Cannot Capture Outbound Frames with Network Monitor 2 on a Token Ring Network (264715)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Professional SP1
This article was previously published under Q264715
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

You may not be able to use Network Monitor version 2 to capture outbound frames from the local computer on your Token Ring network. This problem exists because of the following conditions:
  • Network Monitor 2 cannot force a network adapter into Promiscuous mode.
  • Some Token Ring network adapters must be forced into Promiscuous mode to allow the capturing of local outbound traffic.

CAUSE

The ForcePmode (Force Promiscuous Mode) registry setting was removed from Network Monitor 2.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix for Service Pack 2 should have the following file attributes or later: 
   Date         Time   Version        Size     File name
   -----------------------------------------------------
   11-Oct-2000  05:01  5.0.2195.2228  161,680  Ndis.sys
The English version of this fix for Service Pack 3 should have the following file attributes or later: 
   Date         Time   Version        Size     File Name
   -----------------------------------------------------
   13-Feb-2001  19:33  5.0.2195.3253  161,680  Ndis.sys

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

How to Edit the Registry to Force Promiscuous Mode

  1. Check the Monitor Control tool to determine the permanent Media Access Control (MAC) address for the network adapter.
  2. In Registry Editor (RegEdt32.exe), locate and click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nm\Parameters

  3. On the Edit menu, click Add Key.
  4. In the Key Name box, type ForcePmode, and then click OK.
  5. Click the ForcePmode key in the left pane.
  6. On the Edit menu, click Add Value.
  7. In the Value Name box, type the MAC address (from step 1), and then click OK.
  8. In the String Editor dialog box, type 1.
  9. On the Registry menu, click Exit.
  10. Restart the Monitor Control tool and reconfigure Security Monitor.
The next time that Network Monitor or the Monitor Control service runs, the network adapter runs in Promiscuous mode.

How to Stop Forcing Promiscuous Mode

  1. Use Registry Editor to locate and click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nm\Parameters\ForcePmode

  2. Click the string in the right pane.
  3. On the Edit menu, click String.
  4. In the String Editor dialog box, remove all text (so that the value is null).
  5. On the Registry menu, click Exit.
For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Modification Type:MinorLast Reviewed:9/26/2005
Keywords:kbHotfixServer kbQFE kbbug kbfix kbnetwork kbWin2000PreSP2Fix kbWin2000PreSP3Fix kbWin2000sp3fix KB264715
©2004 Microsoft Corporation. All rights reserved.