Jean-Pierre Paradis's Blog: Pktmon: Capture Windows Traffic Without a Third-Party Driver

Do not install a third-party packet capture driver on a production Windows server just to learn which hop is dropping your packets. The driver you add for one afternoon of troubleshooting can outlive the ticket, survive a reboot, and reappear in your next change-control review. Windows has shipped its own packet capture and drop-detection tool for years, and it does real diagnostic work without a third-party binary. The risk you carry into a capture is the capture itself. A full-packet trace on the wrong interface records credentials and customer payloads to disk, and an unbounded file can fill the system drive of the server you are trying to rescue, which is why the filter, file-size, and log-mode choices below decide whether the trace is an asset or an incident.



adamtheautomator.