---
title: "Packet Capture with Netsh Trace: A PowerShell Guide"
description: "Perform packet captures without extra software. Learn how to use the Netsh Trace command effectively."
canonical: "https://adamtheautomator.com/netsh-trace/"
---

# Packet Capture with Netsh Trace: A PowerShell Guide

> Perform packet captures without extra software. Learn how to use the Netsh Trace command effectively.

Source: https://adamtheautomator.com/netsh-trace/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Packet Capture with Netsh Trace: A PowerShell Guide](https://adamtheautomator.com/wp-content/uploads/2019/06/5d238ae5c824b514689ea5b4.jpg)

# Packet Capture with Netsh Trace: A PowerShell Guide

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)30 June 20191 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[PowerShell](/tag/powershell/)

Have you ever had a need to do a quick packet capture on something but didn’t want to mess with installing Wireshark or Netmon? You’re in luck! Today, I decided to PowerShellify netsh trace and build a method to kick off a packet capture via netsh.

In [this script](https://github.com/adbertram/Random-PowerShell-Work/blob/master/Networking/PacketCapture.ps1) there are two functions; `Start-PacketCapture` and `Stop-PacketCapture`. Both are very simple functions that just act as wrappers around the netsh commands with a little bit of validation in there.

**_Related: [PowerShell Functions: Introduction](https://adamtheautomator.com/powershell-functions/)_**

Let’s say you’re having some problems with network connectivity on your local machine and want to quickly fire up a packet capture. Download the PS1 file I’ve created with the functions inside and dot source it. This will get both functions in your current session.

```powershell
.\PacketCapture.ps1
```

Once you do this, you can then start the packet capture.

```powershell
Start-PacketTrace C:\SomeTraceFile.etl
```

The function then invokes netsh trace and once it releases control back to your console the trace is started. You can confirm by viewing the size of _C:\\SomeTraceFile.etl_. Replicate what you want to do and then stop the packet capture.

```powershell
Stop-PacketTrace
```

You should now have recorded all network activity in the _C:\\SomeTraceFile.etl_ file.

Pretty cool, huh? Well, if you try to open the ETL file up in Wireshark it’s not going to work out of the box. It will first need to be converted to do so. I haven’t automated that yet but it can be done using the netsh trace output. These two functions can be built upon also. If this isn’t enough for you feel free to steal it and make it better!

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fnetsh-trace%2F&text=Packet%20Capture%20with%20Netsh%20Trace%3A%20A%20PowerShell%20Guide)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fnetsh-trace%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fnetsh-trace%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81d9a96fd378dc47c60a/121705eb357e56699bca0c73e19055d636ddcfdd7418053591d9dbf69af050e2.jpg)

### [Audit Every SMB Share Permission with Get-SmbShareAccess](/audit-smb-share-permissions-powershell/)

Audit SMB share permissions with Get-SmbShareAccess, flag Everyone and Full Control grants, and check the NTFS ACL before you revoke anything.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b813190efe4fbf5ba49f1/01cf2782293526c501009180bd8555b6e73ab2cef8c62a48d76f7970916c3080.jpg)

### [Migrate DHCP Without Losing Leases with Export-DhcpServer](/migrate-dhcp-server-export-dhcpserver/)

Move a DHCP server with Export-DhcpServer and Import-DhcpServer, keeping leases intact, then authorize the new server in Active Directory.

![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg)

### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/)

Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)