Microsoft Network Monitor 3.0 (Netmon 3.0) is the latest version of protocol analyzer tool from Microsoft which currently released as beta 2. Network Monitor 3.0 protocol analyzer, which also known as packet sniffer or Ethernet sniffer, is a computer software similar to Ethereal that intercepts, captures and logs network traffic and packets passing over a digital network, and then decodes, analyzes and displays its content according to the appropriate RFC or other specifications.

Network Monitor 3.0 is the successor and upgrade version for Network Monitor 2.0 which comes with Windows Server as limited feature version that only captures network traffic destined for your PC. Or else you need to buy full featured version of Netmon 2.0 which only available for Systems Management Server (SMS). But Network Monitor 3.0 will be available for free download.

Microsoft Network Monitor 3.0 features:

A completely new user interface
Real time capture and display of frames
Simultaneous capture on multiple network adapters
Multiple simultaneous capture sessions
Network conversations and a tree view displaying frames by conversation
A new script-based protocol parser language, and script-based parsers
Network Parsing Language (NPL)
Support for Windows Vista/Windows XP/Windows Server 2003
Support for 32bit and 64bit platforms

By installing Microsoft Network Monitor on a PC in a LAN or wireless network, it’s possible to sniff, spy, capture and reveal any unsecured or unencrypted user id and password that been sent over the network and seen by the particular network interface, in promiscuous mode . However, depending on the network structure (hub or switch) Microsoft Network Monitor 3.0 can sniff all or just parts of the traffic from a single machine within the network. But if comparing with Ethereal that focuses on professional and technical expert, although lose out in feature sets and performance, but Microsoft Network Monitor 3.0 has user friendly interface and considerably ease to use.

APC Magazine (dead link) tries out and reviews the Microsoft Network Monitor 3.0 and finds that Network Monitor 3.0 is an impressive step up from the earlier version and is now on par with other software packet sniffers. With a little tweaks and filters, APC Magazine manages to ‘crack’ FTP passwords that sent as a clear text.

Sniff FTP Password

Currently, to download Microsoft Network Monitor 3.0, you need to be a Microsoft Connect user, and apply for the program under Available Connections section after you login to Microsoft Connect.

Download Microsoft Network Monitor (current version 3.4) from Microsoft Download Center.