{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "slug": "dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation", "url": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/" }, "title": "Use Pktmon counters to narrow a Windows packet-capture investigation", "summary": "How can Pktmon filtering and counters help scope a Windows networking investigation?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:17+00:00", "modified_at": "2026-09-08T18:23:26+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Administrators collecting Windows network-stack evidence with Packet Monitor.", "dse_recommendation": "Start with a narrow filter and record the operation being reproduced.", "primary_source": { "name": "Packet Monitor (Pktmon)", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Packet Monitor is included with Windows and supports capture, filtering, counting, and detection of packet drops across networking components. Microsoft’s workflow begins with command help and scenario-specific filters, uses counters for a high-level view during the experiment, and formats the log for detailed analysis. The Windows Admin Center Packet Monitoring extension presents captured traffic across the networking stack in a browsable log. Microsoft documentation.

\n

Applicability

\n

Define the affected endpoint, traffic tuple, virtual or physical path, and safe reproduction window. Review the tool options on the actual Windows release and determine who is authorized to handle the captured traffic.

\n

DSE recommendation

\n

Start with a narrow filter and record the operation being reproduced. Use the counters to decide whether the relevant traffic is present before collecting a longer trace. Keep the selected filter and component context with the capture so another investigator can understand what was excluded.

\n

Verification

\n

Check that the log contains the intended test packets and compare their counters and drop observations across components. Correlate findings with the application’s failure time. Preserve any unobserved part of the path as a limitation, and investigate a reported drop before assigning a root cause.

\n

Official references

\n

Microsoft Learn: Packet Monitor (Pktmon). Source reviewed September 8, 2026.

", "content_text": "Source facts\nPacket Monitor is included with Windows and supports capture, filtering, counting, and detection of packet drops across networking components. Microsoft’s workflow begins with command help and scenario-specific filters, uses counters for a high-level view during the experiment, and formats the log for detailed analysis. The Windows Admin Center Packet Monitoring extension presents captured traffic across the networking stack in a browsable log. Microsoft documentation.\nApplicability\nDefine the affected endpoint, traffic tuple, virtual or physical path, and safe reproduction window. Review the tool options on the actual Windows release and determine who is authorized to handle the captured traffic.\nDSE recommendation\nStart with a narrow filter and record the operation being reproduced. Use the counters to decide whether the relevant traffic is present before collecting a longer trace. Keep the selected filter and component context with the capture so another investigator can understand what was excluded.\nVerification\nCheck that the log contains the intended test packets and compare their counters and drop observations across components. Correlate findings with the application’s failure time. Preserve any unobserved part of the path as a limitation, and investigate a reported drop before assigning a root cause.\nOfficial references\nMicrosoft Learn: Packet Monitor (Pktmon). Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nPacket Monitor is included with Windows and supports capture, filtering, counting, and detection of packet drops across networking components. Microsoft’s workflow begins with command help and scenario-specific filters, uses counters for a high-level view during the experiment, and formats the log for detailed analysis. The Windows Admin Center Packet Monitoring extension presents captured traffic across the networking stack in a browsable log. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon).\n\n## Applicability\n\nDefine the affected endpoint, traffic tuple, virtual or physical path, and safe reproduction window. Review the tool options on the actual Windows release and determine who is authorized to handle the captured traffic.\n\n## DSE recommendation\n\nStart with a narrow filter and record the operation being reproduced. Use the counters to decide whether the relevant traffic is present before collecting a longer trace. Keep the selected filter and component context with the capture so another investigator can understand what was excluded.\n\n## Verification\n\nCheck that the log contains the intended test packets and compare their counters and drop observations across components. Correlate findings with the application’s failure time. Preserve any unobserved part of the path as a limitation, and investigate a reported drop before assigning a root cause.\n\n## Official references\n\n[Microsoft Learn: Packet Monitor (Pktmon)](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "url": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use Pktmon counters to narrow a Windows packet-capture investigation", "item": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "url": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/", "headline": "Use Pktmon counters to narrow a Windows packet-capture investigation", "description": "How can Pktmon filtering and counters help scope a Windows networking investigation?", "abstract": "How can Pktmon filtering and counters help scope a Windows networking investigation?", "articleBody": "Source facts\nPacket Monitor is included with Windows and supports capture, filtering, counting, and detection of packet drops across networking components. Microsoft’s workflow begins with command help and scenario-specific filters, uses counters for a high-level view during the experiment, and formats the log for detailed analysis. The Windows Admin Center Packet Monitoring extension presents captured traffic across the networking stack in a browsable log. Microsoft documentation.\nApplicability\nDefine the affected endpoint, traffic tuple, virtual or physical path, and safe reproduction window. Review the tool options on the actual Windows release and determine who is authorized to handle the captured traffic.\nDSE recommendation\nStart with a narrow filter and record the operation being reproduced. Use the counters to decide whether the relevant traffic is present before collecting a longer trace. Keep the selected filter and component context with the capture so another investigator can understand what was excluded.\nVerification\nCheck that the log contains the intended test packets and compare their counters and drop observations across components. Correlate findings with the application’s failure time. Preserve any unobserved part of the path as a limitation, and investigate a reported drop before assigning a root cause.\nOfficial references\nMicrosoft Learn: Packet Monitor (Pktmon). Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:17+00:00", "dateModified": "2026-09-08T18:23:26+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-114-use-pktmon-counters-to-narrow-a-windows-packet-capture-investigation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use Pktmon counters to narrow a Windows packet-capture investigation" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Packet Monitor (Pktmon)", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon" } } ] } }