Environment
Micro Focus Client for Open Enterprise Server 2 SP4
Microsoft NETSH.EXE
Situation
The system administrator needs to capture a trace of LAN traffic for analysis.
Resolution
Other Micro Focus TIDs describe how to capture a LAN trace using Wireshark, Ethereal, Sniffer, LANalyzer, or other tools.
Another method for machines running Windows 7 / Windows 2008 R2 or above is to use the NETSH.EXE application furnished with Windows itself (no additional software is needed).
NETSH.EXE can be used to capture a "typical" LAN trace of a problem being experienced after the machine is already running and the user is logged on, or can be configured to capture LAN traffic that occurs as the machine is booting up (a "boot-up" trace).
Typical LAN Trace:
1. Open an elevated command prompt (from the Start menu, right-click "Command Prompt" and select the "Run As Administrator" option).
2. In the elevated command prompt, execute a command such as:
netsh trace start capture=yes tracefile=<path and name of trace file>.etl
e.g. netsh trace start capture=yes tracefile=tracefile.etl
3. Duplicate the problem you are experiencing.
4. In the command prompt where NETSH is running, type
netsh trace stop
Provide the .etl file to your support engineer for analysis. The .cab file is not generally needed and can be deleted.
Boot-up LAN Trace:
1. Open an elevated command prompt (from the Start menu, right-click "Command Prompt" and select the "Run As Administrator" option).
2. In the elevated command prompt, execute a command such as:
netsh trace start capture=yes tracefile=<path and name of trace file>.etl
e.g. netsh trace start capture=yes persistent=yes tracefile=tracefile.etl
3. Restart the workstation. Duplicate the problem you are experiencing.
4. Open an elevated command prompt and run this command:
netsh trace stop
Provide the .etl file to your support engineer for analysis. The .cab file is not generally needed and can be deleted.
Additional Information
NETSH.EXE is a powerful tool, and many options are available. However, simply capturing "everything" using the command lines suggested here is the simplest and usually the best approach.
More information about available option can be viewed by typing "netsh.exe trace start help".
Analyzing a trace captured using NETSH.EXE requires Microsoft Message Analyzer.