Using Winshark to Filter by process/PID

20 views Asked by At

I'm following the suggestions in this question to allow filtering packets by process ID in a Windows 10 system.

@OneAndOnly recently suggested WinShark, which has a github page here.

It describes the process using "netsh trace" to capture packets and make them available in Wireshark.

As suggested, I ran these commands from an elevated prompt:

C:\WINDOWS\system32>netsh.exe trace start capture=yes report=no correlation=no

Trace configuration:
-------------------------------------------------------------------
Status:             Running
Trace File:         C:\Users\******\AppData\Local\Temp\NetTraces\NetTrace.etl
Append:             Off
Circular:           On
Max Size:           512 MB
Report:             Off


C:\WINDOWS\system32>logman start Winshark-PacketCapture -p "Microsoft-Windows-NDIS-PacketCapture" -rt -ets
The command completed successfully.

C:\WINDOWS\system32>

I then started Wireshark 4.2.4. following the instruction to "Then launch Wireshark with administrator privileges and select Winshark-PacketCapture interface:"

Unfortunately, there is no Winshark-PacketCapture interface in the list of interfaces.

enter image description here

I looked in the ...\AppData\Local\Temp\NetTraces\ directory, and NetTrace.etl is zero bytes after running for 15-20 minutes of activity. How can I proceed to be able to filter network traffic on process ID?

Edit - after shutting down the capture with ">netsh.exe trace stop", it displayed output that included "Generating data collection ... done" and wrote a 450 Mbyte NetTrace.etl file. Wireshark still does not offer the Winshark-PacketCapture interface.

0

There are 0 answers