Comments (4)
@kgibm FYI I found the ndiscap packet capture filtering documentation: run "netsh trace show CaptureFilterHelp". It does look very similar to the TCPIP ETW filtering I mentioned, but I don't see "TCP.AnyPort" in the documented filter types. In fact I only see L2 and L3 filters. Hopefully you can use pktmon to moot this shortcoming.
from etl2pcapng.
@kgibm, you can run it on a different box.
I think the "TCP.AnyPort" stuff you found is related to filtering for the TCPIP ETW provider rather than packet capture (run "netsh trace show providerfilterhelp Microsoft-Windows-TCPIP" to see some documentation). I don't know a way off the top of my head to filter the ndiscap packet capture at collection time. However, new systems have pktmon, which can do filtering:
pktmon filter add -t tcp -i 192.168.1.1 -p 6100
pktmon filter add -t udp
pktmon start -c
pktmon stop
[captures all UDP traffic AND all TCP traffic to/from 192.168.1.1 to/from port 6100 - see pktmon filter add /? for all parameters]
Note that etl2pcapng only works on ndiscap packet captures (i.e. the ones you collect with netsh.exe). For pktmon captures, you instead use pktmon to convert to pcapng. In an ideal world where everyone upgrades to new versions of Windows with pktmon available, etl2pcapng becomes an obsolete tool!
BTW if you find any functionality gaps in the pktmon pcapng convertor please let me know and perhaps it can be addressed. Thanks!
from etl2pcapng.
you can run it on a different box.
Thanks.
new systems have pktmon, which can do filtering
Thanks, I'll check it out! It seems like we need to change our instructions from netsh
to pktmon
primarily, and leave the netsh
instructions for older Windows builds.
BTW if you find any functionality gaps in the pktmon pcapng convertor please let me know and perhaps it can be addressed
Will do.
from etl2pcapng.
For reference, I've ended up with the following instructions:
Windows (newer versions)
Capture without port filtering
- Right-click Command Prompt } Run as Administrator
- Start the capture:
a. This command captures up to 2GB of total data. Change file-size in MB as needed.
pktmon start --capture --pkt-size 0 --file-size 2048 --log-mode circular
b. This command captures the entire packet. To minimize bytes per packet, set pkt-size to 96 for IPv4 and 128 for IPv6 traffic. You can go lower but it’s sometimes useful to have at least some of the TCP packet.
c. If you receive the error, "Packet monitor is already started," then first run "pktmon stop" and then re-run the "start" command. - Check for any errors running the previous commands in your terminal.
- Reproduce the problem.
- Stop the capture:
pktmon stop
- Convert the capture to pcapng format:
pktmon etl2pcap PktMon.etl
- Upload
PktMon.etl
andPktMon.pcapng
Capture with port filtering
- Right-click Command Prompt } Run as Administrator
- Configure the filtered port; replace %PORT% with the target port (for example, 80, 443, and so on):
pktmon filter add -t tcp -p %PORT%
- Start the capture:
a. This command captures up to 2GB of total data. Change file-size in MB as needed.
pktmon start --capture --pkt-size 0 --file-size 2048 --log-mode circular
b. This command captures the entire packet. To minimize bytes per packet, set pkt-size to 96 for IPv4 and 128 for IPv6 traffic. You can go lower but it’s sometimes useful to have at least some of the TCP packet.
c. If you receive the error, "Packet monitor is already started," then first run "pktmon stop" and then re-run the "start" command. - Check for any errors running the previous commands in your terminal.
- Reproduce the problem.
- Stop the capture:
pktmon stop
- Convert the capture to pcapng format:
pktmon etl2pcap PktMon.etl
- Upload
PktMon.etl
andPktMon.pcapng
Windows (older versions)
Capture without port filtering
- Right-click Command Prompt } Run as Administrator
- Start the capture:
a. This command captures up to 2GB each of total data. Change maxSize in MB as needed.
netsh trace start provider=Microsoft-Windows-TCPIP persistent=yes capture=yes packettruncatebytes=1500 tracefile=C:\diag_networktrace.etl maxSize=2048 perf=no
b. This command capture up to 1500 bytes per packet (essentially unlimited). To minimize bytes per packet, set packettruncatebytes to 96 for IPv4 and 128 for IPv6 traffic. You can go lower but it’s sometimes useful to have at least some of the TCP packet. - Check for any errors running the previous commands in your terminal.
- Reproduce the problem.
- Stop the capture:
netsh trace stop
- Download etl2pcapng and run it on
diag_networktrace.etl
- Upload
diag_networktrace.etl
anddiag_networktrace.pcapng
from etl2pcapng.
Related Issues (20)
- Conversion is not working. 0 packets converted. HOT 1
- Unable to download file HOT 3
- Windows Defender detected: Trojan:Script/Woreflint.A!cl in the etl2pcapng.zip HOT 4
- Malware warnings HOT 5
- Input ETL file does not contain a packet capture. HOT 1
- Arp packets to large after conversion HOT 2
- Crash HOT 1
- Support for packets captured by Microsoft-Windows-Ras-NdisWanPacketCapture HOT 1
- Using GitHub Actions to automate releases HOT 4
- not recognized event HOT 2
- Support for Filter Flags such as IP Address, Protocol, etc HOT 8
- Support for ETL files captured by Windows Performance Recorder HOT 1
- released version should be dropped in zip format Etl2Pcapng.zip HOT 10
- Show version number HOT 2
- Support winget Installation
- Additional data in comment. Add process name with PID in comment HOT 1
- Make output file name an optional command-line parameter HOT 3
- TCP PID always 4 HOT 1
- Input ETL file does not contain an ndiscap packet capture. HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from etl2pcapng.