that we arnt getting a response from a DHCP server ). I can see above, the DHCP discover packets have been parsed correctly (and. Now the output is ready for you to analyse: When you open the file you might find that it looks a bit rubbish at first:Īll you need to do is go to the tools > options tab so that you can tell netmon which parsers to use to convert the trace:Ĭhoose the Windows parsers and dont forget to click 'set as active' before you click OK or nothing will happen. For customers, I capture using the netsh switch then get permission to view the data on my machine where I have netmon installed. Now that you have the trace, you can take it to a machine where installing netmon is more appropriate to view the data. If you forget to elevate the prompt you will get this: Log on and stop the trace using: ' netsh trace stop' (from an elevated prompt). I will do this trace for a slow boot scenario - it works fine for non reboot scenarios too, just reproduce the issue and then stop the trace.ģ.

You can view the trace on another machine using netmon.

Your trace will be stored in c: emp ettrace-boot.etl**or where ever you saved it. Open an elevated command prompt and run: ' netsh trace stop' Reproduce the issue or do a reboot if you are tracing a slow boot scenario.ģ. Open an elevated command prompt and run: ' netsh trace start persistent=yes capture=yes tracefile=c: emp ettrace-boot.etl' (make sure you have a emp directory or choose another location).Ģ. (This feature works on Windows 7/2008 R2 and above).ġ. If you need to capture a network trace of a client or server without installing Wireshark or Netmon this might be helpful for you.

Wireshark trace