Network Monitor is available in two versions: a full version that ships with Microsoft Systems Management Server (SMS) and a "lite" version that ships with Windows Server 2003, Windows 2000 Server, and Windows NT Server 4.0. The lite version contains a subset of the full version's commands. In this article, I focus primarily on the lite version of Network Monitor because more people have this version. The two versions have some significant differences.
If you need to monitor remote segments or need additional functionality not included in the lite version, consider purchasing SMS to obtain the full version of Network Monitor, or buy a third-party network monitor that has remote-segment monitoring capability. Before switched networks became popular, it was much easier to capture network data because several computers shared the same network segment. Before switched networks, I used Network Monitor primarily to find a beaconing or faulty NIC that caused the network to crash. Today, managed switches perform this type of function. If you have a managed switch and suspect a faulty NIC or device, check the switch statistics and look for ports that have a high number of packets and/or packet errors on the port. After you identify potential problematic ports, you can use Network Monitor to capture network traffic on those ports. Of course, you can still use Network Monitor as a packet-capturing tool to troubleshoot specific problems with protocol connectivity, examine network utilization, and monitor server network traffic.