Use Pktmon counters to narrow a Windows packet-capture investigation

Source facts

Packet Monitor is included with Windows and supports capture, filtering, counting, and detection of packet drops across networking components. Microsoft’s workflow begins with command help and scenario-specific filters, uses counters for a high-level view during the experiment, and formats the log for detailed analysis. The Windows Admin Center Packet Monitoring extension presents captured traffic across the networking stack in a browsable log. Microsoft documentation.

Applicability

Define the affected endpoint, traffic tuple, virtual or physical path, and safe reproduction window. Review the tool options on the actual Windows release and determine who is authorized to handle the captured traffic.

DSE recommendation

Start with a narrow filter and record the operation being reproduced. Use the counters to decide whether the relevant traffic is present before collecting a longer trace. Keep the selected filter and component context with the capture so another investigator can understand what was excluded.

Verification

Check that the log contains the intended test packets and compare their counters and drop observations across components. Correlate findings with the application’s failure time. Preserve any unobserved part of the path as a limitation, and investigate a reported drop before assigning a root cause.

Official references

Microsoft Learn: Packet Monitor (Pktmon). Source reviewed September 8, 2026.