Capturing network traffic using the netsh command for the Windows Filtering Platform

The Windows Filtering Platform (WFP) is a new architecture that debuted in Windows Vista and Windows Server 2008.  Microsoft added a diagnostic tool for the Windows Filtering Platform in Windows 7 and Windows Server 2008 R2.  To capture network traffic, launch an elevated command prompt and use the following command:

netsh wfp capture start 

To stop the capture, use the command:

netsh wfp capture stop

 

Within the .cab output file, two files should be present.

Within the .XML file, details of the network traffic should be present.  The example below is a ping to the IP address of 8.8.8.8.