NetmonAPI.NmGetFieldValueString RRS feed

  • Question

  • H,

    I have few questions regarding Network Monitor API

    1) What is the difference between Property and Field in this API and which properties and fields are available (Means that can get from a cap file)?

    2) How can I use the NetmonAPI.NmGetFieldValueString function in order to get a field value? For example, I need to get the Description field value.

    I searched alot for getting the the frame data but I failed to do that. It is very appreciated if you can explain to me using some code.

    My code:

    I added the following fields:

    ret = NetmonAPI.NmAddField(frameParserConfig, "Description", out myFieldID);
                ret = NetmonAPI.NmAddField(frameParserConfig, "TCP.SrcPort", out myFieldID1);
                ret = NetmonAPI.NmAddField(frameParserConfig, "TCP.DataOffset.DataOffset", out myFieldID2);

    Where myFieldID, myField1 and myField2 are private:

    private static UInt32 myFieldID = 0;
            private static UInt32 myFieldID1 = 0;
            private static UInt32 myFieldID2 = 0;

    The function which read the CAP file:

    public static void ReadExistingCapFile()
                myFrameParser = CreateFrameParser();
                IntPtr capFile;
                UInt32 ret = NetmonAPI.NmOpenCaptureFile("C://Latest.cap", out capFile);
                UInt32 frameCount = 0;
                ret = NetmonAPI.NmGetFrameCount(capFile, out frameCount);
                myFrameParser = CreateFrameParser();
                for (UInt32 i = 0; i < frameCount; i++)
                    IntPtr pframe;
                    ret = NetmonAPI.NmGetFrame(capFile, i, out pframe);
                    IntPtr parsedFrame, insFrame;
                    ret = NetmonAPI.NmParseFrame(myFrameParser, pframe, i, NmFrameParsingOption.None, out parsedFrame, out insFrame);
                        IntPtr buff = Marshal.AllocHGlobal(1000);
                        char[] charBuffer = new char[1000000];
                        fixed (char* pchar = charBuffer)
                            ret = NetmonAPI.NmGetFieldValueString(parsedFrame, 100000000, 100000000, pchar);
                            ret = NetmonAPI.NmGetFieldValueString(parsedFrame, myFieldID, 100000000, pchar);
                        Console.WriteLine("-----------------" + i.ToString());

    In the above function I'm trying to get the Description field value (Other fields are not used in this function - but should be too).

    Can you please explain to me what is wrong in my code and how can I fix it?



    • Edited by Nadim2522 Thursday, September 12, 2013 12:02 PM
    Thursday, September 12, 2013 11:55 AM

All replies

  • For #1, fields are things that map to data on the wire.  Properties are derived from various things, but don't map directly to wire data.

    For #2, look at the API example which are in the Network Monitor Help menu called "Contents and SDK".  For your code above, you should check the return values and at least print an error.  Description is an example of a property, so you can't add it as a field.  I'm guessing that returns an error.  Also your file name is using forward slashed, but I think you need backslashes.  I'll bet it's also returning an error.  There are two examples that can help, Filtering Live Data and Retrieving Data Fields, and Displaying Properties from a Capture file.  Also Iterating Fields with Display Format might also help.


    • Proposed as answer by Paul E Long Tuesday, September 24, 2013 9:51 PM
    Tuesday, September 24, 2013 9:51 PM