Tips for Using Netmon with DirectPlay
Here are a few tips to using Netmon with Microsoft® DirectPlay®:
- By default, Netmon only captures 1MB of the most recent traffic. You will probably want to increase this value to at least 10-20 MB.
- Netmon doesn't stream to the hard drive, so all you can see is what is in the capture buffer. To stream captured traffic to a hard drive, you will need to implement your own capturer. See MSDN for details.
- By default, DirectPlay parsing uses the [2302,2400]U{6073} port/socket range to filter IP and IPX packets. If you are using non-standard port/socket ranges, you can have the parsers recognize user-defined port/socket values. To do so, add two DWORD values, MinUserPort and MaxUserPort, to the \HKEY_CURRENT_USER\Software\Microsoft\DirectX\DirectPlay\Parsers registry key. This allows you to extend the port/socket range to [2302,2400]U{6073}U[MinUserPort,MaxUserPort].
- Because the DirectPlay and RTP protocols are both layered on top of the UDP protocol, their parsers may conflict. You should disable the RTP parser when analyzing DirectPlay traffic, and vice versa.