CmdID

CmdID / Commands / pktmon filter

pktmon filter add

Pktmon filter add allows you to add a filter to control which packets are reported. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Pktmon filter add allows you to add a filter to control which packets are reported. For a packet to be reported, it must match all conditions specified in at least one filter. Up to 32 filters can be active at once.

pktmon filter add <name> [-m <mac> [mac2]] [-v <vlan>] [-d { IPv4 | IPv6 | number }]
[-t { TCP [flags...] | UDP | ICMP | ICMPv6 | number }]
[-i <ip> [ip2]] [-p <port> [port2]] [-b] [-e [port]]

The following set of filters will capture any ICMP traffic from or to the IP address 10.0.0.10 along with any traffic on port 53.

C:\Test> pktmon filter add -i 10.0.0.10 -t icmp C:\Test> pktmon filter add -p 53Identify
-iMatch source or destination IP address. Windows commands reference
-tMatch by transport (layer 4) protocol. Windows commands reference

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

Matches documented abuse: Reconnaissance (T1040)

The following filter will capture all the SYN packets sent or received by the IP address 10.0.0.10

C:\Test> pktmon filter add -i 10.0.0.10 -t tcp synIdentify
-iMatch source or destination IP address. Windows commands reference
-tMatch by transport (layer 4) protocol. Windows commands reference

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

The following filter called MyPing pings 10.10.10.10 using the ICMP protocol

C:\Test> pktmon filter add MyPing -i 10.10.10.10 -t ICMPIdentify
-iMatch source or destination IP address. Windows commands reference
-tMatch by transport (layer 4) protocol. Windows commands reference

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

The following filter called MySmbSyb captures TCP synchronized SMB traffic

C:\Test> pktmon filter add MySmbSyn -i 10.10.10.10 -t TCP SYN -p 445Identify
-iMatch source or destination IP address. Windows commands reference
-tMatch by transport (layer 4) protocol. Windows commands reference
-pMatch source or destination port number. Windows commands reference

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

Matches documented abuse: Reconnaissance (T1040)

The following filter called MySubnet captures traffic on the subnet mask 255.255.255.0, or /24 in CIDR notation

C:\Test> pktmon filter add MySubnet -i 10.10.10.0/24Identify
-iMatch source or destination IP address. Windows commands reference

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

-m, --mac[-address]Match source or destination MAC address. See note above.
-v, --vlanMatch by VLAN ID (VID) in the 802.1Q header.
-d, --data-link[-protocol], --ethertypeMatch by data link (layer 2) protocol. Can be IPv4, IPv6, ARP, or a protocol number.
-t, --transport[-protocol], --ip-protocolMatch by transport (layer 4) protocol. Can be TCP, UDP, ICMP, ICMPv6, or a protocol number. To further filter TCP packets, an optional list of TCP flags to match can be provided. Supported flags are FIN, SYN, RST, PSH, ACK, URG, ECE, and CWR.
-i, --ip[-address]Match source or destination IP address. See note above. To match by subnet, use CIDR notation with the prefix length.
-p, --portMatch source or destination port number. See note above.
-b, --heartbeatMatch RCP heartbeat messages over UDP port 3343.
-e, --encapApply above filtering parameters to both inner and outer encapsulation headers. Supported encapsulation methods are VXLAN, GRE, NVGRE, and IP-in-IP. Custom VXLAN port is optional, and defaults to 4789.