Windows Packet Capture-PKTMON vs. Older NETSH TRACE

Network troubleshooting and analysis are essential tasks for maintaining a healthy and secure network environment. In the realm of Windows operating systems, the introduction of the built-in packet capture tool “pktmon” has provided administrators and analysts with a convenient way to capture, filter, and analyze network traffic.


Packet Monitor, commonly referred to as “pktmon,” is a powerful command-line utility integrated into Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022. Its inception in the Windows 10 May 2020 Update (version 2004) marked a significant advancement in network troubleshooting capabilities. Let’s begin by understanding the basics of pktmon and its core functionalities.

Starting and Stopping a Capture

 firstly, launch Command Prompt as an administrator, and then execute the following command:

pktmon start --etw -m real-time

The --etw flag utilizes Event Tracing for Windows, while the -m real-time flag enables real-time monitoring of network traffic. , simply run:

pktmon stop

Filtering Captured Packets

pktmon offers the ability to filter captured packets based on specific criteria. For instance, to capture packets involving a particular IP address, execute the following command:

pktmon filter add -i <ip_address>

Replace <ip_address> with the IP address of interest. This feature allows you to focus on specific network interactions, streamlining your analysis.

Converting Captures to PCAP Format

While pktmon natively saves captures in the ETL (Event Trace Log) format, it can be more convenient to work with captures in the universally supported PCAP format, especially when using tools like Wireshark. To convert an ETL capture to PCAP format, employ the following command:

pktmon etl2pcap {etlfile} --out {pcap_name}.pcap

Replace {etlfile} with the ETL file to be converted and {pcap_name} with the desired name for the resulting PCAP file.

A Practical Example: Capturing HTTPS Traffic

To illustrate the application of pktmon, consider the following example of capturing HTTPS traffic involving the IP address and port 443:

  1. Add a filter for the desired IP address and port:
pktmon filter add -i -p 443
  1. Verify the applied filter:
pktmon filter list
  1. Start the real-time packet capture:
pktmon start --etw -m real-time
  1. Stop the capture once sufficient data has been collected:
pktmon stop
  1. Convert the ETL capture to PCAP format for analysis in Wireshark:
pktmon etl2pcap PktMon.etl --out pktmon_https_capture.pcap

pktmon vs. netsh trace: Choosing the Right Tool

While pktmon has undoubtedly brought network packet capture to the forefront, it’s crucial to understand its predecessor, netsh trace, and the differences between the two tools.

pktmon: Modern and User-Friendly

pktmon offers a more user-friendly experience for capturing and analyzing network traffic. Its simplified command-line interface and direct support for PCAP output make it an attractive option for basic packet capture tasks. However, for advanced network analysis, pktmon might fall short, lacking the extensive filtering capabilities and graphical interfaces of specialized tools like Wireshark.

netsh trace: Legacy Packet Capture

netsh trace, a component of the broader netsh utility, provides packet capturing functionality, albeit with less user-friendly commands. While it can output captures in ETL format, which can later be converted to PCAP, its focus lies more on configuration and monitoring of Windows networking components. As such, netsh trace may not offer the same level of simplicity as pktmon but can still serve network administrators well.

Converting ETL Captures for Analysis

After capturing network traffic using pktmon or netsh trace, the captured data can be converted to a more widely recognized format for analysis in tools like Wireshark. There are two notable methods for conversion:

  1. Microsoft Message Analyzer (Retired): This tool, now retired, allowed users to open the ETL file and export the captured messages to a PCAP format file for use in Wireshark.
  2. Microsoft GitHub Script ETL2PCAPNG: A free tool available on GitHub, “etl2pcapng,” can convert ETL files to the PCAPNG format, enhancing compatibility with popular packet analysis tools. This option provides a more streamlined approach for converting captures.

Packet Capture Methods on Windows Systems: Tools and Techniques

Packet capture on Windows systems can be done using various tools and methods.One of the most commonly used tools for packet capture on Windows is Wireshark, which is a powerful open-source network protocol analyzer. Here’s a basic guide on how to perform packet capture using Wireshark:

  1. Install Wireshark: If you don’t have Wireshark installed, you can download it from the official website:
  2. Launch Wireshark: After installing Wireshark, launch the application. You might need administrative privileges to capture packets on your network interface.
  3. Select Network Interface: In the Wireshark application, you’ll see a list of available network interfaces. Choose the interface through which you want to capture packets (e.g., Ethernet, Wi-Fi).
  4. Start Capturing Packets: Once you’ve selected the desired network interface, click the “Start” or “Capture” button to begin capturing packets. Wireshark will start capturing packets on the chosen interface in real-time.
  5. Analyze Packets: Wireshark will display a live stream of captured packets. You can apply filters to narrow down the packets you’re interested in analyzing. You can also stop the capture process at any time.
  6. Save Capture File: To save the captured packets for later analysis, go to “File” > “Save” or “File” > “Save As” and choose a location on your system to save the capture file. The capture file will have a “.pcap” extension.
  7. Analyze Saved Capture: You can reopen the saved capture file in Wireshark for further analysis. This is useful if you want to review captured packets or share the capture with others for troubleshooting.

Overview of how to use pktmon

pktmon is a built-in packet monitoring tool in Windows that allows you to capture network traffic at the packet level. It’s available in Windows 10 and later versions. Unlike Wireshark, which provides a graphical user interface, pktmon is a command-line tool. Here’s an overview of how to use pktmon:

  1. Open Command Prompt as Administrator: To use pktmon, you need to open the Command Prompt with administrative privileges. Right-click on the “Start” button, select “Command Prompt (Admin)” or “Windows Terminal (Admin).”
  2. Start Capturing Packets: Use the following command to start capturing packets using pktmon:
    pktmon start --etw

    This command starts capturing packets and logs them using the Event Tracing for Windows (ETW) framework.

  3. Stop Capturing Packets: To stop capturing packets, run the following command:
    pktmon stop

    This command stops the packet capture process.

  4. View Captured Packets: You can view the captured packets using the following command:
    pktmon format -o <output_file>

    Replace <output_file> with the path where you want to save the captured packet information. This command formats the captured data into a readable text format.

  5. Analyze Captured Data: you can analyze the captured packet information using any text editor or analysis tools. The captured data will encompass details about each packet, including source and destination IP addresses, ports, protocols, and more.
  6. Clear Captured Data: In the event that you wish to clear the accumulated data, you can employ the following command:

Copy code

pktmon clear

This command clears the captured packet data.

Keep in mind that pktmon captures packet-level information and doesn’t provide the same level of protocol analysis and filtering capabilities as tools like Wireshark.

Windows Packet Capture
Windows Packet Capture

Leave a Comment