0

I'm looking to capture all IP traffic on a Windows machine to/from all interfaces.

  • I must be able to capture the process ID which generated the outgoing traffic.
  • I need to be able to trigger capture from the command line and automatically parse the capture file in an external tool.

I'm trying to use netsh, which appears to be able to do the job. However I'm having problems figuring out how to extract the information I need.

Running netsh trace start persistent=yes capture=yes tracefile=xxx then netsh trace stop seems to capture the information I need. If I load the generated .etl file into Windows Message Analyzer (WMA) then I can see IP traffic along with a lot of other event information

My specific problems are:

  • How do I restrict netsh to only capture IP traffic?
  • How do I parse an etl file without a tool like WMA?

Regarding the second question. I've managed to convert the etl file to an xml file (using tracerpt or netsh trace convert. However the data seems to be incomplete. I can't see, for example, an IP address which I know traffic was sent to (confirmed in WMA). Possibly it's all hidden in some binary blob.

Improve this question
7
  • Why would you not use WMA for this? It's meant to be used for the. Other tools that you want to use will also have to know about the file format? I don't really get what your goal here would be. As for limiting what netsh captures: Using Netsh to Manage Traces and netsh trace show capturefilterHelp.
    – Seth
    May 26, 2017 at 7:58
  • As mentioned, I need this to be triggered from the command line. The purpose is to build a tool which can run in the background and, amongst other things, gather traffic. Using the UI isn't workable. I'm certainly open to WMA if there's a way of driving it from the command line, but I'm unaware of one.
    – Andrew Parker
    May 26, 2017 at 8:17
  • You said you need to trigger the capture, which is done by netsh, using the command line. As netsh is already a command line tool this is pretty easy. Your current approach is meant for debugging. If you try to monitor the server you'd usually go for a mirroring of traffic and send that traffic straight to the analyzer.
    – Seth
    May 26, 2017 at 8:26
  • I already understand how to trigger netsh and capture, that much is easy. My problem (aside from reducing capture noise) is I need to also analyse the traffic automatically. Which means processing the file without a UI or human. If WMA supports this then I'm all ears. Imagine I have a test which I need to run regularly on different machines. I want to automate end-to-end the capture and analysis and ask specific questions from the capture about which process sent what traffic.
    – Andrew Parker
    May 26, 2017 at 9:41
  • Assuming you're writing the software yourself why not just include output for that kind of information within the application? The Message Analyzer directory actually does contain a parse.exe. It probably won't do what you need though. How do you expect to automate the analysis if you need to supply information for that analysis? My guess is still that you're looking at the wrong kind of tool. Maybe try to include an actual example of what you would the workflow like to be and what kind of actions you're actually trying to perform and what kind of data you're interested in.
    – Seth
    May 26, 2017 at 10:10

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .