Capturing Network Traffic on Windows Server

๐Ÿ”’ Secure Bits ๐Ÿ’ก

๐—–๐—ฎ๐—ฝ๐˜๐˜‚๐—ฟ๐—ถ๐—ป๐—ด ๐—ป๐—ฒ๐˜๐˜„๐—ผ๐—ฟ๐—ธ ๐˜๐—ฟ๐—ฎ๐—ณ๐—ณ๐—ถ๐—ฐ ๐—ผ๐—ป ๐—ช๐—ถ๐—ป๐—ฑ๐—ผ๐˜„๐˜€ ๐—ฆ๐—ฒ๐—ฟ๐˜ƒ๐—ฒ๐—ฟ

There is an issue on a Windows Server, and I need to capture network traffic to understand what is happening. The first thought is usually:

โžก๏ธ Letโ€™s install ๐—ช๐—ถ๐—ฟ๐—ฒ๐˜€๐—ต๐—ฎ๐—ฟ๐—ธ

๐Ÿšซ But that does not always work.

In many environments I work in โ€” especially critical infrastructure or other highly secured environments โ€” ๐˜†๐—ผ๐˜‚ ๐—ฐ๐—ฎ๐—ป๐—ป๐—ผ๐˜ ๐—ท๐˜‚๐˜€๐˜ ๐—ถ๐—ป๐˜€๐˜๐—ฎ๐—น๐—น whatever tool you want on a server.

And sometimes the target is ๐—ช๐—ถ๐—ป๐—ฑ๐—ผ๐˜„๐˜€ ๐—ฆ๐—ฒ๐—ฟ๐˜ƒ๐—ฒ๐—ฟ ๐—–๐—ผ๐—ฟ๐—ฒ.

Yes, there are command-line alternatives, but downloading tools and getting them into a restricted environment is often not simple at all.

So what I learned to use instead is the ๐—ฏ๐˜‚๐—ถ๐—น๐˜-๐—ถ๐—ป ๐—ป๐—ฒ๐˜๐˜€๐—ต ๐˜๐—ฟ๐—ฎ๐—ฐ๐—ฒ.

โœ… It is straightforward, available out of the box, and that matters a lot in secure environments.

๐—ช๐—ต๐—ฒ๐—ป ๐˜†๐—ผ๐˜‚ ๐—ฎ๐—ฟ๐—ฒ ๐—ฟ๐—ฒ๐—ฎ๐—ฑ๐˜† ๐˜๐—ผ ๐˜€๐˜๐—ฎ๐—ฟ๐˜:

netsh trace start capture=yes report=disabled

๐—ช๐—ต๐—ฒ๐—ป ๐˜†๐—ผ๐˜‚ ๐—ฎ๐—ฟ๐—ฒ ๐—ฑ๐—ผ๐—ป๐—ฒ:

netsh trace stop

This gives you an ๐—˜๐—ง๐—Ÿ file.

The goal is usually not to investigate that file directly on the server, but to move it to a place where you can work with it ๐—ฐ๐—ผ๐—บ๐—ณ๐—ผ๐—ฟ๐˜๐—ฎ๐—ฏ๐—น๐˜† โ€” of course according to the security rules of the environment, because you do not want to ๐—ฒ๐˜…๐—ฝ๐—ผ๐˜€๐—ฒ sensitive traffic.

Before opening it in Wireshark, there is one extra step. Convert it with Microsoftโ€™s ๐—ฒ๐˜๐—น๐Ÿฎ๐—ฝ๐—ฐ๐—ฎ๐—ฝ๐—ป๐—ด tool:

etl2pcapng nettrace.etl nettrace.pcapng

โœ… Then you can open the PCAPNG file in Wireshark.

For some people this may sound like ๐˜‚๐—ป๐—ป๐—ฒ๐—ฐ๐—ฒ๐˜€๐˜€๐—ฎ๐—ฟ๐˜† extra work.

But once you deal with Server Core, production systems, and restricted environments, this is actually very handy.

๐—ง๐—ต๐—ถ๐˜€ ๐—ฝ๐—ผ๐˜€๐˜ ๐˜„๐—ฎ๐˜€ ๐—ถ๐—ป๐˜€๐—ฝ๐—ถ๐—ฟ๐—ฒ๐—ฑ ๐—ฏ๐˜† Andreas Bellstedt

Full article: https://www.andibellstedt.com/posts/002_capture-network.traffic/