Windows built in packet capture

! Start capture 
! --capture enables packet capture.
! --comp nics captures traffic for all network interfaces.
! --etw enables detailed logging of events.
pktmon start --capture --comp nics --etw --file C:\PktMon.etl
pktmon start --capture  --etw -p process --file C:\PktMon.etl

pktmon stop

pktmon etl2pcap C:\PktMon.etl -o C:\PktMon.pcapng

! .pcap will be generated in same location as cd 



------------------------------------------------------

Capturing process info 

pktmon start --capture  --etw  --file C:\PktMon.etl
pktmon stop
pktmon format PktMon.etl -o report.txt