

It also captures some related diagnostic information and compresses that information into a CAB file.Īt this point, S upport will ask for either the ETL file, or both the ETL and CAB file depending on the information they are looking for, to be uploaded for analysis. Notice that NETSH trace generated an ETL file and saved i t in the folder specified when starting the trace. Once reproduced, stop the trace to generate the ETL file. With the trace now running, the issue now needs to be reproduced. Use the switches they provide you if asked.)

(Note: If working with Microsoft Support, the Support Engineer may give you a slightly modified version of this command to enable certain trace options specific to your reported issue. Netsh trace start capture=yes tracefile =c:\temp\ % computername%.etl maxsize =1024 filemode =circular.Microsoft Support asked that they run the standard network trace capture command and switches: One of my customers was having some issues which required us to take a network trace. Now that we have some background, let's talk about a recent support issue I ran into. CAP file which could then be used by lots of other networking applications like Wireshark. It also can export that data into a standard.

It can open ETL files and decode the networking data contained within. Microsoft Message Analyzer was our tool to capture, display and analyze protocol messaging traffic. This brings us to Microsoft Message Analyzer. Windows Performance Analyzer is a great tool to view ETL files that contain system performance data, but not the best thing for network traces. No improvements to Netmon have been made since 2010 but is still available for download from Microsoft. įor the last few years, Microsoft has used a variety of tools to decode and view the data in ETL files, mainly NetMon, Windows Performance Analyzer and Microsoft Message Analyzer. When using NETSH to capture a network trace, it generates a specialized file with an ETL file extension. You can read all about what NETSH can be used for here. NETSH is a great tool built into the Windows OS and can be used to configure many parts of the networking stack within your Windows OS. If your issue requires network traces to be captured, Microsoft Support will often ask you to capture the m running a built-in utility called NETSH. Maybe you or your staff also has the technical expertise to review the data and make some preliminary observations while waiting for Microsoft Support to complete the investigation. Maybe y ou want to review that data yourself. Sean Greenbaum here with a tale from the field.Īs many of you have probably experienced, when working with Microsoft Premier support, you’ll often be asked to capture some data and upload it to Microsoft for analysis.
