CmdID

CmdID / Commands / netsh

netsh trace

The netsh trace command allows you to capture detailed network traffic and trace events, providing valuable data for diagnosing and troubleshooting network problems on Windows systems. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

The netsh trace command allows you to capture detailed network traffic and trace events, providing valuable data for diagnosing and troubleshooting network problems on Windows systems. It supports a range of options for filtering, exporting, and analyzing trace data.

netsh trace [convert | correlate | diagnose | dump | export | help | merge | postreset | show | start | ?]
netsh trace convert [input=]tracefilename.etl [output=]filename [dump=]CSV|XML|EVTX|TXT|No [report=]yes|no
[overwrite=]yes|no [metadata=]yes|no [tmfpath=]pathname [manpath=]pathname
netsh trace correlate [input=]tracefilename.etl [output=]newtracefilename.etl [filter=]Activity_ID
[overwrite=]yes|no [retaincorrelationevents=]yes|no [retainpii=]yes|no
[retainglobalevents=]yes|no
netsh trace diagnose [scenario=]<scenarioname> [namedAttribute=]<attributeValue>
[saveSessionTrace=]<yes|no> [report=]<yes|no> [capture=]<yes|no>
netsh trace dump
netsh trace export [scenario=]<scenarioname> [file=]<filename>
netsh trace merge
netsh trace postreset

To convert an ETL log file to XML, run the following command

netsh trace convert input="C:\Logs\mytrace.etl" output="C:\Logs\mytrace.xml"Identify

To analyze and correlate the data between multiple ETL files into a single correlated file, run the following command

netsh trace correlate input="C:\Logs\trace1.etl,C:\Logs\trace2.etl" output="C:\Logs\correlated_trace.etl"Identify

To export an ETL to a text file (.txt), run the following command

netsh trace export input="C:\Logs\mytrace.etl" output="C:\Logs\mytrace.txt"Identify

To merge multiple ETL files into a single trace file, run the following command

netsh trace merge input="C:\Logs\trace1.etl,C:\Logs\trace2.etl" output="C:\Logs\merged_trace.etl"Identify

To list all network interfaces available for tracing, run the following command

netsh trace show interfacesIdentify

To start a new trace session and save the log to a specific file path, run the following command

netsh trace start capture=yes tracefile="C:\Logs\networktrace.etl"Identify

Trips 1 Sigma rule: mediumNew Network Trace Capture Started Via Netsh.EXE by Kutepov Anton, oscd.community

trace convertConverts a trace file to an HTML report. input: Specifies the input Event Trace Log (ETL) file. output: Sets the output file name. If not specified, defaults to the input file name. dump: Chooses the output format: TXT (default), CSV, XML, EVTX, or No (no dump). report: Generates an HTML report if set to yes. Default is no. overwrite: Overwrites existing files if set to yes. Default is no. metadata: Includes metadata traces in the output if set to yes. Default is no. tmfpath: Provides the path to the Trace Message Format (TMF) files for decoding the Windows Software Trace Preprocessor (WPP) traces. manpath: Provides the path to manifest files for decoding Event Traces for Windows (ETW) traces.
trace correlateNormalizes or filters a trace file, producing a new output file. You can filter by Activity ID (a GUID in the format {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}) to include only related events. The command can also retain correlation events, personal data (such as packet capture events), and global events. input: Specifies the input ETL trace file. output: Sets the output file name and path. filter: Outputs only events related to the specified Activity GUID. Default is none. overwrite: Overwrites existing files if set to yes. Default is no. retaincorrelationevents: Retains correlation events if set to yes. Default is no. retainpii: Retains events containing personal data if set to yes (default). retainglobalevents: Retains global events if set to yes (default).
trace diagnoseStarts a diagnostic session. scenario: Specifies a diagnostic scenario name (example, InternetClient). namedAttribute: Supply the additional details or options for the scenario, which is dependent on the scenario chosen. saveSessionTrace: If set to yes, saves the trace data from the session for later analysis. If no, the trace isn't saved. This option defaults to yes if report=yes. report: If set to yes, generates a diagnostic report after running the scenario. If no (default), no report is created. capture: If set to yes, captures network traffic during the diagnosis. If no (default), traffic isn't captured.
trace dumpCreates a script containing the current context configuration. The script can be saved to a file and used to restore settings if they're altered or need to be replicated on another system.
trace exportExports a scenario to a Windows Performance Recorder (WPR) profile. scenario: Specifies the name of the tracing scenario to export. file: Sets the output file name and path for the exported WPR profile.
trace mergeMerges multiple trace files into one and enriches the output with symbol and PerfTrack metadata for improved analysis.
trace postresetRestores the global tracing settings to default after a network stack reset.
trace showDisplays information for the following parameters: capturefilterhelp: Lists all supported capture filters and provides usage examples. globalkeywordsandlevels: Displays available global keywords and tracing levels for configuration. helperclass: Provides information about helper classes used in tracing. interfaces: Lists all network interfaces available for tracing. provider: Displays detailed information about a specific trace provider. providerfilterhelp: Lists supported provider filters and explains their usage. providers: Shows all trace providers available on the system. scenario: Displays details about a specific tracing scenario. scenarios: Lists all available tracing scenarios. status: Shows the current tracing configuration and session status.
trace startStarts a trace session. sessionname: Specifies the name of the trace session. scenario: Specifies a predefined scenario (LAN, InternetClient, etc.) globalKeywords: Filters events for all providers using ETW keywords. globalLevel: Sets the verbosity for global events: - 1 (Critical): Only critical events. - 2 (Error): Critical and error events. - 3 (Warning): Critical, error, and warning events. - 4 (Informational): Adds informational events. - 5 (Verbose): Captures all events, including detailed debug info. capture: Whether to capture network packets (yes or no). capturetype: Specifies the packet capture type (physical, vmswitch, or both). report: Generate an HTML report after tracing (yes, no, or disabled). persistent: Keeps the session running after a system reboot (yes or no). traceFile: Full path and filename for the trace output. maxSize: Maximum size of the trace file in megabytes. fileMode: Specifies the method of file writing mode: - single: All data is written to one file up to the specified file size in megabytes. - circular: Overwrites oldest data when file reaches max size (acts as a ring buffer). - append: Adds new trace data to the end of an existing file. …
help or ?Displays a list of commands and their descriptions in the current context.