Capturing network packets
To activate and deactivate network traffic captures, use the Trace (xbtrace.exe) (NDA topic) tool.Start a network capture
To start a network capture, use thexbtrace start netcap command. This initiates a network capture on the default console.
To start tracing on a console other than the default console, use the /X: argument.
Stop a network capture
To stop a network capture, usexbtrace stop. By default, the capture is saved as xbtrace.etl in the current directory. To save to a different location or file name, provide the path and file name after stop. For example, xbtrace stop c:\temp\sample.etl saves the trace file as c:\temp\sample.etl. If you specify an existing file name, xbtrace provides an informative message and the trace continues to run.
On-console trace data isn’t lost when you specify an existing file name. There’s currently no way to overwrite an existing trace file. You must delete the existing file or specify a different file name for the new trace.
/X argument to specify a console address.
Using network capture data
The following tools can open a raw network captures. Choose a tool according to your preferences.-
Use Microsoft Message Analyzer (MMA) to open etl network captures and view network events. Analyze the captured file directly in MMA. You can also use MMA to save the captured packet data as a PCAP file, which you can then open for analysis in other tools, such as Fiddler or Wireshark.
[!NOTE] Microsoft Message Analyzer is archived and no longer maintained.
- Use Network Monitor (netmon) to open a network capture etl file and view packets. To fully parse all network events, set the ‘Windows Parser Profile’ under Tools > Options > Parser Profiles. Analyze the captured, raw network events directly in netmon.