Limitations

The capabilities of NTRACE are highly dependent upon the capabilities of the hardware AND MAC driver. Specifically, both of these components may or may not support a "promiscuous copy" operation.

Without this support, tracing is limited to broadcasts, multicasts and directly addressed frames (frames that are explicitly addressed to this adapter address).
Both the hardware and the MAC driver must support promiscuous mode.
Ethernet hardware is promiscuous by design, however on Token-Ring this is an OPTIONAL feature.

Each instance of the NTRACE driver can only be tracing on a single MAC driver at a time.

Golden Code recommends a separate instance of the NTRACE driver be loaded per MAC driver which could possibly be traced.

High resolution timing will generate incorrect time stamps if WINOS2 applications are running at the same time as tracing.
The Frame Status field in Token-Ring frames is not provided to protocol drivers by the MAC driver. This is a permanent restriction associated with using the NDIS interface for access to the LAN media. The resulting frames as written to the trace file are written just as received by NTRACE.OS2. No frame status field exists in this data.
The resulting trace files do not use Sniffer (TM) compressed format.

MAC hardware and drivers have varied support for allowing multiple protocols to make copies of the same frame (also known as "multiple TransferData").

This is not an issue for MAC drivers that always use the "ReceiveChain" style of indications. In this cases, there are no limitations.
Some MAC drivers use "ReceiveLookahead" style indications. In this case, it is very important to determine if the MAC supports "multiple TransferData". If multiple TransferData is NOT supported then only the first 256 bytes of a frame can be copied into the trace buffer. This is known as forced frame slicing.
A MAC driver that normally uses "ReceiveChain", may use "ReceiveLookahead" if its buffers are full or nearly full. In this case, if the driver does not support multiple TransferData, forced frame slicing will occur.
Forced frame slicing can be circumvented by using "dedicated mode", but this will stop all other network traffic to/from the trace machine.

Ethernet adapters do not provide a "loopback" capability. This capability is necessary to capture outbound frames from the tracing machine. This is a design limitation of the NDIS protocol implementation.

Each instance of the NTRACE driver MAY ONLY be bound to a single instance of a MAC driver. This is by design. If multiple MAC driver instances exist, there MUST be an equal number of instances of the NTRACE driver.