When You Can't Save Frames From the UI

  • Article

You might have run into an occasion when doing a capture from the UI that you are unable to save your capture. You might receive a message like "Not enough storage is available to process this command". The UI tends eat up a lot of resources as it saves conversation information and builds the conversation tree. This is why we recommend you use NMCap, the command line capture utility included with Network Monitor, if you are going to capture a considerable amount of data. But if you do get into this situation, there might be a way to save the trace using the Frame Buffer Manager.

Frame Buffer Manager to Save the Day

Frame Buffer Manager is a tool in Network Monitor that allows you to select frames in any order and from multiple capture files and add them to a new capture file. You can sometimes use this feature to get around this problem. Just follow these steps:

  1. Go to File, Frame Buffer Manager
  2. Select the New File button
  3. In the file save dialog, type in a capture file name and hit save
  4. Hit OK to exit the Frame Buffer Manager window
  5. Select all frames in frame summary (Ctrl+A)
  6. Go to File, Frame Buffer Manager again
  7. Select the file you created in step 3 and Hit OK
  8. Go to File, Frame Buffer Manager again
  9. Select the file you created in step 3
  10. Select the Close File button to save the file

The file will now be saved. If the capture size is larger than 20megs, then it will be split into multiple files labeled, for instance, out.cap, out(1).cap, out(2).cap and so on.  You can stitch these back together using NMCap.  Please refer to this blog on stitching chained captures back together.

What You Learned

First, use NMCap if you need to capture for long periods of time. Second, if you do happen to find yourself in this situation with the UI, Frame Buffer Manager can possibly provide a way to save your data.