Skip to content

Latest commit

 

History

History
27 lines (18 loc) · 767 Bytes

README.md

File metadata and controls

27 lines (18 loc) · 767 Bytes

ndisdump

A no-dependencies network packet capture tool for Windows.

Introduction

Windows systems come with a pre-installed network filter, ndiscap.sys, which is used by netsh trace command to perform network captures into an .etl file. The file which must then be converted to .pcapng with another tool.

This repository contains ndisdump, a tool that uses ndiscap.sys to perform network capture directly into .pcapng file.

Usage: ndisdump [-s SNAPLEN] -w FILE

-w FILE      The name of the output .pcapng file.
-s SNAPLEN   Truncate packets to SNAPLEN to save disk space.

You can terminate the capture with Ctrl+C.

TODO

The ultimate aim is for this tool to have the same command-line interface as tcpdump, including the filter language.