Rafael Pfister

Packet capture

Capture packets and list open connections: see what actually crosses the wire.

Capture a port

Captures the traffic on a port: the most reliable answer to whether packets arrive at all.

SMTP (25)

PowerShell (Windows)

pktmon Built-in 

pktmon filter remove
pktmon filter add -p 25
pktmon start --capture --pkt-size 0 -f capture.etl
# ... reproduzieren, dann:
pktmon stop
pktmon etl2txt capture.etl -o capture.txt

tcpdump (WSL/Npcap) Add-on tool 

tcpdump -i eth0 -n -c 200 port 25

Unix shell (bash)

tcpdump Built-in 

tcpdump -i eth0 -nn -c 200 port 25

tshark Add-on tool 

tshark -i eth0 -c 200 -f "port 25"

Submission (587)

PowerShell (Windows)

pktmon Built-in 

pktmon filter remove
pktmon filter add -p 587
pktmon start --capture --pkt-size 0 -f capture.etl
# ... reproduzieren, dann:
pktmon stop
pktmon etl2txt capture.etl -o capture.txt

tcpdump (WSL/Npcap) Add-on tool 

tcpdump -i eth0 -n -c 200 port 587

Unix shell (bash)

tcpdump Built-in 

tcpdump -i eth0 -nn -c 200 port 587

tshark Add-on tool 

tshark -i eth0 -c 200 -f "port 587"

pktmon ships with Windows 10/Server 2019 and later and needs an administrator session. On Linux, tcpdump needs root or the CAP_NET_RAW capability.

Capture a peer

Captures only the traffic to one peer, regardless of port.

PowerShell (Windows)

netsh trace Built-in 

netsh trace start capture=yes tracefile=C:\temp\trace.etl maxsize=200 Ethernet.Type=IPv4 IPv4.Address=mail.example.com
# ... reproduzieren, dann:
netsh trace stop

tcpdump (WSL/Npcap) Add-on tool 

tcpdump -i eth0 -nn -c 200 host mail.example.com

Unix shell (bash)

tcpdump Built-in 

tcpdump -i eth0 -nn -c 200 host mail.example.com

tshark Add-on tool 

tshark -i eth0 -c 200 -f "host mail.example.com"

netsh trace writes an ETL file you can open in Microsoft Network Monitor, or in Wireshark after conversion.

Read the SMTP dialog

Shows the SMTP conversation in clear text: commands, response codes and the peer's error messages.

PowerShell (Windows)

pktmon Built-in 

pktmon filter remove
pktmon filter add -p 25
pktmon start --capture --pkt-size 0 -f smtp.etl
# ... reproduzieren, dann: pktmon stop; pktmon etl2txt smtp.etl -o smtp.txt

tcpdump (WSL/Npcap) Add-on tool 

tcpdump -i eth0 -nn -A -s 0 port 25

Unix shell (bash)

tcpdump Built-in 

tcpdump -i eth0 -nn -A -s 0 port 25

tshark Add-on tool 

tshark -i eth0 -Y smtp -T fields -e smtp.req.command -e smtp.req.parameter -e smtp.rsp.code

This only works unencrypted (port 25 without STARTTLS). Once TLS kicks in, the content is encrypted and only the handshake stays visible.

Capture to a file

Writes the capture to a file so you can analyse it later (for example in Wireshark).

PowerShell (Windows)

pktmon Built-in 

pktmon filter remove
pktmon filter add -p 25
pktmon start --capture --pkt-size 0 -f capture.etl
# ... reproduzieren, dann: pktmon stop
pktmon pcapng capture.etl -o capture.pcapng

tcpdump (WSL/Npcap) Add-on tool 

tcpdump -i eth0 -nn -s 0 -w capture.pcap port 25

Unix shell (bash)

tcpdump Built-in 

tcpdump -i eth0 -nn -s 0 -w capture.pcap port 25
tcpdump -r capture.pcap -nn | head -50

tshark Add-on tool 

tshark -i eth0 -w capture.pcap -f "port 25"

pktmon writes ETL and can convert it with "pktmon pcapng" into a format Wireshark reads.

Open connections

Shows established connections to a peer including the process: a quick alternative when a capture is not possible.

PowerShell (Windows)

Get-NetTCPConnection Built-in 

Get-NetTCPConnection -RemoteAddress (Resolve-DnsName mail.example.com -Type A).IPAddress -ErrorAction SilentlyContinue |
  Select-Object LocalPort, RemoteAddress, RemotePort, State, OwningProcess

netstat Built-in 

netstat -ano | findstr ESTABLISHED

Unix shell (bash)

ss Built-in 

ss -tnp state established "dst mail.example.com"

lsof Add-on tool 

lsof -nP -iTCP -sTCP:ESTABLISHED | grep mail.example.com

Other areas