12

I want to know if there is a tool that I can use to script out packet captures (command line) without having to install anything (and preferably not even pcap). This is for Windows machines; the tool would be run with administrative credentials.

I just want to glean the source/destination IP and port pair for packets sent in and out. Netstat will not work, because sessions can open and close within milliseconds and would be missed.

Quick googling reveals either I am going to have to pay for an expensive tool or stick to GUI based tools.

0
19

Windows 7 and above have this feature built in. http://blogs.msdn.com/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx

The short version:

  1. Open an elevated command prompt and run: netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl (make sure you have a \temp directory or choose another location).

  2. Reproduce the issue or do a reboot if you are tracing a slow boot scenario.

  3. Open an elevated command prompt and run: netsh trace stop

Your trace will be stored in c:\temp\nettrace-boot.etl** or where ever you saved it. You can view the trace on another machine using netmon.

14
  • Great, definitely a nice tool for a network administrator – person Feb 18 '15 at 14:41
  • Do you by any chance know if the resulting file can be analyzed using Wireshark on an Ubuntu 14.04 system? – kasperd Feb 19 '15 at 7:55
  • Not directly. blogs.technet.com/b/yongrhee/archive/2013/08/16/… – mfinni Feb 19 '15 at 8:03
  • And here I was hoping I could point some less technical Windows users at your fairly simple instructions for capturing a packet trace. Not going to work so well, if I have to guide those same users through all the steps to install another program just for converting the resulting file to a usable format :-/ – kasperd Feb 19 '15 at 12:03
  • 1
    The current/ working link to @mfinni comment: web.archive.org/web/20140531052949/http://blogs.technet.com/b/… I couldn't find it in the Technet Archive – AdamKalisz Apr 24 '20 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.