Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was requested to capture all traffic to a specific static IP address from my Windows 7 machine, and I was wondering if there is anything built into Windows that would allow me to do so?

The device is on a fixed 192.168.254.1 IP address and is connected to my machine by a USB<->ethernet converter device.

EDIT:
I've looked at TCPView, but that seems to show me just how many packets were sent, doesn't seem to capture the details of what's being sent.

share|improve this question
    
This question is about software recomendation and must not be asked in SuperUser (its off-topic). Ask such questions in another StackExchange site named SoftwareRecomendations. –  Jet Aug 1 at 20:00
    
@Jet - This question is not about a software recommendation, this question is about how to accomplish a specific task (IP traffic capture) on a specific OS (Windows 7) with build in functionality. What I received instead were responses of "that's not possible, but try these tools". That makes this question fine for SU –  Mike Aug 2 at 0:16

3 Answers 3

up vote 5 down vote accepted

Windows does not have a built-in network capture tool (although it used to, back in NT 4.0).

Install Wireshark.

share|improve this answer
    
Yup, that seems to do it. Thanks. –  Mike Oct 24 '12 at 16:02

I know this is a crusty old article, but you can capture natively on Windows 7 without Wireshark and the packet processors (like Winpcap).

I highly recommend you check out the "netsh trace" command.

For what you want to do, you could utilize to dump packets to a file to be examined with Microsofts Message Analyzer. Elseif, you want to really use Wireshark, you can convert the resultant netsh trace .etl file into a .cap file. You can even have the capture continue even after a reboot for troubleshooting too.

share|improve this answer

Traffic capture is not a feature built into Windows. You would need administrative privileges as well as a third-party program such as WireShark in order to do this.

You can use the Resource Monitor (a program built into Task Manager) to view the open connections, but you can't view the actual traffic being sent and received. You need a kernel driver in order to do that, hence admin privileges are needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.