How to capture a trace using Windows netsh

[Loredana]

How to capture a trace using Windows netsh

Prerequisites

• Windows Server
• CMD Administrator Rights

Procedure for capture

1. Open your browser and clear the cache, do not go to gallery yet.
2. Open CMD and type the below but change the path in the tracefile= "insert new location and rename if you wish to do so"

netsh trace start tracefile="C:\trace\classic.etl" scenario=internetclient capture=yes maxsize=200 filemode=circular overwrite=yes

        3. Go to the browser and enter the gallery link, replicate the normal steps that show up the error.
        4. After the above steps, go back to the CMD and type the below:

netsh trace stop

         5. The files can be send to be converted by support by following the below steps.

Procedure for Conversion

  1. Download the pack for conversion from github:  https://github.com/microsoft/etl2pcapng
   2. Copy the files in a new folder that you choose.

3. Copy the trace obtained in the previous step inside the same folder.


4. Open CMD administrator and change path to the etl2pcap location by using the command:
 

cd C:\location

5. Once you are in the etl2pcap folder type the below command:
 

etl2pcapng.exe classic.etl FileName.pcapng

6. Open the .pcapng file with wireshark for analysis.
 

[Ariharan]

Hi @Loredana , 

What is the use of this trace and which scenario do we need to trace like this.? 

Regards, 

Ariharan R

[lepome]

@Ariharan 

Traces as described above can help Support Engineers understand what is happening as Designer or Server reach out and connect to other resources, whether they be on networked drives, in databases, via proxy servers, even looped back to the same machine, and so on.  Usually, Alteryx Customer Support Engineers (CSEs) will request that users download and install Wireshark when such logs are needed, but some IT groups restrict downloading and installing troubleshooting tools like Wireshark or Fiddler AND also won't work with their internal users to help them obtain needed logs.  In those situations, users are stuck between policy and bureaucracy, and netsh, though less configurable, is usually already present on their machines.  

One thing to be careful about is that such traces are often quite large and contain information that might be somewhat sensitive.  They should not be emailed without encryption.  When you work with a CSE, you will be directed to upload traces rather than emailing them.