Skip to content

Instantly share code, notes, and snippets.

@PshMike

PshMike/cap.ps1

Created March 22, 2020 10:27
Show Gist options
  • Save PshMike/d8c94fc8788898df667637454c6229e4 to your computer and use it in GitHub Desktop.
Save PshMike/d8c94fc8788898df667637454c6229e4 to your computer and use it in GitHub Desktop.
Download ZIP
Packet Capture using PowerShell
Raw
cap.ps1
$cs = New-CimSession -ComputerName SERVER001
New-NetEventSession -CimSession $cs -Name mycap -LocalFilePath c:\temp\netcapture.etl
Add-NetEventPacketCaptureProvider -CimSession $cs -SessionName mycap
Start-NetEventSession -CimSession $cs -Name mycap
break
# run these next two lines to stop the capture
Stop-NetEventSession -CimSession $cs -Name mycap
Remove-NetEventSession -CimSession $cs -Name mycap
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment