How to Capture Network Packet Traces in Windows 11 Using PowerShell NetEventSession

Diagnosing transient network connectivity issues, dropped TCP connections, DNS query failures, or unexpected firewall resets on Windows 11 traditionally required installing third-party packet sniffing utilities like Wireshark or WinPcap. However, in secure corporate or hardened enterprise environments, installing third-party kernel drivers or promiscuous-mode packet filters is often prohibited by security policy. Windows 11 includes a robust, kernel-level packet tracing infrastructure built directly into the Event Tracing for Windows (ETW) subsystem, manageable entirely through PowerShell NetEventPacketCapture cmdlets.

In this guide, you will learn how to create native packet capture sessions, attach network capture providers, filter traffic by IP address, and convert captured trace logs in Windows 11 using PowerShell.

Understanding NetEventSession Architecture

Windows packet capturing operates through a three-stage pipeline:

• NetEventSession: The master session container that controls trace buffering, memory limits, and the output destination file (typically an .etl Event Trace Log file).
• NetEventProvider: The event provider that hooks into the NDIS (Network Driver Interface Specification) layer. The primary network capture provider is Microsoft-Windows-NDIS-PacketCapture.
• Capture Filters: Rules applied directly at the driver level to discard unneeded packets, preventing the trace buffer from overflowing during heavy network I/O.

Because packet capture operates inside the native Windows kernel, it introduces negligible CPU overhead and requires zero external software.

Creating and Configuring a New NetEventSession

Launch an elevated PowerShell session (Run as Administrator). To create a new packet capture session container named NetTrace01 that writes to C:\Traces\capture.etl:

# Ensure trace directory exists
New-Item -ItemType Directory -Path "C:\Traces" -Force

# Create packet capture session
New-NetEventSession -Name "NetTrace01" -CaptureMode SaveToFile -LocalFilePath "C:\Traces\capture.etl" -MaxFileSize 250

Key parameters include:

• -CaptureMode SaveToFile: Streams captured packet buffers directly to disk.
• -MaxFileSize 250: Restricts the trace file size to 250 Megabytes, automatically stopping or circular-wrapping to protect disk space.

Verify that the session container is registered:

Get-NetEventSession -Name "NetTrace01"

Attaching the NDIS Packet Capture Provider

A session container remains inactive until you bind a packet capture provider to it. Add the Microsoft NDIS capture provider using Add-NetEventPacketCaptureProvider:

Add-NetEventPacketCaptureProvider -SessionName "NetTrace01" -TruncationLength 128

The -TruncationLength 128 parameter truncates each packet payload to 128 bytes. This captures full Ethernet, IP, TCP, and UDP headers for protocol analysis while stripping large application payloads, dramatically improving performance and preserving confidentiality.

To capture full un-truncated packets (such as payload contents for deep application debugging), omit -TruncationLength or set it to 0.

Applying Packet Capture Filters

On busy endpoints, capturing every packet on the network interface can generate gigabytes of noise within seconds. You can apply driver-level IP and port filters using Add-NetEventNetworkAdapter or Set-NetEventPacketCaptureProvider.

To restrict packet capture exclusively to an active network adapter (such as Ethernet or Wi-Fi):

Add-NetEventNetworkAdapter -Name "Wi-Fi" -SessionName "NetTrace01"

To capture traffic matching a specific remote IP address (e.g., 192.168.1.50):

Add-NetEventPacketCaptureProvider -SessionName "NetTrace01" -CaptureType BothPhysicalAndSwitch -IPAddresses "192.168.1.50"

Starting and Monitoring the Capture Session

Once the session and providers are configured, start packet recording:

Start-NetEventSession -Name "NetTrace01"

Confirm the active status of the capture session:

Get-NetEventSession -Name "NetTrace01" | Select-Object Name, SessionStatus, LocalFilePath

While the session is running, reproduce the network issue (such as browsing to an unreachable intranet site, pinging a gateway, or initiating an SSH handshake).

Stopping and Removing the Session

Once you have reproduced the issue, stop the capture immediately to prevent unneeded data from overwriting trace buffers:

Stop-NetEventSession -Name "NetTrace01"

To release the session container and unhook the NDIS kernel filter:

Remove-NetEventSession -Name "NetTrace01"

Verify that the output file has been finalized and flushed to disk:

Get-Item "C:\Traces\capture.etl" | Format-List Name, Length, LastWriteTime

Converting and Analyzing the ETL Trace File

The generated .etl file is an Event Trace Log. To analyze it in network protocol analyzers like Wireshark:

1. Using Microsoft Message Analyzer / ETL2Pcap: Convert the ETL trace to standard .pcap format using Microsoft’s open-source etl2pcap tool:

   .\etl2pcap.exe C:\Traces\capture.etl C:\Traces\capture.pcap

2. Opening in Wireshark: Launch Wireshark and open capture.pcap. You can now filter packets using standard display filters (e.g., dns, tcp.analysis.retransmission, or http).
3. Using PowerShell Get-WinEvent: If you do not have external tools, you can inspect trace metadata directly in PowerShell:

   Get-WinEvent -Path "C:\Traces\capture.etl" -Oldest | Select-Object -First 20 | Format-Table TimeCreated, Id, Message -AutoSize