Capture and inspect Windows Server network traffic with Packet Monitor

Intermediate

Administrator

Windows Server

Learn a repeatable Packet Monitor workflow for collecting focused, host-local network evidence on Windows Server.

Learning objectives

By the end of this module, you're able to:

Explain when Packet Monitor is useful, how cross-component capture differs from network-adapter-only capture, and what local observations can prove.
Discover network components and create a narrow filter for a known address, protocol, and port.
Select counters-only or packet logging, component scope, packet size, file size, and bounded logging options.
Collect and validate a focused trace, then convert the original event trace log to text and packet capture next generation format.
Record collection context, retain evidence safely, clean up Packet Monitor state, and recognize when advanced analysis is required.

Basic knowledge of Internet Protocol addresses, Transmission Control Protocol, User Datagram Protocol, Internet Control Message Protocol, and ports.
Familiarity with network adapters and inbound and outbound traffic.
Experience running commands in Windows PowerShell or Command Prompt.
Awareness that packet captures can contain sensitive information.