One issue with Netsh is that it generated ETL files, which are not a file format that Wireshark supports. ( NOTE: With the persistent=yes it means that the traffic capture will persist after reboots and will only stop when someone runs a netsh stop command) Netsh trace start capture=yes tracefile=c: et.etl persistent=yes maxsize=4096 Netsh can be configured using the following commands to generate a network trace on a specific Windows VM It can also be used to collect network packet traces.

In Windows there is a feature called netsh which is a command-line scripting utility that allows you to display or modify the network configuration of a computer. Secondly, I might be working in a pretty locked down environment where I might not have access to download and install wireshark at all, and why should I since I have built-in functionality in Windows? So when you are working on a production workload and something is not right with the network on that Windows VM, what do you do? Wireshark to the rescue? well no… not quite, I wouldn’t install that on a production server since it installs WinPcap/NpCap which is an NDIS filter driver on the network card.

How to open wireshark captures