Capture network packets in Windows and visualize in Wireshark
Contents
Capture packets natively from Windows
When having trouble installing Wireshark, Microsoft’s built in packet capture command netsh can be used.
Display Windows capture interfaces
>netsh trace show interfaces
Wireless LAN adapter Wi-Fi:
Description: Dell Wireless 1560 802.11ac
Interface GUID: {85001906-73BC-4911-A36C-5431E7DF030E}
Interface Index: 19
Interface Luid: 0x47008000000000
Start capturing packets
>netsh trace show status There is no trace session currently in progress
We launch packets capture.
>netsh trace start capture=yes CaptureInterface="Wi-Fi" tracefile=wificap.etl
Trace configuration: ------------------------------------------------------------------- Status: Running Trace File: C:\Development\work\wificap.etl Append: Off Circular: On Max Size: 512 MB Report: Off
Once finished, we stop the capture
>netsh trace stop
Merging traces ... done
Generating data collection ... done
The trace file and additional troubleshooting information have been compiled as "C:\Development\work\wificap.cab".
File location = C:\Development\work\wificap.etl
Tracing session was successfully stopped.
Convert etl file to pcap file
In Microsoft GitHub, there is a tool to transform etl files to pcap file (usable by WireShark)
Download etl2pcapng
Download etl2pcapng from GitHub https://github.com/microsoft/etl2pcapng/releases
# wget -q https://github.com/microsoft/etl2pcapng/releases/download/1.5.0/etl2pcapng.zip # unzip etl2pcapng.zip Archive: etl2pcapng.zip creating: etl2pcapng/ creating: etl2pcapng/x64/ inflating: etl2pcapng/x64/etl2pcapng.exe inflating: etl2pcapng/x64/etl2pcapng.pdb creating: etl2pcapng/x86/ inflating: etl2pcapng/x86/etl2pcapng.exe inflating: etl2pcapng/x86/etl2pcapng.pdb
Convert etl file to pcap
>etl2pcapng\etl2pcapng\x64\etl2pcapng.exe etl2pcapng <infile> <outfile> Converts a packet capture from etl to pcapng format.
>etl2pcapng\etl2pcapng\x64\etl2pcapng.exe wificap.etl wificap.cap IF: medium=wifi ID=0 IfIndex=19 Converted 2161 frames
View the file in WireShark
