>

Capture a network packet trace on Windows with netsh trace

Start an ETL packet capture with the built-in netsh trace context — the lightweight alternative to installing Wireshark on servers.

WindowsnetshcapturetroubleshootingMedium risk
Run netsh trace start capture=yes tracefile=C:\temp\nettrace.etl to begin capturing, and netsh trace stop to finish and merge the trace file.

01Command

Command
$ netsh trace start capture=yes tracefile=C:\temp\nettrace.etl maxsize=512

02What it does

netsh trace has shipped with Windows since Server 2008 yet is almost never remembered when a capture is needed. Besides raw packets (capture=yes), it can trace provider scenarios (e.g. scenario=Connectivity) and emits a CAB with correlated logs on stop. Open the resulting .etl in Microsoft Network Monitor or convert it with etl2pcapng for Wireshark.

03Risk

RiskMedium risk
RequirementsRun Command Prompt as Administrator
!Warning: The capture keeps writing until you run netsh trace stop — a forgotten stop fills the file up to maxsize and keeps recording; ETL files are also large, so give tracefile a roomy path.

04Undo

Undo
$ netsh trace stop

05Sources

  • netsh trace | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents 'netsh trace start' with capture=yes and tracefile parameters to begin a packet capture, and 'netsh trace stop' to end it and correlate the logs.
  • NETSH - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: SS64 documents the netsh trace context, including scenario-based tracing and capture options.

Last verified: 2026-09-17 · Category: Network

06Related solutions

Flush the DNS resolver cache on Windows
WindowsnetworkDNStroubleshooting

Purge cached DNS lookups so Windows re-resolves hostnames from scratch — the fix for 'the new server is live but my browser still hits the old one'.

Medium risk ✓ 2026-09-17
Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17
Show the local ARP table on Windows (find devices on your LAN)
Windowsnetworktroubleshootinglan

Display the IP-to-MAC address cache Windows built by talking to neighbors — a quick way to spot which devices are on your subnet.

Low risk ✓ 2026-09-17