should first build an address database. Once this database is built, you can use the addresses listed in the database to specify address pairs in a capture filter. To create an address list, follow these steps: From the Capture menu, select Start. Optionally, open a .cap file in the Frame Viewer window. When you have finished capturing, select Stop and View from the Capture menu to display the Frame Viewer window. From the Display menu, select Find All Names. Network Monitor processes the frames, then adds them to the address database. Close the Frame Viewer window, and display the Capture window. From the Capture menu, select Filter to display the Capture filter dialog box. In the Capture Filter dialog box, double-click on the Address Pairs line. Or, choose Address in the Add groupbox. Network Monitor displays the address database you have created. You can use the names in this database to specify address pairs in the Capture filter. Capturing Data Between Two ComputersTo monitor traffic between two computers, follow these steps: From the Capture menu, choose Filter to display the Capture Filter dialog box. Double-click on the ANYANY line to display the Address Expression dialog box. In the left window of the Address Expression dialog box, select the address of a computer. In the right window of the Address Expression dialog box, select the address of a computer. When you have done this, choose the Next button at the top of this window for more instructions. In the Direction window, of the dialog box, choose one of the symbols: Choose thesymbol to monitor the traffic that passes in either direction between the addresses that you have selected. Choose the - symbol to monitor only the traffic that passes from the address selected in the left window to the address selected in the right window.Choose OK. In the Capture Filter dialog box, choose OK. From the Capture menu, choose Start. Saving Captured DataUse the Save As command to save capture statistics to a capture file or to save changes to capture files that you have modified. Later, to view frames saved to file, you can open this file and display the statistics in Network Monitors Frame Viewer window. To save the captured frames to a capture file or text file: Do one of the following: On the Toolbar, click the File Save button.-or- From the File menu, choose Save As.Do one the following: To save the file to the current drive and directory, in the File Name box, specify a file name and an extension. If you are saving a file that you have modified, you cannot save it under its original name in the same directory. To save the file to a network share to which you are not connected, choose the Network button, and then use the Connect Network Drive dialog box to establish the connection. To save the file to a different drive or directory, do the following: In the Drives box, select a new drive. In the Directories box, select a new directory. Type the file name.To save only those frame statistics that meet the specifications of the current display filter, choose Filtered.This option is available only if you are saving data from the Frame Viewer window. To save a particular range of frames, type the beginning and ending frame numbers in the From and To boxes. Choose OK. NOTE: When a range of frames is saved to a capture file, the numbers associated with the frames are changed; in a capture file, frame numbers always begin with 1, regardless of the number associated with the original frame. Similarly, if you apply a display filter, and then save the filtered frames, the frame numbers in the capture file begin with 1. If, however, you use the Print to File option in the Print dialog box, the original frame numbers associated with the frames are preserved. Tracing in a WAN EnvironmentSometimes, you may be asked to make a capture of network traffic between two specific computers that are separated by one or more routers. In these cases, the support professional may want to analyze all network traffic between the first computer and its nearest router, and all network traffic between the second computer and its nearest router. Most of the time, this is done to check whether or not network packets are being lost or corrupted somewhere between th