Windows Network Captures From the Command Line using NETSH

Network Captures with NETSH

Start a Network Capture

A simple capture:

c:\> netsh trace start persistent=yes capture=yes tracefile=c:\temp\%computername%_201312060857.etl

A slightly more complex capture:

c:\> netsh trace start capture=yes report=yes persistent=no maxSize=1024 fileMode=circular overwrite=yes correlation=yes tracefile=c:\temp\%computername%_201312060857.etl

Stop a Network Capture

c:\> netsh trace stop

View a Network Capture

• Network Monitor 3.4 [Deprecated]
  
• Microsoft Message Analyzer [Deprecated]
• WireShark

Resources

• Using Netsh to Manage Traces
• Using Network Monitor to View ETL Files