Every network admin will at some point need to capture and view network events to help troubleshoot network issues. The PowerShell module NetEventPacketCapture is an interesting option to capture network tracesIT professionals have many tools that can enable the capturing and viewing of network traffic. Tools such as Wireshark and Netmon have been staples for performing network traces. Starting with Windows 7/2008 the netsh trace command became available to allow capturing traces via the command line.

The NetEventPacketCapture module

One tool I have recently started using is the PowerShell NetEventPacketCapture module to capture and show trace events. Microsoft released the module with Windows 8.1/2012 R2, so although it is a few years old, it is not a widely used tool. One of the main reasons why using this module is appealing to me is that you can do many of the tasks within PowerShell without having to use other tools.

In order to create a trace log (.etl file), you must use four cmdlets from the NetEventPacketCapture module. In addition, you need a tool to view the trace file. This would be the bare minimum process for capturing a network event trace:

  • Use New-NetEventSession to create a trace session. For remote traces you can use the ‑CimSession
  • Add-NetEventProvider to add an event-tracing provider to the session you created. For instance the provider “Microsoft-Windows-TCPIP” would trace TCP/IP events.
  • Start-NetEventSession will begin logging live events to the .etl file.
  • Stop-NetEventSession will end the trace session.
  • Finally, to view the .etl file, you can use a number of tools. In this article, I will use the Get-WinEvent cmdlet in PowerShell.
Read more on 4Sysops.com

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts

Technical

Restart multiple computers with the PowerShell PCSVDevice module

To restart multiple computers with PowerShell and without relying on functionality of the remote operating system, you can use the PCSVDevice module. The module contains several useful cmdlets for out-of-band management and supports the IPMI Read more…

Technical

Remotely migrate user data with USMT and PowerShell

USMT has been a staple for system administrators for years and has greatly reduced the time to migrate data between computers. USMT has the ability to migrate user files, OS settings, and application settings. It Read more…

Technical

Deploy VMware VMs with PowerCLI and MDT

If you are managing Windows servers, chances are you have a mix of physical and virtual servers in your data center. While VMware provides a method to create VMs from templates to simplify server deployments, Read more…