Continuing in our wander through the capabilities of procmon, this week we look at a Windows quirk that can cause confusion when analysing a trace.
I was investigating the intermittent slow loading of a PDF in a financial research management system. I'd spent ages carefully planning and managing the capture of a network and process monitor trace, and at last I had an example of the problem.
I started to look through the procmon trace and ... hang on, where are the TCP entries? I checked and rechecked the trace filters but I couldn't see what was wrong.
The explanation is quite simple ...