Netcap Syntax

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

NetCap Syntax

NetCap uses the following syntax:

Art Imagenetcap [/b:Number] [/t Type Buffer HexadecimalOffset HexadecimalPattern] [/f: FilterFile] [/c: CapturePath] [/n: Number] [/l: HH:MM:SS] [/tcf: FolderName] [/remove]


  • */b:Number***
    Specifies the buffer size in megabytes. Number can be from 1 to 1000. The default is 1 (MB).
  • */t* *Type Buffer HexadecimalOffset HexadecimalPattern*
    Specifies the use of a trigger to determine when to stop capturing. If the trigger is omitted, NetCap captures until the buffer is full, then stops. The /t N option continues to capture until the spacebar is pressed, using the buffer as a queue. If the buffer becomes full Netcap will overwrite the oldest entries.
  • Type
    B = Buffer

**P** = Pattern

**BP** = Buffer then pattern

**PB** = Pattern then buffer

**N** = No trigger
  • Buffer
    Percent buffer size. Options are 25, 50, 75, and 100. It is used with B, BP, PB, but not P.
  • HexadecimalOffset
    Hexadecimal offset from start of frame. Used with P, BP, PB, but not B.
  • HexadecimalPattern
    Hexadecimal pattern to match. Used with P, BP, PB, but not B. The pattern must be an even number of hexadecimal digits.
  • */f:* *FilterFile*
    Specifies a filter to use during the capture. A filter file is created using Network Monitor in versions 2.x and after. A filter file has a .cf extension.
  • */c:* *CapturePath*
    Specifies a location where Netcap will move the temporary capture files. This can be any valid local or remote path. If /c is not specified, the capture path remains in the default temporary capture folder.
  • */n:* *Number*
    Specifies which network adapter to capture from, based on the network adapter index number. Run Netcap with the /? parameter to assign index numbers to the network adapters on the computer.
  • */l:* *HH:MM:SS*
    Specifies how long the capture will last in hours, minutes, and seconds (maximum = 99:99:99). Note
    • This option overrides the default 100 percent trigger, unless /t Type is also specified.
  • */tcf:* *FolderName*
    Sets the location where the temporary capture files are stored. The path must be on a fixed local hard drive. Once set, you only need to use the option again to change the directory.
  • */remove*
    Removes the NetCap instance of the Network Monitor Driver.


See Netcap Examples

See Also


Netcap Overview
Netcap Remarks
Netcap Examples
Alphabetical List of Tools
Spcheck Overview
Nltest Overview
Netdom Overview
Netdiag Overview
Httpcfg Overview
Dnslint Overview
Dnscmd Overview
Dhcploc Overview
Dcdiag Overview
Browstat Overview