Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you advise me a network traffic logger for Windows 2008 R2? It expected to be executed as service and gather simple data "source ip/port, dest ip/port, packets size". I have tried to use ETW Tracing with Winsock AFD provider, but it produces enormous size of data, dropping a lot of packets and its hard to analyze resulting ETL log files.

share|improve this question

Wireshark can be launched from the command line. Then you just create a scheduled task that will start it on boot.

Command lines arguments for wireshark:

Else you could also do port mirroring from the switch on another port to collect data.

Depending on how the network traffic is done, you could use process monitor from Sysinternals. It can log activity since boot directly (option in tools). Network traffic is logged if using windows api. Be sure to "drop filtered entry" and to only log network.

When you will launch again the tool, it will detect it and ask for retrieving the logged entries.

share|improve this answer

Best product I know of is Microsoft Network Monitor. It's a free download and highly extensible / maintained by Microsoft. I've used most of the others, but I always come back to this one when I need to get something done.

There are also additional parsers on Codeplex, but the built in stuff is pretty robust.

Network Monitor Blog Site

Download Links

share|improve this answer
I'd use network monitoring at the switch or router level to do your 'service' based monitoring. – James Apr 2 '12 at 18:29

Have you looked at netmon? ETW will provide a lot of data but shouldn't drop packets.

share|improve this answer
Is there way to launch netmon as service and log network activity? – Stan Mar 21 '12 at 3:59
it's possible. out of curiosity why do you want to launch it as a service? Are you looking for boot traffic? – Jim B Mar 21 '12 at 19:43
Service is not a must. Any way that allow to run it without interactive session is applicable. I just want to launch network activity logging on remote server for a week or two, so launching netmon in a RDP session is not acceptable. – Stan Mar 22 '12 at 6:39
Id probably use task scheduler with the command line version but you can certainly do this with a service (since services are scheduled tasks there isn't much difference) – Jim B Mar 22 '12 at 15:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.