How can I perform a packet capture in Windows with built-in utility?
12/20/2019 16 12054
This article explains how to use the built-in Windows packet capture utility. A packet capture can assist with troubleshooting while investigating a network issue.
Open an elevated CMD prompt.
Open the start menu and type CMD in the search bar.
Right click the command prompt and Run as Administrator.
Enter the following command.
netsh trace start capture=yes
You can use the following command if you want to specify the IP address. netsh trace start capture=yes IPv4.Address=X.X.X.X
When completed, run the following command.
netsh trace stop
Once the data collection has finished, attach both the files (NetTrace.cab and NetTrace.etl) to the case; the file location will be displayed in the CMD prompt once the data collection has been finished.