Network Monitor 3.0 has released!!

After many months of hard work we are proud to announce the Release to Web of Microsoft Network Monitor 3.0 (NM3). The final version is available from Microsoft Connects site ( The Connects site does require you have a passport account, but this is also free.

What you get for your money

Well since it's free, I suppose you get infinite value. But in nut shell here are some of the key features of NM3.

  • A completely new user interface
  • Real time capture and display of frames
  • Simultaneous capture on multiple network adapters
  • Multiple simultaneous capture sessions
  • Network conversations and a tree view displaying frames by conversation
  • A new script-based protocol parser language, and script-based parsers
  • Support for Vista/Windows XP/Windows Server 2003
  • Support for 32bit and 64bit platforms

Done but not finished

While work on the 3.0 release has completed, we have already started work on the next version. There are plenty of improvements and new features that we want to provide moving forwards. We have grand ideas for the future, but had to stop somewhere. And the best thing is that you won't have to wait years for the next version. Our current plan is to release the next version in 6-8 months, though don't hold me to that. I'm sure you know how schedules work, and how hard it is to predict the future.

How Do I Report Problems or Suggest Improvements?

The Connect site has link on the side bar that says Feedback. This is where you would go to provide us with bug reports or suggest ideas that you think would improve our product. We will personally look at your bug report, and if necessary ask for more information. So remember to check back in case we need more information.

How do I get unconfused?

The Connect site also has a Newsgroup link on the sidebar. Once you set your newsgroup password you will be able to join our newsgroup and ask questions in one of the four categories (capturing, filtering, general, npl). Just pick the most appropriate section and ask away. Hopefully somebody on our team or another helpful individual will be able to resolve your issue.

Download and Enjoy

Once you sign in to the Connects site and participate in our product, you'll get to download Network Monitor 3.0 for free. And please let us know what you think by participating in surveys and providing us feedback on the Connects site.

Comments (12)
  1. Paul E Long says:

    You must make sure to be logged in with your passport account in order to see the NM3 download.  Once you are logged in, you should see Network Monitor listed in the second table from the "Available Connections" link.

    If you have already joined the Network Monitor project, it will then appear under "My Participaiton" once you log in.

    Hope that helps,


  2. Thomas Lee says:


    I’ve been using Netmon for many years, and 3.0 is the best release yet.

    This product is very cool – I can’t believe it’s free!


  3. Jim Harrison says:

    What MS ISA payload wre you referring to?

    CARP, intra-array, firewall client?

    ISA Servers generate a few unique traffic profiles.

  4. It doesn’t understand MS ISA payload.  

  5. ISA Server has a set of network profiles, yeah.

    I talked about Firewall Client payload, NM 3.0 doesn’t understand it all.

    Surely, I can sniff Firewall Client traffic but it’s entirely useless. MS  For example, I can’t dig out SMTP packets encapsulated by Firewall Client.

  6. Anonymous says:

    Hello all , I cannot find netmon 3 download link from , who can kindly post the full path here ? Thanks!

  7. Anonymous says:

    Here’s some cool stuff I came across this evening: XML NotePad 2007 – new version of XML Notepad for…

  8. Anonymous says:

    The releases just keep coming… today it’s Network Monitor (NetMon) 3.0. NetMon is a much needed upgrade

  9. Jim Harrison says:

    Currently, the parser for the FWC protocol is MS-internal only.  It *may* be provided at a later date, but this is a decision to be made by the ISA product team.

    The more folks there are asking for it, the better the chances that it will "go public".

    You should also bear in mind that as of ISA 2004, the default i to encrypt the FWC control channel.  This means that even with a knowledgeable parser, you still can’t "see into" the FWC control traffic.

    The application (SMTP, HTTP, IM, etc.) traffic is still viewable, but is carried via an ephemeral port between the client & ISA.


    Jim Harrison (ISA SE)

  10. Anonymous says:

    If you aren’t familiar with Network Monitor, it’s a packet sniffer that’s a Windows component on the…

Comments are closed.

Skip to main content