Open Source PCAP warehouse with dependency mapping. (by Mike Canney)
How TCP Works - Window Scaling

Capture Packets With Microsoft’s netsh (by Tony Fortunato)

There are many challenges we face when I want to capture packets while troubleshooting.  

  • Installing a packet capture tool such as Microsoft’s Netmon or Wireshark, might be a deal breaker for some admins.
  • Using a span or mirror port might not be available or add excessive latency to packets.

In most cases I would be happy with a solution that simply captures the packets and I can analyze the data on another system.

Many analysts I speak to are not aware that most Microsoft operating systems allow you to capture packets without installing anything on it.  The command is netsh trace start etc… 

In this video I show you how to get started by capturing data and making the trace compatible for Wireshark.



Continue reading other LoveMyTool posts by Tony Fortunato »