Since the launch of Windows 10 we have seen how from Redmond they have not stopped working on improving what so far for most users of the Microsoft system is the best version. Before each new version or compilation, the company usually announces the news that each one of them will bring, however, there are sometimes that the company includes certain features or functions without mentioning anything about it. This is the case with the Windows 10 sniffer , a utility available on the system since the October 2018 update and few users have discovered and used it.
Step-by-Step Guide to Using the Windows 10 Sniffer.
Step 1: Install the Windows 10 Sniffer
To begin using the Windows 10 sniffer, you first need to install it on your computer. You can download the Microsoft Network Monitor tool from the official Microsoft website and follow the on-screen instructions to install it.
Step 2: Start Capturing Packets
Once the Windows 10 sniffer is installed, launch the application and start capturing packets. You can choose to capture traffic on a specific network interface or all interfaces depending on your requirements.
Step 3: Analyze the Captured Data
After capturing packets, you can analyze the captured data using various filters and display options provided by the Windows 10 sniffer. You can view detailed information about each packet, including source and destination IP addresses, protocols used, and payload data.
Step 4: Troubleshoot Network Issues
One of the key benefits of using the Windows 10 sniffer is its ability to help you troubleshoot network connectivity problems. By analyzing the captured data, you can identify issues such as packet loss, network congestion, or misconfigured network devices.
Tips for Using the Windows 10 Sniffer Effectively
- Use filters to focus on specific types of traffic and reduce noise in the captured data.
- Take advantage of the real-time statistics and graphs provided by the Windows 10 sniffer to monitor network performance.
- Save captured packets for later analysis and reference by exporting them to a file.
By following these tips and steps, you can effectively use the Windows 10 sniffer to analyze network traffic and troubleshoot connectivity issues on your Windows 10 computer.
How to use the PktMon.exe sniffer
To use Packet Monitor the first thing we have to do is open a command prompt window or Windows PowerShell with administrator permissions. Once in front of the command line, if we write pktMon and press Enter we will find that the syntax of the command and the possible commands to be used will be shown.
The correct syntax for PktMon is:
pktmon {filter | comp | reset | start | stop} [OPTIONS | help]
Being the commands:
- filter Manage packet filters.
- comp Manage registered components.
- reset Resets the counters to zero.
- start Starts package monitoring.
- stop For monitoring.
- format Converts the log file to text.
- unload Download the PktMon driver.
If we need more help on a specific command, then we can use the following command:
Pktmon command help . For example, Pktmon filter help.
As soon as this instruction is executed, information on the syntax and the possible commands to be used for pktmon filter or the indicated command will be shown. These are the syntax and commands available for each case:
pktmon filter {list | add | remove} [OPTIONS | help]
Commands:
- list: Shows active packet filters.
- add: Add a filter to control the packets that are reported.
- remove: Remove all filters.
pktmon comp {list | counters} [OPTIONS | help]
Commands:
- list: List all active components.
- counters: Shows the current counters by component.
pktmon reset [-counters]
Reset all component counters to zero.
pktmon start [-c {all | nics | [ids…]}] [-d] [–etw [-p size] [-k keywords]] [-f] [-s] [-r] [-m]
Starts package monitoring.
- -c, –components: Select the components to monitor. It can be all components, just NICs, or a list of ids. of components. The default is all.
-d, –drop-only: Only report dropped packets. By default, successful packet propagation is also reported. - ETW registration
- –Etw: Starts a log session for packet capture.
- -p, –packet-size: Number of bytes to be recorded for each packet. To always log the entire packet, set the value to 0. The default is 128 bytes.
- -k, –keywords: Hexadecimal bit mask (that is, the sum of the following marks) that controls which events are logged. By default, all events are logged.
- -f, –file-name: .etl registry file. The default is PktMon.etl.
- -s, –file-size: Maximum size of the log file in megabytes. The default is 512MB.
- Registration mode
- -r, –circular: New events overwrite the oldest when the maximum file size is reached.
- -m, –multi-file: A new file is created when the maximum file size is reached.
pktmon stop
Stops package monitoring and displays the results.
pktmon format log.etl [-o log.txt]
Convert the log file to text format.
pktmon unload
Stops the PktMon driver service and downloads PktMon.sys. Equivalent to ‘sc.exe stop PktMon’.
In Conclusion, the Windows 10 sniffer is a valuable tool for network troubleshooting and analysis. By following the steps outlined in this article and using the tips provided, you can make the most of this tool and improve your network troubleshooting skills. So why wait? Start using the Windows 10 sniffer today to enhance your network monitoring capabilities!