When you use Microsoft Network Monitor to capture network traffic, the capture buffer size must be large enough to save the desired traffic.

The capture buffer in Network Monitor is based on a first-in, first-out (FIFO) system, and its size is limited to 1 MB by default. Captured data is stored in RAM until you save the capture. If the data is larger than the allocated RAM, data is discarded using FIFO logic.

You can adjust the capture buffer size to as high as 120 MB. However, increasing the capture buffer to a size larger than the available memory can cause the tool to swap data to the hard disk, which may result in lost or dropped frames.

To increase the capture buffer size:

1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
2. On the Capture menu, click Buffer Settings.
3. In the Buffer Size (in MB) box, type a value between 1-120, and then click OK.

Network Monitor allocates the necessary memory immediately. You can make the capture buffer larger than available memory, but the following warning message may be displayed: If you receive this warning message, you can decrease the capture buffer size to a value smaller than the available memory on your computer.

If you experience problems capturing data and have increased the buffer to the maximum limit, you can decrease the frame size to allow for more frames:

1. Click Start, point to Programs, point to Network Analysis Tool, and then click Network Monitor.
2. On the Capture menu, click Buffer Settings.
3. In the Frame Size (in bytes) box, click a value from the available frame sizes, and then click OK.

NOTE: If your troubleshooting methodology requires detailed information from each frame, you cannot use this option. An example of when this method is feasible is if you are looking only at Transmission Control Protocol (TCP) header information to analyze TCP traffic. The entire frame is not needed for just the header information.