Network Monitor Driver

The Network Monitor Driver component contains the Network Monitor driver, which allows the Network Monitor application to retrieve packets from the network. The driver can be installed without the Network Monitor application by installing either the full version of Network Monitor or Network Monitor Lite to enable remote attachment to the agent from another computer that is running the full version of Network Monitor. The driver is installed as an additional protocol for a connection in the Network Connections folder. The Network Monitor Driver installation actually consists of the Network Monitor Driver component, NMNT.SYS, the Network Driver Interface Specification (NDIS), the Network Packet Provider, called NDISNPP.DLL, and other files.

This component includes the following files:

  • Psnppagn.dll
  • Npptools.dll
  • Nmnt.sys
  • Ndisnpp.dll
  • Nppagent.exe

The network traffic is collected from the NDIS driver as individual frames. The Network Monitor driver, which consists of the Nmnt.sys file, then routes the frames to a network packet provider (NPP), which in turn captures the data and places it in one or more capture files. The NPP is a collection of Component Object Model (COM) interfaces that are used to capture data.

Once the network frames are stored in the capture file and the file has become accessible, experts and parsers can use the Network Monitor user interface and the Network Monitor functions provided in Nmapi.dll to analyze the data. Capture files are not accessible until the capture is complete.


There are no services associated with this component.

Associated Components

No other components interact with this component.


There are no configurable settings for this component.

© 2006 Microsoft Corporation. All rights reserved.