12

I want to know if there is a tool that I can use to script out packet captures (command line) without having to install anything (and preferably not even pcap). This is for Windows machines; the tool would be run with administrative credentials.

I just want to glean the source/destination IP and port pair for packets sent in and out. Netstat will not work, because sessions can open and close within milliseconds and would be missed.

Quick googling reveals either I am going to have to pay for an expensive tool or stick to GUI based tools.

0

1 Answer 1

19

Windows 7 and above have this feature built in. http://blogs.msdn.com/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx

The short version:

  1. Open an elevated command prompt and run: netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl (make sure you have a \temp directory or choose another location).

  2. Reproduce the issue or do a reboot if you are tracing a slow boot scenario.

  3. Open an elevated command prompt and run: netsh trace stop

Your trace will be stored in c:\temp\nettrace-boot.etl** or where ever you saved it. You can view the trace on another machine using netmon.

14
  • Great, definitely a nice tool for a network administrator
    – person
    Feb 18, 2015 at 14:41
  • Do you by any chance know if the resulting file can be analyzed using Wireshark on an Ubuntu 14.04 system?
    – kasperd
    Feb 19, 2015 at 7:55
  • Not directly. blogs.technet.com/b/yongrhee/archive/2013/08/16/…
    – mfinni
    Feb 19, 2015 at 8:03
  • And here I was hoping I could point some less technical Windows users at your fairly simple instructions for capturing a packet trace. Not going to work so well, if I have to guide those same users through all the steps to install another program just for converting the resulting file to a usable format :-/
    – kasperd
    Feb 19, 2015 at 12:03
  • 1
    The current/ working link to @mfinni comment: web.archive.org/web/20140531052949/http://blogs.technet.com/b/… I couldn't find it in the Technet Archive
    – AdamKalisz
    Apr 24, 2020 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .