how to capture all packet size using windows pktmon

user_13960041 0
Viewed 485

I am trying to use pktmon(built-in windows packet analyzer). However from the documentation they mention that by default packet size is limited to 128 bytes but can be increase with the following command pktmon start --etw -p 0.

But running that command gives me this error Error: '0' is not a valid event provider Id. what could be wrong?

So far I've not seen anything helpful on the internet.

packet-capture windows
2 Answers

From the utility help:

--pkt-size Number of bytes to log from each packet. To always log the entire packet set this to 0. Default is 128 bytes.

user_10915360

Most of the examples on the internet show

pktmon start --etw -p 0 -c 1

The -p doesn't seem to work and also the -c. So what worked for me is

pktmon start --etw --pkt-size 0 --comp 1
user_42024940
Related