How to specify filters in NMcap RRS feed

  • Question

  • As in "How to reduce # of lost packets using Net mon 3.3; performance" I type command

    NMCap /network * /capture 'TCP and (ContainsBin(FrameData, 2, "4C 00"))' /file out.cap:500M /DisableConversations

    but I get error:
    Error: '/Capture' - Invalid parameter ''TCP and (ContainsBin(FrameData, 2, 4C 00))''

    And it repeates in any other cases when I try to specify any filter on all computers where I try.
    Where is a mistake?
    Tuesday, October 20, 2009 2:14 PM


  • For some reason, you can't use the single quotes around the double quotes.  However, the other way works fine.

    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, '4C 00'))" /file out.cap:500M /DisableConversations

    You can also escape the double quotes inside as in

    NMCap /network * /capture "TCP and (ContainsBin(FrameData, 2, \"4C 00\"))" /file out.cap:500M /DisableConversations

    Hope that helps,

    • Marked as answer by Safety1st Tuesday, October 20, 2009 3:21 PM
    Tuesday, October 20, 2009 2:22 PM