2020. 2. 26. 08:35ㆍ카테고리 없음
Applies to:Windows 10, version 1803Windows Server 1709Windows 10, version 1709Windows 10, version 1703Windows Server 2016Windows 10, version 1607Windows 10, version 1511Windows 10, version 1507Windows Server 2012 R2Windows 8.1Windows Server 2012Windows 8Windows Server 2008 R2Windows 7Does not apply:Windows Server 2008Windows VistaWindows Server 2003Windows XPOriginally published Dec 2012. Updated June 2015, Nov. 2016, May 2018.In Windows Server’s, if you wanted to capture network packets (for those coming from a Unix background, Packet sniffer or protocol analyzer, or TCPDump), you would have to install an add-on such as Network Monitor (Netmon) or Wireshark (used to be known as Ethereal). In order to install these products, you would have to go thru a change control process.Starting with Windows 7 and Windows Server 2008 R2, network capture has been built-in and native to the Windows O.S.Step 1.
Packet Programs For Windows 7
WARNING: In Windows 7 and Windows Server 2008 R2, you could run into:Please make sure to install the hotfix above before you proceed.Step 2. Before you capture any network trace, here are questions you should have ready when you are capturing it:Step 3.
Easyterm Packet Radio
Minimize the noise.Close all the applications that are unnecessary for the issue that you are investigating.Step 4. Clear any caching that has been done.Clear all name resolution cache as well as all cached Kerberos tickets.To clear DNS name cache you type in: IPConfig /FlushDNSTo clear NetBIOS name cache you type in: NBTStat -RNote: This command requires you to be a “Local Administrator” (i.e.
CMD ( Run as admin)).To clear Kerberos tickets will need KList.exe: KList purgeNote: Depending on what permissions the service or application has, you might have to open a Command Prompt (CMD.exe) using those permissions. For example: If the app or service uses the System account, you will need to use Sysinternals Psexec.PSExec.exe -s -i cmd.exeAnd then run the commands above in the new command prompt that opened to clear the cache(s).i.e. If you are troubleshooting Internet Explorer (IE), clear the IE cache.Step 5. Start, CMD (Run as admin)Type “Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=1024 correlation=no traceFile=C:TempNetTrace.etl” without the quotation marks and then press Enter.Note: Details of all the options are available in the links to more information.Note 2: You always want to take network traces from both sides (sending and receiving).Step 6. Reproduce the issue.Open a second CMD (Run as admin)When you have the repro, to make the network trace with a ‘marker’ that you are done.Type “ping 127.0.0.1” without the quotation marks and then press Enter.Step 7.