This section provides an overview of Netsh trace usage.
.gif) Note |
|
The examples in this section, Using Netsh trace commands, are documented as if you have entered the Netsh trace context. If you have not already entered the Netsh trace context, you can run these commands from the command prompt by prepending Netsh trace to each example. |
Identifying scenarios
The Netsh trace context contains predefined sets of trace providers, known as scenarios, which you can enable for troubleshooting. To view a complete list of scenarios and a brief description of each scenario’s purpose, type show scenarios.
Following is an example of the results that are rendered by running the Netsh trace show scenarios command:
netsh trace>show scenarios
Available scenarios (13):
-------------------------------------------------------------------
AddressAcquisition : Troubleshoot address acquisition-related issues
DirectAccess : Troubleshoot DirectAccess related issues
FileSharing : Troubleshoot common file and printer sharing problems
InternetClient : Diagnose web connectivity issues
InternetServer : Troubleshoot server-side web connectivity issues
L2SEC : Troubleshoot layer 2 authentication related issues
LAN : Troubleshoot wired LAN related issues
Layer2 : Troubleshoot layer 2 connectivity related issues
NDIS : Troubleshoot network adapter related issues
NetConnection : Troubleshoot issues with network connections
RPC : Troubleshoot issues related to RPC framework
WFP-IPsec : Troubleshoot Windows Filtering Platform and IPsec related issues
WLAN : Troubleshoot wireless LAN related issues
netsh trace>
When you have identified the scenario that appears to be most relevant to your issues, you can see a list of all of the providers included in that scenario. For example, to see all of the providers enabled under the LAN scenario, type show scenario lan.
Following is an example of the results that are rendered by running the Netsh trace show scenario lan command:
netsh trace>show scenario lan
Description: Troubleshoot wired LAN related issues
Providers
---------
Provider:
Name: Microsoft-Windows-L2NACP
Provider Guid: {85FE7609-FF4A-48E9-9D50-12918E43E1DA}
Default Level: 4 (win:Informational)
Default Keywords: 0x0
Provider:
Name: Microsoft-Windows-Wired-AutoConfig
Provider Guid: {B92CF7FD-DC10-4C6B-A72D-1613BF25E597}
Default Level: 4 (win:Informational)
Default Keywords: 0x0
Provider:
Name: Microsoft-Windows-NDIS
Provider Guid: {CDEAD503-17F5-4A3E-B7AE-DF8CC2902EB9}
Default Level: 4 (win:Informational)
Default Keywords: 0x0
Provider:
Name: Microsoft-Windows-EapHost
Provider Guid: {6EB8DB94-FE96-443F-A366-5FE0CEE7FB1C}
Default Level: 4 (win:Informational)
Default Keywords: 0x0
Provider:
Name: Microsoft-Windows-OneX
Provider Guid: {AB0D8EF9-866D-4D39-B83F-453F3B8F6325}
Default Level: 4 (win:Informational)
Default Keywords: 0x0
netsh trace>
Obtaining trace provider details
To obtain a complete list of providers, you can type show providers from within the Netsh trace context. The show providers command lists – by name and GUID - every available provider, including providers that are not relevant to networking.
Following is a short excerpt of the list of providers that are rendered as a result of running the show providers command:
{0F67E49F-FE51-4E9F-B490-6F2948CC6027} Microsoft-Windows-Kernel-Processor-Power
{122EE297-BB47-41AE-B265-1CA8D1886D40} Microsoft-Windows-LoadPerf
{127E0DC5-E13B-4935-985E-78FD508B1D80} Microsoft-Windows-TerminalServices-RdpSoundDriver
{134EA407-755D-4A93-B8A6-F290CD155023} Microsoft-Windows-HomeGroup-ControlPanel
{13B197BD-7CEE-4B4E-8DD0-59314CE374CE} Microsoft-Windows-Perflib
{1418EF04-B0B4-4623-BF7E-D74AB47BBDAA} Microsoft-Windows-WMI-Activity
{155CB334-3D7F-4FF1-B107-DF8AFC3C0363} Microsoft-Windows-MSDTC Client 2
{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED} Microsoft-Windows-Dhcp-Client
{15CA44FF-4D7A-4BAA-BBA5-0998955E531E} Microsoft-Windows-Kernel-Boot
{17D6E590-F5FE-11DC-95FF-0800200C9A66} Microsoft-Windows-ApplicationExperience-SwitchBack
{17E92E2A-3D08-413E-BAEB-A79A262BF486} Microsoft-Windows-MsiServer
{17F14A23-551D-40CC-A086-E4194D64ED4C} Microsoft-Windows-WABSyncProvider
{18F4A5FD-FD3B-40A5-8FC2-E5D261C5D02E} Microsoft-Windows-ApplicationExperience-LookupServiceTrigger
{192EDE41-9175-4C86-AC02-9D003C9D43AB} Microsoft-Windows-DisplaySwitch
{199FE037-2B82-40A9-82AC-E1D46C792B99} LsaSrv
You can obtain details about a specific provider by typing show provider followed by the provider name. For example, to see details about the Microsoft-Windows-Dhcp-Client provider, type show provider name=Microsoft-windows-dhcp-client.
Following is an example of the results that are rendered by running the show provider name=Microsoft-windows-dhcp-client command:
netsh trace>show provider name=Microsoft-windows-dhcp-client
Name: Microsoft-Windows-Dhcp-Client
Provider Guid: {15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}
Levels (value) - 3 element(s)
-------------------------------------------------------------------
win:Error (2)
win:Warning (3)
win:Informational (4)
Keywords (mask) - 4 element(s)
-------------------------------------------------------------------
win:ResponseTime (0x1000000000000)
Microsoft-Windows-Dhcp-Client/Operational (0x8000000000000000)
Microsoft-Windows-Dhcp-Client/Admin (0x4000000000000000)
System (0x2000000000000000)
netsh trace>
Using filters to limit ETL trace file details
When troubleshooting, it is frequently beneficial to target tracing results by limiting irrelevant tracing details. For example, if you are running traces over an extended period of time, or if you are running tracing scenarios in which multiple providers are enabled, the resulting ETL trace file can become very large. If the ETL trace file becomes too large, the ETW buffer constraints may cause some traces to be dropped. Additionally, reducing the amount of data in the ETL trace file can simplify troubleshooting by reducing the amount of data to review.
You can use Netsh trace filters to reduce the ETL trace file size. The trace filters that you can apply to individual providers are:
The Netsh trace context also supports packet filtering capability that is similar to Network Monitor. See the Remarks section within the Netsh trace start command section in this topic for information about trace packet filter parameters and usage.
To see a list of filters which can be applied, type show CaptureFilterHelp.
The following example is an excerpt of the filter information that is displayed by running the show CaptureFilterHelp command.
netsh trace>show capturefilterhelp
Capture Filters:
Capture filters are only supported when capture is explicitly
enabled with capture=yes. Supported capture filters are:
CaptureInterface=<interface name or GUID>
Enables packet capture for the specified interface name or GUID. Use
'netsh trace show interfaces' to list available interfaces.
e.g. CaptureInterface={716A7812-4AEE-4545-9D00-C10EFD223551}
e.g. CaptureInterface=!{716A7812-4AEE-4545-9D00-C10EFD223551}
e.g. CaptureInterface="Local Area Connection"
Ethernet.Address=<MAC address>
Matches the specified filter against both source and destination
MAC addresses.
e.g. Ethernet.Address=00-0D-56-1F-73-64
Wifi.Type=<Management|Data>
Matches the specified filter against the Wifi type. Allowed values
are 'Management' and 'Data'. If not specified, the Wifi.Type filter
is not applied.
Note: This capture filter does not support ranges, lists or negation.
e.g. Wifi.Type=Management
Protocol=<protocol>
Matches the specified filter against the IP protocol.
e.g. Protocol=6
e.g. Protocol=!(TCP,UDP)
e.g. Protocol=(4-10)
netsh trace>
Example Netsh trace filter parameters and usage
Following is an example start command for Netsh trace that includes filter parameters.
-
start InternetClient provider=Microsoft-Windows-TCPIP level=5 keywords=ut:ReceivePath,ut:SendPath
In this example, the level is set to 5, which means that 5 events is the maximum number of events that will be shown. The keywords ut:ReceivePath and ut:SentPath filter the events to show only the events that are traced on the receive or send path.
|
Note |
|
255 is the maximum that is supported by ETW. ETW maximums can vary by provider, within the range of 0 – 255. In the example, the value of 5 is the highest level supported by Microsoft-Windows-TCPIP. |
See the Remarks section within the Netsh trace start command in this topic for additional details concerning trace filter parameters and usage.
Starting and stopping trace
You can start a trace for all of the providers in a given scenario. For example, to start a trace for all of the providers enabled under the InternetClient scenario, type start scenario=internetclient. You can also start a trace for additional providers not included in that particular scenario. For example, you might want to start traces for all of the providers enabled under the WLAN scenario and also for the DHCP provider. To do this, you can type start scenario=wlan provider=Microsoft-Windows-Dhcp-Client.
To stop tracing, type stop from within the Netsh trace context.
Using the files rendered by trace
When tracing is stopped, two files are generated by default:
-
An Event Trace Log (ETL) file. The ETL file collects trace events, which can be viewed using tools such as Network Monitor. By default, the ETL is saved as nettrace.etl.
| Note |
|---|
| You can specify a different name by including the tracefile=FileName.etl parameter when starting the trace, where FileName is the name you specify for the saved .etl file. |
-
A .cab file. The .cab file contains detailed information about the software and hardware on the system, such as the adapter information, build, operating system, and wireless settings. By default, the .cab file will be named nettrace.cab by default, unless another name was specified as indicated above. The .cab file will contain two files, which will always be named as follows:
- Report.etl. Report.etl is a duplicate copy of the information included in nettrace.etl.
- Report.html. The report.html file includes additional information about the trace events, as well as other information that was collected by trace.
.gif) Tip |
|---|
|
To receive the most detailed information, include the command parameter report=yes when starting a trace. |