Where does the Network Monitor Agent (Netmon) place itself in the IP Stack?
If you use Microsoft’s Netmon product for packet sniffing, it must run from a system which does not have Intel Packet Protect enabled. If Netmon is running on a system with Intel Packet Protect enabled, you will see the following: • Netmon will not see any ESP/AH packets among other peers. It does see IKE packets. • All ICMP packets to or from self (where Netmon runs) are clear. These packets are actually encrypted on the wire. So, to correctly collect sniffing packets, Netmon must be running from a third system which has IPSec disabled.
