DOCUMENT:Q254644  31-MAY-2000  [sms]
TITLE   :SMS: Network Monitor Experts Increase CPU Use and Finish Slowly
PRODUCT :Microsoft Systems Management Server
PROD/VER:winnt:2.0 SP1
OPER/SYS:
KEYWORDS:kbtool kbsms200 kbsms200bug

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Systems Management Server version 2.0 SP1 
-------------------------------------------------------------------------------

SYMPTOMS
========

When you use the TCP Retransmit expert or the Server Response Time expert in
Microsoft Network Monitor version 5.00.943 on a large (greater than 2 megabytes)
network capture, it may need 30 or more minutes to complete, and Network Monitor
may increase central processing unit (CPU) utilization to 100 percent on the
computer during this time. Note that Network Monitor version 5.00.943 is
included in Systems Management Server (SMS) version 2.0, Service Pack 1 (SP1).

CAUSE
=====

This problem can occur because the MSRPC parser in this version of Network
Monitor continually looks back (recursively) in its recognize function. Because
of this, every time the parser engine moves on to the next frame, it goes back
and looks at all previous frames again, causing it to be extremely slow.

WORKAROUND
==========

To work around this problem, you can disable the MSRPC parser:

1. Quit Network Monitor if it is running, and then open the NETMON\i386\Parsers
   folder.

2. Rename the Msrpc.dll and Msrpc.ini files in this folder to Msrpc.olddll and
   Msrpc.oldini.

3. Restart Network Monitor, and then test filtering and the use of experts.

STATUS
======

Microsoft has confirmed this to be a problem in Systems Management Server
version 2.0.

Additional query words: prodsms bloodhound netmon expert netmon.exe

======================================================================
Keywords          : kbtool kbsms200 kbsms200bug 
Technology        : kbSMSSearch kbSMS200SP1
Version           : winnt:2.0 SP1
Issue type        : kbbug

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2000.