pktmon

Run PowerShell or Command Prompt as Administrator.

Basic capture

1
2
  pktmon filter remove
  pktmon start --capture --pkt-size 0 --file-name C:\Temp\capture.etl

Reproduce the network issue, then:

1
  pktmon stop

Convert the capture for Wireshark:

1
  pktmon etl2pcap C:\Temp\capture.etl --out C:\Temp\capture.pcapng

Or convert it to readable text:

1
  pktmon etl2txt C:\Temp\capture.etl --out C:\Temp\capture.txt

Capture a specific IP address

1
2
3
  pktmon filter remove
  pktmon filter add WebServer -i 10.53.252.65
  pktmon start --capture --pkt-size 0 --file-name C:\Temp\webserver.etl

After reproducing the issue:

1
2
  pktmon stop
  pktmon etl2pcap C:\Temp\webserver.etl --out C:\Temp\webserver.pcapng

Capture a TCP port

For HTTPS:

1
2
3
  pktmon filter remove
  pktmon filter add HTTPS -t TCP -p 443
  pktmon start --capture --pkt-size 0 --file-name C:\Temp\https.etl

You can combine IP and port:

1
  pktmon filter add TargetHTTPS -i 10.53.252.65 -t TCP -p 443

Real-time display

On newer builds:

1
2
3
  pktmon filter remove
  pktmon filter add HTTPS -t TCP -p 443
  pktmon start --capture --pkt-size 0 --log-mode real-time

Stop it with Ctrl+C or:

1
  pktmon stop

Useful diagnostic commands:

1
2
3
4
5
  pktmon status
  pktmon filter list
  pktmon counters
  pktmon list
  pktmon help

–pkt-size 0 captures complete packets and may expose credentials or application data, so protect and delete captures appropriately. Without it, packets may be truncated. Full command reference: pktmon command documentation (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/pktmon).

Example packet capture for Radius trubleshooting:

Run pktmon as Administrator on the remote gateway server, filtering UDP traffic to the NPS IP and RADIUS authentication port.

Replace 10.53.252.65 with the NPS server IP:

New-Item -ItemType Directory -Path C:\Temp -Force

1
2
3
4
5
  pktmon filter remove
  pktmon filter add RadiusAuth `
      -i 10.53.252.65 `
      -t UDP `
      -p 1812

pktmon filter list

Start the capture:

1
2
3
4
5
  pktmon start `
      --capture `
      --comp nics `
      --pkt-size 0 `
      --file-name C:\Temp\radius-gateway.etl

Trigger an authentication attempt through the gateway, then stop:

pktmon stop

Convert it for Wireshark:

1
2
3
  pktmon etl2pcap `
      C:\Temp\radius-gateway.etl `
      --out C:\Temp\radius-gateway.pcapng

Open radius-gateway.pcapng in Wireshark and use:

radius

or:

udp.port == 1812

Capture accounting traffic too

RADIUS accounting normally uses UDP 1813. Each port needs a separate filter:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
  pktmon filter remove

  pktmon filter add RadiusAuth `
      -i 10.53.252.65 `
      -t UDP `
      -p 1812

  pktmon filter add RadiusAccounting `
      -i 10.53.252.65 `
      -t UDP `
      -p 1813

Legacy configurations may use UDP 1645 for authentication and 1646 for accounting. Confirm the configured ports in NPS properties. NPS UDP port documentation (https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-udp-ports-configure)

Dell OS10 Switch