windows-powershell-docs icon indicating copy to clipboard operation
windows-powershell-docs copied to clipboard

NetEventPacketCapture needs to support chained capture files

Open Malcolm-Stewart opened this issue 3 years ago • 0 comments

LOGMAN supports chained capture files (-Mode NewFile) with %d in the file name to indicate where to increment the file number. NETSH does not support this, but you can work around it like this (.CMD syntax of %):

netsh trace start capture=yes maxsize=1 TRACEFILE=.\deleteme.etl logman start ndiscap -p Microsoft-Windows-NDIS-PacketCapture -mode newfile -max 200 -o .\realdata%%d.etl -ets

Is there something similar with the PowerShell commands? Can we capture the Microsoft-Windows-NDIS-PacketCapture event or similar event for network and firewall packet captures?

Malcolm-Stewart avatar Sep 08 '22 22:09 Malcolm-Stewart