Generating a Packet Capture on Windows With Packet Sniffer

Issue

Automox Support (or your own network team) requests a packet capture from a Windows device to troubleshoot agent connectivity, blocked downloads, or proxy and firewall behavior, and installing Wireshark or other third-party capture tools on the device is not allowed or practical.

Environment

• Windows 10 / Windows Server 2019 (version 1809) and later, which include Packet Monitor (pktmon) in-box
• The full command set shown below requires Windows 10 / Windows Server version 2004 or later
• An elevated (Run as administrator) Command Prompt or PowerShell session

Overview

Packet Monitor (pktmon) is Microsoft's built-in packet capture tool. It writes captures to an ETL log that can be converted to PCAPNG format and opened in Wireshark. Two defaults matter for a useful support capture: pktmon only logs the first 128 bytes of each packet unless told otherwise, and it captures all traffic unless filters are applied first. The steps below produce a filtered, full-packet capture ready to attach to a ticket.

Resolution

1. Open an elevated prompt and confirm pktmon is available:

   pktmon help

2. Add capture filters before starting (recommended). Filtering to the traffic you care about keeps the capture small and readable; up to 32 filters can be active, and a packet is logged if it matches any one of them. Automox agent traffic is HTTPS, so filtering on port 443 covers it:

   pktmon filter add -p 443

   • To narrow further to a specific destination, add an IP filter: pktmon filter add -i <ip_address. The Automox hostnames and IP ranges to expect are listed in Platform Firewall Allowlisting Rules.
   • Confirm what is active with pktmon filter list.

3. Start the capture with full packets:

   pktmon start -c --pkt-size 0

   • -c enables packet capture and logging. --pkt-size 0 logs entire packets instead of the default 128-byte truncation, which would otherwise cut off most payload and TLS handshake detail.
   • The log is written to PktMon.etl in the current working directory (circular, 512 MB maximum by default).
4. Reproduce the problem while the capture runs. For agent issues, this usually means running a scan from the console or restarting the Automox agent service so it checks in.

5. Optionally, confirm traffic is being seen without stopping the capture:

   pktmon counters

6. Stop the capture:

   pktmon stop

7. Convert the ETL log to PCAPNG so it opens in Wireshark:

   pktmon etl2pcap PktMon.etl --out PktMon.pcapng

8. Remove the filters so they do not affect a future capture:

   pktmon filter remove

9. Attach the PktMon.pcapng file (zipped, if large) to your support ticket, along with a note of the device time when the issue was reproduced.

Notes

• The pktmon command syntax changed in Windows 10 / Server version 2004. Older guides (including a previous version of this article) show pktmon start --etw and pktmon pcapng for conversion; on current builds use pktmon start -c and pktmon etl2pcap as shown above. Microsoft's current reference is the Packet Monitor documentation and pktmon command reference.
• pktmon can also report dropped packets with a drop reason (for example, MTU mismatch or a filtered VLAN), which a plain traffic capture cannot. Convert the same log with pktmon etl2pcap PktMon.etl --drop-only --out PktMon-drops.pcapng to inspect only the drops.
• Component IDs shown by pktmon comp list are not persistent across reboots. For a support capture there is normally no need to target a specific adapter; capturing on all components with filters applied is simpler and reliable.
• For Linux and macOS devices, see How to Get a Packet Capture with tcpdump.