Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Packet capturing on Windows with netsh

isc.sans.edu

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Packet capturing on Windows with netsh

#11

Post by c0nsumer »

This is missing one of the most useful features of using netsh for this: boot time captures.

By using the "persistent=yes" argument one can cause the capture to keep running through a reboot. This is incredibly useful when trying to troubleshoot something that happens before login. This was very, very difficult before without a tap, span port, etc.

I wrote a small article about doing this a few years back, for anyone who is interested: https://nuxx.net/blog/2010/08/17/network-capture-during-boot...

Also, if you'd like to get these in a format that can be read using Wireshark, Microsoft Message Analyzer (mentioned in the original article) can export in .cap format. Or if you want to stick with Microsoft tools just open the ETL in Network Monitor and use it for more traditional frame-oriented capture analysis.

Re: Packet capturing on Windows with netsh

#13

Post by c0nsumer »

pvsnp wrote: post #3

I think the key insight here is the availability of Message Analyzer app -- I haven't used it but that's a good alternative that's supported than the hoops you sometimes have to join to run Wireshark.

Look at it closely. It's neat, but it is different from the frame-oriented approach of Wireshark / Network Monitor. It's great, but... different.

Re: Packet capturing on Windows with netsh

#15

Post by jmsguy »

ape4 wrote: post #14

But if you install Wireshark does it capture traffic on the LAN (ie that doesn't begin or end with the current PC). I never had any luck with that on Windows.

Not unless (a) your PC is routing traffic or (b) your PC is connected to a hub vs. a switch [1].

Unless one of these things is happening (even if your card is in promiscuous mode), those packets won't make it into your machine.

[1] http://www.webopedia.com/DidYouKnow/Hardware_Software/router...

Re: Packet capturing on Windows with netsh

#18

Post by mobiplayer »

ohm wrote: post #9

Tried running a capture while downloading a large file in Firefox and the download failed when I started the capture. Wouldn't recommend running this on a server.

Hey, not sure what happened there but I've used this for years on hundreds of different systems and never had that issue. Not even once as far as I can remember.

I thoroughly recommend it, but if you don't like it and can install Network Monitor, you can use NMCap which is also a command line tool.

Re: Packet capturing on Windows with netsh

#19

Post by noselasd »

ape4 wrote: post #14

But if you install Wireshark does it capture traffic on the LAN (ie that doesn't begin or end with the current PC). I never had any luck with that on Windows.

A wired LAN these days pretty much imply an ethernet switch, ethernet switches doesn't send you any frames that should go to another device if it knows which port that device is plugged into. You can't sniff traffic that doesn't reach your computer - so this isn't related to using Windows or Wireshark.

Most managed ethernet switches have a span/mirror port though, where you can mirror all traffic to all ports out on a single port, so you can plug into that port to capture your LAN traffic.

Re: Packet capturing on Windows with netsh

#20

Post by windowsworkstoo »

c0nsumer wrote: post #13
pvsnp wrote: post #3

I think the key insight here is the availability of Message Analyzer app -- I haven't used it but that's a good alternative that's supported than the hoops you sometimes have to join to run Wireshark.

Look at it closely. It's neat, but it is different from the frame-oriented approach of Wireshark / Network Monitor. It's great, but... different.

Yes and frustratingly they have deprecated Network Mon at version 3.4 in favour of Message Analyser, so grab a copy while you still can.
Post reply on HN