NETMON Input Format Fields

The structure of the input records generated by the NETMON input format depends on the value specified for the fMode parameter.

TCPIP Mode

When the fMode parameter is set to "TCPIP", the NETMON input format returns an input record for each TCP/IP packet found in the capture file.
In this mode, input records contain the following fields:
Name Type Description
CaptureFilename STRING The full path of the capture file containing this packet
Frame INTEGER The frame number containing this packet
DateTime TIMESTAMP Date and time at which the packet was sent
FrameBytes INTEGER Total number of bytes in the frame
SrcMAC STRING MAC address of the sender of this packet
SrcIP STRING IP address of the sender of this packet
SrcPort INTEGER TCP port number of the sender of this packet
DstMAC STRING MAC address of the destination of this packet
DstIP STRING IP address of the destination of this packet
DstPort INTEGER TCP port number of the destination of this packet
IPVersion INTEGER IP version of this packet
TTL INTEGER Time-To-Live field of the IP header of this packet
TCPFlags STRING TCP flags field of the TCP header of this packet
Seq INTEGER TCP sequence number of this packet
Ack INTEGER TCP acknowledge number of this packet
WindowSize INTEGER Window size field of the TCP header of this packet
PayloadBytes INTEGER Number of bytes in the TCP payload of this packet
Payload STRING TCP payload of this packet
Connection INTEGER Unique identifier of the TCP connection to which this packet belongs

TCPConn Mode

When the fMode parameter is set to "TCPConn", the NETMON input format returns an input record for each TCP connection found in the capture file.
In this mode, input records contain the following fields:
Name Type Description
CaptureFilename STRING The full path of the capture file containing this connection
StartFrame INTEGER Frame number containing the first packet of this connection
EndFrame INTEGER Frame number containing the last packet of this connection
Frames INTEGER Total number of frames containing packets belonging to this connection
DateTime TIMESTAMP Date and time of at which the first packet of this connection was sent
TimeTaken INTEGER Total number of milliseconds elapsed since the first packet of this connection to the last packet
SrcMAC STRING MAC address of the initiator of this connection
SrcIP STRING IP address of the initiator of this connection
SrcPort INTEGER TCP port number of the initiator of this connection
SrcPayloadBytes INTEGER Total number of bytes in the reconstructed TCP payload sent by the initiator of this connection
SrcPayload STRING Reconstructed TCP payload sent by the initiator of this connection
DstMAC STRING MAC address of the receiver of this connection
DstIP STRING IP address of the receiver of this connection
DstPort INTEGER TCP port number of the receiver of this connection
DstPayloadBytes INTEGER Total number of bytes in the reconstructed TCP payload sent by the receiver of this connection
DstPayload STRING Reconstructed TCP payload sent by the receiver of this connection

© 2004 Microsoft Corporation. All rights reserved.