How to Use the Windows 11 Built-In Network Packet Sniffer (pktmon)

If you are troubleshooting a complex network issue, such as dropped connections to a specific server or unusual background data usage, you traditionally needed to install heavy third-party software like Wireshark to intercept and analyze the traffic.

However, starting with recent builds of Windows 10 and continuing into Windows 11, Microsoft quietly included a native, command-line network packet sniffer called pktmon (Packet Monitor). This powerful tool allows system administrators to capture raw network traffic directly from the terminal without installing any external dependencies.

How to Capture Network Traffic with Pktmon

Because packet sniffing intercepts raw data passing through your network adapter, this tool requires administrative privileges to run.

1. Click the Windows Start menu and type cmd.
2. Right-click on Command Prompt and select Run as administrator.
3. Before starting a capture, it is best practice to clear any existing packet filters that might have been left behind from a previous session. Type the following command and press Enter:

   pktmon filter remove

4. To begin capturing absolutely all network traffic flowing through all of your network adapters, execute the following start command:

   pktmon start --etw

The terminal will print a confirmation that the logger has started. The tool is now silently running in the background, recording every single packet of data entering or leaving your machine.

How to Stop the Capture and View Results

Let the capture run while you reproduce your network issue (e.g., attempt to load the failing webpage or connect to the failing server).

1. Once you have captured enough data, return to the Command Prompt and type:

   pktmon stop

The terminal will indicate that the capture has stopped and saved the data to a file named PktMon.etl in your current directory (usually C:\Windows\System32).

Converting the Log for Analysis

The raw .etl file is not easily readable by humans. You must instruct pktmon to convert it into a standard text file format.

1. Execute the following formatting command:

   pktmon format PktMon.etl -o network_capture.txt

This command takes the raw data and exports it into a highly detailed text file named network_capture.txt. You can now open this text file using Notepad (or any standard text editor) to manually review the source IP addresses, destination ports, and protocol data of every packet that traversed your network adapter during the capture period.