Capture network traces with the PowerShell module NetEventPacketCapture
Every network admin will at some point need to capture and view network events to help troubleshoot network issues. The PowerShell module NetEventPacketCapture is an interesting option to capture network tracesIT professionals have many tools that can enable the capturing and viewing of network traffic. Tools such as Wireshark and Netmon have been staples for performing network traces. Starting with Windows 7/2008 the netsh trace command became available to allow capturing traces via the command line.
The NetEventPacketCapture module
One tool I have recently started using is the PowerShell NetEventPacketCapture module to capture and show trace events. Microsoft released the module with Windows 8.1/2012 R2, so although it is a few years old, it is not a widely used tool. One of the main reasons why using this module is appealing to me is that you can do many of the tasks within PowerShell without having to use other tools.
In order to create a trace log (.etl file), you must use four cmdlets from the NetEventPacketCapture module. In addition, you need a tool to view the trace file. This would be the bare minimum process for capturing a network event trace:
- Use New-NetEventSession to create a trace session. For remote traces you can use the ‑CimSession
- Add-NetEventProvider to add an event-tracing provider to the session you created. For instance the provider “Microsoft-Windows-TCPIP” would trace TCP/IP events.
- Start-NetEventSession will begin logging live events to the .etl file.
- Stop-NetEventSession will end the trace session.
- Finally, to view the .etl file, you can use a number of tools. In this article, I will use the Get-WinEvent cmdlet in PowerShell.
Read more on 4Sysops.com
Previous Post
Next Post