netsh trace start capture=yes report=disabled
。。。
netsh trace stop
etl2pcapng.exe "C:\Users\yfhu\AppData\Local\Temp\NetTraces\NetTrace.etl" 1.pcap
https://github.com/microsoft/etl2pcapng
https://www.sonicwall.com/support/knowledge-base/how-can-i-perform-a-packet-capture-in-windows-with-built-in-utility/170905204545360/
==============
Microolap TCPDUMP for Windows — Download
https://www.microolap.com/products/network/tcpdump/download/
以管理员身份运行：
tcpdump
列出全部网卡：
tcpdump -D
1.\Device\{2B90FA51-0A1A-43FF-B4C9-D6F595DDEA05} (Realtek RTL8822BE 802.11ac PCIe Adapter)
2.\Device\{4E029346-F271-4953-BBC8-E72AD49C0A48} (Microsoft Wi-Fi Direct Virtual Adapter)
3.\Device\{968BB362-A609-4346-A84E-A4C983CDF7DF} (Realtek PCIe GbE Family Controller)
4.\Device\{94214CFD-26E2-49CD-982C-E4829693647D} (Microsoft Wi-Fi Direct Virtual Adapter)
指定网卡抓包：
tcpdump -nnn -i 3 host 233.6.6.6 and udp
[
本帖最后由 linda 于 2021-8-13 17:15 编辑 ]
