Aug 14, 2026/Windows

Windows can record your network traffic, no downloads needed

By TechWalrus
A terminal window running packet capture commands.

Your Windows PC can record the network traffic it sends and receives. You don't have to install a thing. Packet Monitor ships with Windows 10 and Windows 11, and it has sat there quietly for years.

Record your traffic with one command

Open a terminal as administrator and type pktmon start --capture. Windows starts logging the packets moving through its network adapters. When you have seen enough, type pktmon stop and it writes the capture to a file called PktMon.etl.

There are two catches. Out of the box the tool saves only the first 128 bytes of each packet. Microsoft says the first 128 bytes should cover the header of most packets, the part that says where they are going, but not everything they carry. Add --pkt-size 0 to the start command and it keeps full packets instead. The log also tops out at 512 MB, and during a longer capture the tool starts overwriting the oldest packets.

Microsoft pktmon start reference

PS C:\Users\Admin> pktmon start --capture

Logger Parameters:
    Logger name:        PktMon
    Logging mode:       Circular
    Log file:           C:\Users\Admin\PktMon.etl
    Max file size:      512 MB
    Memory used:        128 MB

Collected Data:
    Packet counters, packet capture

Capture Type:
    All packets

Monitored Components:
    All

PS C:\Users\Admin> pktmon stop
Flushing logs...
Merging metadata...
Log file: C:\Users\Admin\PktMon.etl (No events lost)
Frame 1: no image at all. Real text on the page, so you can select any line, copy the whole thing, and it stays sharp at any size.
Rounded dark console panel with no title bar and no window buttons, showing pktmon start capture and pktmon stop.
Frame 2: a plain dark panel, with no bar of any kind above the first line.
Dark console panel with three small gray dots along the top instead of window buttons.
Frame 3: the three-dot header a lot of tech sites use, which reads as a terminal without claiming to be any particular one.
Light gray console panel with dark monospace text and no window chrome at all.
Frame 4: a light panel, the way documentation sites usually show a terminal.
Amber monochrome terminal text on a near-black background with faint scan lines.
Frame 5: an amber CRT, monochrome text with faint scan lines running across it.
Green monochrome terminal text on a near-black background with faint scan lines.
Frame 6: the same CRT idea in green phosphor, using the older Command Prompt prompt.

Packet Monitor is Windows only, so the last two frames swap in the Linux equivalent, tcpdump watching the same DNS lookups on port 53, on the same example network as the pktmon shots above.

Dark blue terminal panel with no window chrome, using a purple and green developer color scheme.
Frame 7: the dark blue palette a lot of developer blogs use, set in JetBrains Mono.
Plain black Linux console with light gray monospace text and no window chrome or color.
Frame 8: a plain Linux console, pure black with no color and no chrome.

A frame cannot tell you where to paste a command, because paint is not information. A word can. The blocks below carry a small label naming the shell, and each one runs a different command so the labels have something to be right about: a PowerShell session, a Command Prompt session, a bash session, a saved .bat file, and the same job written as a PowerShell script.

Dark console panel with a thin bar above it reading PowerShell, showing pktmon start capture and pktmon stop.
Label A: a thin strip above the console with the shell name on the left. This is the pktmon session again, so it is labelled PowerShell.
PowerShell
PS C:\Users\Admin> pktmon start --capture

Logger Parameters:
    Logger name:        PktMon
    Logging mode:       Circular
    Log file:           C:\Users\Admin\PktMon.etl
    Max file size:      512 MB
    Memory used:        128 MB

Collected Data:
    Packet counters, packet capture

Capture Type:
    All packets

Monitored Components:
    All

PS C:\Users\Admin> pktmon stop
Flushing logs...
Merging metadata...
Log file: C:\Users\Admin\PktMon.etl (No events lost)
Label A as live text rather than a picture. Same strip, and the copy button now sits in it instead of floating over the first line.
Dark console panel with the words Command Prompt set small in the top right corner, showing pktmon etl2pcap and etl2txt.
Label B: no strip at all, just a quiet word in the top right corner. The commands are the two converters, run in Command Prompt, which colors nothing.
Dark blue console panel with three dots on the left of its header and the word bash centered, running tcpdump on port 53.
Label C: the three-dot header with the shell name centered in it. The command is the Linux one, so the label reads bash.
bash
admin@ws-01:~$ sudo tcpdump -i eth0 -n port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:12:04.183255 IP 192.168.1.24.41372 > 192.168.1.1.domain: 24917+ A? www.wireshark.org. (35)
16:12:04.201377 IP 192.168.1.1.domain > 192.168.1.24.41372: 24917 1/0/0 A 104.26.10.130 (51)
16:12:05.994710 IP 192.168.1.24.52918 > 192.168.1.1.domain: 8134+ A? learn.microsoft.com. (37)
16:12:06.011842 IP 192.168.1.1.domain > 192.168.1.24.52918: 8134 1/0/0 A 23.192.180.213 (53)
16:12:07.660418 IP 192.168.1.24.57604 > 192.168.1.1.domain: 51028+ A? github.com. (28)
16:12:07.734126 IP 192.168.1.1.domain > 192.168.1.24.57604: 51028 1/0/0 A 140.82.113.4 (44)
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel
Label C as live text. The dots and the label are drawn by the page, so they cost nothing and stay sharp at any size.
Dark code panel showing a batch script, with a strip along the bottom reading Batch file, capture-dns.bat.
Label D: the label under the block instead of over it, naming the file rather than a shell. This one is a saved script, so it has no prompts and no output.
@echo off
REM Capture 60 seconds of DNS traffic, then convert it for Wireshark
pktmon filter remove
pktmon filter add DNS -p 53
pktmon start --capture --pkt-size 0 --file-name dns.etl
timeout /t 60 >nul
pktmon stop
pktmon etl2pcap dns.etl --out dns.pcapng
echo Done. Open dns.pcapng in Wireshark.
Batch file · capture-dns.bat
Label D as live text, which matters more here than anywhere else, because a script is the one thing a reader really will copy.
Dark code panel with a tab in the top left reading PowerShell script, marked with an orange line, showing a pktmon script.
Label E: the label as a tab in the top left with the site orange along its edge. The same capture job, written in PowerShell instead of batch.
PowerShell script
$etl  = "$env:USERPROFILE\dns.etl"
$pcap = $etl -replace '\.etl$', '.pcapng'

# Keep only DNS, then record for one minute
pktmon filter remove
pktmon filter add DNS -p 53
pktmon start --capture --pkt-size 0 --file-name $etl
Start-Sleep -Seconds 60
pktmon stop

pktmon etl2pcap $etl --out $pcap
Write-Host "Saved $pcap"
Label E as live text. That orange line is the only thing on any of these blocks that says TechWalrus rather than terminal.
Light gray console panel with a header strip reading bash, running tcpdump on port 53.
Label F: the same top strip on the light panel, to check the idea survives outside a dark box.

Watch it live and filter the noise

You don't have to wait for a file either. Run pktmon start --capture -m real-time and packets scroll across the screen as they pass through, until you press Ctrl+C. This mode is watch-only, so nothing gets saved to a file.

On a busy PC that is a flood, so the tool lets you narrow the capture before you start. Type pktmon filter add -p 53 as your only filter and the capture keeps just the traffic on port 53, the port that classic DNS lookups use when they turn a site name into a numeric address.

Illustration of tweezers holding a virus above a dish with the Windows logo.

Test sketchy apps in Windows Sandbox

By TechWalrus

You can stack up to 32 filters on ports, addresses, and protocols. A packet needs to match just one of them to be kept, and pktmon filter remove wipes them all when you're done.

Microsoft pktmon filter examples

Windows PowerShell with a pktmon port 53 filter added and real-time DNS lookups scrolling on screen.
The DNS-only live capture in action. After the filter, the only lines that scroll by are lookups on port 53, each one printed the moment it happens.

Open the capture in Wireshark

Windows saves the log in its own ETL format. To read it in Wireshark, the free program that network professionals use to dissect captures, type pktmon etl2pcap PktMon.etl first. That converts the capture to a pcapng file, which Wireshark opens directly.

The converted file leaves out packets that Windows dropped, along with Packet Monitor's notes about where each packet traveled. Run pktmon etl2pcap PktMon.etl --drop-only --out drops.pcapng to get the dropped packets in their own file. If you'd rather read the full log as plain text, pktmon etl2txt PktMon.etl does that instead.

Microsoft etl2pcap conversion notes

Windows PowerShell showing pktmon etl2pcap converting PktMon.etl into a pcapng file.
The conversion step. The tool reports how many packets it wrote to the new pcapng file and that one packet was dropped along the way.
Wireshark main window showing a packet list with a DNS response on port 53 selected.
A converted capture opened in Wireshark. The selected row is a DNS answer on port 53, the same traffic the filter example keeps. Wireshark User’s Guide.

It even tells you why a packet was dropped

Packet Monitor watches packets at many points inside Windows itself, not just at the network card. When a packet is dropped in a part of Windows that supports drop reporting, the tool names that part and tells you why. Maybe the packet was too big for the connection, or a network rule blocked it.

Microsoft diagram of packet checkpoints inside the Windows networking stack, with a red drop marker and a drop reason callout.
Microsoft’s diagram of the checkpoints inside Windows networking. Green checks mark the points a packet cleared, and the red cross is where one was dropped, with the reason attached. Microsoft.

You can also run pktmon counters --live during a capture. It shows a running count of how many packets each part of Windows networking has passed or dropped.

Microsoft says the tool is especially helpful inside the virtual networks that servers run. But it ships with Windows 11 and has been in Windows 10 since 2018. Next time an app won't connect, or you wonder who your PC talks to when you are not touching it, the recorder is already there.

Microsoft Packet Monitor command list

0 Comments
TAGS: how-to networking security tools windows
The urlscan.io logo.

Check a suspicious link without opening it yourself
Illustration of a fictional bank page with an edited account balance.

A real web address doesn't make a screenshot real
Illustration of a password hash prefix, masked password and keys.

Check for leaked passwords without sending yours
Illustrated browser showing a sentence highlighted by a text fragment link.

Link straight to the sentence you want someone to read