Windows Network Sniffer - pktmon
Tags: windows, testing, network
Published: 2020-05-20 13:16:12

This blog post originally appeared on my blog [QAInsights](https://qainsights.com/windows-network-sniffer-pktmon/).
<!-- wp:paragraph -->
<p>Recently I read an article about all new Windows network sniffer tool called <code>pktmon</code> which got released in Windows 10 October 2018 update. It took a while to reach the tech community. In this blog post, we will see how to get started with pktmon and a quick walk through. </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>What is pktmon?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><code>pktmon</code> is a built-in network sniffer for Windows operating system. Just like tcpdump in Linux. pktmon.exe is shipped in Windows 10 October 2018 update. Using pktmon you can diagnose and analyze the network packets.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Other popular network sniffer for Windows is Wireshark. </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>How to launch pktmon in Windows?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Make sure you have the latest release of Windows. Go to Settings &gt; System &gt; About to check the version. I am using Windows 10 Pro 1909 OS build 18363.836.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To launch pktmon, you need to have administrative privilege, otherwise you may not able to run the program.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You can use Windows Terminal or command prompt to launch <code>pktmon</code>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>pktmon</code> is located under <code>C:\Windows\System32\PktMon.exe</code> location.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7329,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-39-1024x572.png" alt="Windows Network Sniffer - pktmon" class="wp-image-7329"/><figcaption>Windows Network Sniffer - pktmon</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><code>pktmon</code> is a command line utility. You should good in remembering commands to work.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If you need help type <code>pktmon help</code> to view the syntax.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>How to capture the network using pktmon?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let us capture the http traffic of http://example.com. The IP address of http://example.com is 93.184.216.34. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Before we begin monitoring, it is important to configure the filter in pktmon.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Issue the below command to add the port 80 filter. You can add multiple filters as well.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7331,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-40.png" alt="Add Filter" class="wp-image-7331"/><figcaption>Add Filter</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>After configuring the filter, you can also add the network interface by issuing the below command. Note down the ID which you can use it in the start command.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7332,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-41.png" alt="Interface List" class="wp-image-7332"/><figcaption>Interface List</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>To start capturing the network, use the command <code>pktmon start --etw -p 0</code> and hit enter. This will capture all the interface traffic. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7333,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-42.png" alt="Start Capturing" class="wp-image-7333"/><figcaption>Start Capturing</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Now launch your favorite browser and open example.com. Once the page is successfully loaded, return to the terminal/command prompt to stop capturing the traffic.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7334,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-43.png" alt="Stop Capturing" class="wp-image-7334"/><figcaption>Stop Capturing</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>The log file will be generated and placed it in the current directory. ETL file will not be in readable format. You need to convert ETL into TXT file using the below command. Text file will give an overview about the packets.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>pktmon format .\PktMon.etl -o output.txt</code></p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7335,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-44-1024x458.png" alt="Output" class="wp-image-7335"/><figcaption>Output</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>In the output.txt file, you can search for the example.com IP.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7336,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-45-1024x241.png" alt="Search" class="wp-image-7336"/><figcaption>Search</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Alternatively, you can also use <a href="http://Microsoft Network Monitor 3.4 (archive)">Microsoft Network Monitor 3.4</a> to view the ETL file.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":7337,"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://qainsights.com/wp-content/uploads/2020/05/image-46-1024x576.png" alt="Microsoft Network Monitor" class="wp-image-7337"/><figcaption>Microsoft Network Monitor</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>After capturing the traffic, you can remove the filter using the below command.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><code>pktmon filter remove</code></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Future release of pktmon will have <strong>real time monitoring</strong> and converting ETL to PCAPNG format to view the traffic in Wireshark.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>How are you planning to use pktmon for your performance testing purposes? Please let me know in the <a href="https://qainsights.com">comments</a>.</p>
<!-- /wp:paragraph -->