Windows Tools

NetCap Syntax

Overview | Notes | Syntax | Examples | Related Tools Open Command Prompt

NetCap uses the following syntax:

One Step netcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/k: HH:MM:SS] [/tcf: FolderName]

Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 MB.
/T Type Buffer HexadecimalOffset HexadecimalPattern
Specifies to use a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t /n option continues to capture until the spacebar is pressed, using the buffer as a queue.
B = Buffer
P = Pattern
BP = Buffer then pattern
PB = Pattern then buffer
N = No trigger
Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.
Hexadecimal offset from start of frame used with P, BP, PB, but not B.
Hexadecimal pattern to match used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.
/c: CapturePath
Temporarily moves the capture path to CapturePath. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.
/f: FilterFile
Specifies a Network Monitor 2.x-generated capture filter (*.cf).
/l: HH:MM:SS
Specifies to capture for the given amount of time (max 99:99:99).


/tcf: FolderName
Sets the default temporary capture folder. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.
Removes the NetCap instance of the Network Monitor driver.
/n: Number
Specifies which NIC to use based on the NIC index number for this computer.


See Example 1: Capture Network Packets for 3 Minutes, Example 2: Monitoring With a Trigger, and Example 3: Remove the Network Monitor Driver.