locked
NM API: Packet truncation? (aka Snaplen) RRS feed

  • Question

  • Hi all

    I wonder whether there is a option in NM API to set the snaplen value? (as known from WinPcap)

    Background: I am only interested in the first (say) 100 Bytes of each packet and therefore would like the API to truncate each packet for me. I am facing some performance issues as I deal with too many and too large packets.

    Thanks

    Wednesday, August 10, 2011 8:08 AM

Answers

  • Hi,

    Yes, Network Monitor supports this.  You can find it in the UI in the Options dialog under the Capture Tab.  It's the "Capture only first X bytes of a frame" checkbox.  Then you can specify how many bytes you'd like to capture from each packet.

    If you're using our commandline tool nmcap, you can find the feature with the /MaxFrameLength switch and specify the number of bytes right after it.  e.g. nmcap /network * /MaxFrameLength 100


    Michael Hawker | Program Manager | Network Monitor
    Wednesday, August 10, 2011 3:05 PM

All replies

  • Hi,

    Yes, Network Monitor supports this.  You can find it in the UI in the Options dialog under the Capture Tab.  It's the "Capture only first X bytes of a frame" checkbox.  Then you can specify how many bytes you'd like to capture from each packet.

    If you're using our commandline tool nmcap, you can find the feature with the /MaxFrameLength switch and specify the number of bytes right after it.  e.g. nmcap /network * /MaxFrameLength 100


    Michael Hawker | Program Manager | Network Monitor
    Wednesday, August 10, 2011 3:05 PM
  • Hi Michael

    Thanks for your answer. It does work as described using the NetMon GUI. Frankly what I want to do is to programatically access that function using the NM API so that I can write my own GUI/app.

    Thanks for any further assistance on this.

    Wednesday, March 14, 2012 1:22 PM
  • Yes, you can simply chop the frame off before you write it to the capture file.  You'll get the full frame in the callback, but then use NMGetPartialRawFrame to get the length you want. Then use NmBuildRawFrameFromBufferEx to create a new shortened frame.  Use that handle to write the frame to a file.

    Thanks,

    Paul

    Wednesday, March 14, 2012 2:01 PM