我想知道是否有一个工具,我可以用来编写数据包捕获(命令行)脚本,而无需安装任何东西(最好不是pcap).这适用于
Windows机器;该工具将使用管理凭据运行.
我只想收集发送和发送的数据包的源/目标IP和端口对. Netstat不起作用,因为会话可以在几毫秒内打开和关闭,并且会被遗漏.
Windows 7及更高版本内置了此功能.
http://blogs.msdn.com/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx
原文链接：https://www.f2er.com/windows/370454.htmlhttp://blogs.msdn.com/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx
The short version:
Open an elevated command prompt and run:
netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl(make sure you have a \temp directory or choose another location).Reproduce the issue or do a reboot if you are tracing a slow boot scenario.
Open an elevated command prompt and run:
netsh trace stopYour trace will be stored in c:\temp\nettrace-boot.etl** or where ever you saved it. You can view the trace on another machine using netmon.
