May be this will help
c:\>logparser -h -i:NETMON
Input format: NETMON (NetMon capture files)
Parses NetMon capture files
FROM syntax:
<filename> [, <filename> ...]
Path(s) to NetMon .cap capture file(s)
Parameters:
-fMode TCPIP|TCPConn : Field mode; TCPIP: each record is a single
TCP/IP packet; TCPConn: each record is a
single TCP/IP connection [default value=TCPIP]
-binaryFormat ASC|PRINT|HEX : Format of binary fields [default value=ASC]
Fields:
CaptureFilename (S) Frame (I) DateTime (T) FrameBytes (I)
SrcMAC (S) SrcIP (S) SrcPort (I) DstMAC (S)
DstIP (S) DstPort (I) IPVersion (I) TTL (I)
TCPFlags (S) Seq (I) Ack (I) WindowSize (I)
PayloadBytes (I) Payload (S) Connection (I)
Examples:
Display total network traffic bytes per second:
LogParser "SELECT QUANTIZE(DateTime, 1) AS Second, SUM(FrameBytes) INTO
DATAGRID FROM myCapture.cap GROUP BY Second"