TSG for Windows Packet Capture
@@ -22,6 +22,7 @@ This document is meant to be a step-by-step guide for trouble shooting any issue
6. [I am having problems with SMB over QUIC.](#trouble-shooting-smb-over-quic-issues)
7. [No credentials when loading a server certificate from PEM with Schannel.](#convert-pem-to-pkcs12-for-schannel)
8. [TLS handshake fails in Chrome and Edge for HTTP/3 (including WebTransport) even though HTTP/1.1 and HTTP/2 work.](#using-a-self-signed-certificate-for-http3)
+9. [I need to get a packet capture](#collecting-a-packet-capture).
## Understanding Error Codes
@@ -224,6 +225,48 @@ Chromium-based browsers requires the server certificate to be trusted by a defau
See [Chromium network switches](https://source.chromium.org/chromium/chromium/src/+/main:services/network/public/cpp/network_switches.cc;l=36;drc=f8c933c2bd17344ce7ac61be2ac7725ed840b19f)
+## Collecting a Packet Capture
+
+### Linux Packet Capture
+
+> TODO
+
+### Window Packet Capture
+
+On Windows, [Packet Monitor](https://docs.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon?msclkid=79c406dcab7711ec976873fd5c4a48bf) (`pktmon`) is the best way to collect a packet capture.
+
+The (optional) first step is usually to find the interface you want to collect the capture on. Do this by first running `pktmon list`:
+
+```
+> pktmon list
+
+Network Adapters:
+ Id MAC Address Name
+ -- ----------- ----
+ 9 40-8D-5C-B5-46-51 Intel(R) Ethernet Connection (2) I219-V #2
+ 104 00-15-5D-D1-5A-30 433db3ea-0acd-457a-9c86-55bb7fa27391
+ 80 00-15-5D-AD-8B-40 433db3ea-0acd-457a-9c86-55bb7fa27391
+```
+
+> **Note** - If you don't do this and use it to filter to a specific component, you will get a packet capture at **every** layer, which will include many duplicates of each packet.
+
+Once you find the interface you want, take note of the `Id`. For instance, in the example above, I want to use the Ethernet adapter, so I need `9`.
+
+Then, to collect the capture for your scenario (example below uses port `443`), run the following:
+
+```
+pktmon filter remove
+pktmon filter add -c 9 -t UDP -p 443
+pktmon start --capture --pkt-size 0
+<run scenario>
+pktmon stop
+pktmon etl2pcap pktmon.etl
+```
+
+This produced `pktmon.pcapng` in your current directory that can then be opened by [Wireshark](https://www.wireshark.org/). If you want to be able to decrypt the QUIC packets, you will need to get/export the TLS secrets from your code (todo: add link/instructions).
+
+> **Note** - If you don't specify the component in the `filter` step, you can specify it at the `etl2pcap` step: `pktmon etl2pcap pktmon.etl -c 9` and it will produce the same final output `pcapng` file.
+
# Trouble Shooting a Performance Issue
1. [Is it a problem with just a single (or very few) connection?](#why-in-performance-bad-for-my-connection)
