pktmon is the packet capture that ships with Windows 10 1809 and later. Add a filter, capture to ETL, convert to pcapng and open the result in Wireshark without installing a driver.
Filter first with **pktmon filter add -p <port>**, capture with **pktmon start --capture -f C:\trace.etl**, stop it and convert with **pktmon etl2pcap**. Unfiltered captures drop packets and grow fast.
**pktmon list** names the network components that support capture. Old filters survive a reboot, so clear them before a new investigation.
pktmon list
pktmon filter remove
pktmon filter listA capture without filters is dropped by the driver as soon as it gets busy. Filter on the port or the address you care about, and add one filter per direction if needed.
pktmon filter add -t TCP -p 443
pktmon filter add -t UDP -p 53
pktmon filter list**--pkt-size 128** keeps the headers and the first payload bytes, which is enough for handshakes and error codes. A size of 0 copies whole packets and multiplies the file size.
pktmon start --capture --pkt-size 128 -f C:\trace.etl
# reproduce the problem now
pktmon stop
Get-Item C:\trace.etl | Select-Object Name,Length**pktmon counters** shows how many packets matched each filter and how many were dropped. A zero match means the filter is wrong, and converting an empty trace wastes time.
pktmon counters
pktmon start --capture --pkt-size 128 -f C:\trace2.etl
Start-Sleep -Seconds 30
pktmon stop
pktmon counters --reset**etl2pcap** rewrites the ETL into pcapng. The conversion keeps the packet metadata, and Wireshark then decodes TLS records, DNS answers and TCP retransmissions normally.
pktmon etl2pcap C:\trace.etl --out C:\trace.pcapng
Get-Item C:\trace.pcapng | Select-Object Name,Length
Start-Process "C:\Program Files\Wireshark\Wireshark.exe" -ArgumentList 'C:\trace.pcapng'A running capture keeps the driver attached to every adapter. Stop it, drop the filters and confirm the state before you close the shell.
pktmon stop
pktmon filter remove
pktmon filter list
Remove-Item C:\trace.etl,C:\trace2.etl -ErrorAction SilentlyContinueThe tool needs Windows 10 1809 or later. On older builds use netsh trace start capture=yes, which writes an ETS file you convert with the same idea.
The filter did not match. Check pktmon counters, remove the filter and capture again with only a port filter to prove the path works.
The capture started below the TCP stack or used a tiny packet size. Increase --pkt-size to 0 and capture again so the payload is complete.
The driver dropped packets because the buffer filled. Shorten the capture window, narrow the filter, or add -s to cap the file size.
No. It is a built-in component and uses the same Windows filtering platform as the firewall, which is why it sees traffic before any third-party capture driver.
Yes. Add the adapter to the capture with --comp or capture all components; monitor mode with raw 802.11 frames is not what pktmon provides.
Only after review. Even header-level captures contain addresses and host names, and a full-payload capture can contain credentials in plain text.
Run pktmon stop, then pktmon filter remove to drop every filter, and delete the .etl and .pcapng files. No permanent configuration change is left behind.
Free · no account needed · tracks your progress