windows-powershell-docs
windows-powershell-docs copied to clipboard
NetEventPacketCapture needs to support chained capture files
LOGMAN supports chained capture files (-Mode NewFile) with %d in the file name to indicate where to increment the file number. NETSH does not support this, but you can work around it like this (.CMD syntax of %):
netsh trace start capture=yes maxsize=1 TRACEFILE=.\deleteme.etl logman start ndiscap -p Microsoft-Windows-NDIS-PacketCapture -mode newfile -max 200 -o .\realdata%%d.etl -ets
Is there something similar with the PowerShell commands? Can we capture the Microsoft-Windows-NDIS-PacketCapture event or similar event for network and firewall packet captures?