Windows 11’s Hidden Packet Capture Utility: What Home‑Lab Enthusiasts Are Missing

If you’ve been tinkering with a home‑lab on a Windows 11 machine, you’ve probably reached for Wireshark or a third‑party sniffer more than once. What most people don’t realise is that the operating system already ships with a surprisingly capable packet capture engine, tucked away under the name pktmon.

Introduced back in the Windows 10 era, pktmon (short for Packet Monitor) got a bit of polish for Windows 11, and it now supports everything from Ethernet frames to wireless adapters, plus a handy conversion tool that spits out standard pcapng files ready for Wireshark. The best part? It’s already on your system – no extra drivers, no extra installs.

Why does this matter? For a hobbyist lab, every extra piece of software is another potential point of failure, not to mention the time spent hunting down the right version for your OS build. With pktmon you get a native, low‑overhead capture that can run from the command line, as a service, or even from a scheduled task. That makes it perfect for long‑running experiments where you want to log traffic without hogging CPU cycles.

Getting started is almost embarrassingly simple. Open an elevated PowerShell window and type:

pktmon start --capture --etw -p 0

The command tells pktmon to begin capturing everything (the –p 0 flag means no filter) and to write the output in ETW (Event Tracing for Windows) format. By default the file lands in the current directory as pktmon.etl.

When you’re ready to stop, just run:

pktmon stop

Now you have an .etl file, but Wireshark can’t read that directly. Thankfully pktmon includes a conversion helper. Run:

pktmon format pktmon.etl -o capture.pcapng

The resulting capture.pcapng can be opened in Wireshark, where you’ll see the same rich packet details you’re used to – protocols, flags, timestamps, the whole shebang.

If you need something more focused, pktmon also accepts simple filters. For example, to capture only traffic on port 80 you could use:

pktmon start --capture --etw -p 0 -f "tcp.port==80"

That tiny filter cuts down file size dramatically, which is handy when you’re running a continuous capture on a low‑powered device like a Raspberry Pi acting as a Windows‑based router.

Another neat trick is to run pktmon as a Windows service, so it starts automatically with the system and keeps logging even after a reboot. Create a basic service definition with sc create pktmonsvc binPath= "C:\Windows\System32\pktmon.exe start --capture --etw" start= auto, then start it with sc start pktmonsvc. The service will keep appending to the same .etl file, and you can stop it whenever you like.

Of course, pktmon isn’t a silver bullet. It lacks some of the advanced dissecting features of Wireshark’s live capture mode, and its UI is purely command‑line, which can feel a bit cold for newcomers. But for most home‑lab scenarios – testing firewalls, monitoring IoT chatter, or just learning how protocols behave – it does the job admirably.

Bottom line: before you go hunting for a third‑party sniffer, open a PowerShell window, type pktmon, and see what you’ve been missing. It’s a small tool with a surprisingly big impact on any Windows‑centric networking sandbox.