|
| 1 | +--- |
| 2 | +title: netsh trace |
| 3 | +description: The netsh trace command captures network traffic and trace events for network diagnostics and troubleshooting in Windows. |
| 4 | +ms.topic: reference |
| 5 | +ms.author: alalve |
| 6 | +author: xelu86 |
| 7 | +ms.date: 10/06/2025 |
| 8 | +--- |
| 9 | + |
| 10 | +# netsh trace |
| 11 | + |
| 12 | +The `netsh trace` command allows you to capture detailed network traffic and trace events, providing valuable data for diagnosing and troubleshooting network problems on Windows systems. It supports a range of options for filtering, exporting, and analyzing trace data. |
| 13 | + |
| 14 | +## Syntax |
| 15 | + |
| 16 | +``` |
| 17 | +netsh trace [convert | correlate | diagnose | dump | export | help | merge | postreset | show | start | ?] |
| 18 | +``` |
| 19 | + |
| 20 | +``` |
| 21 | +netsh trace convert [input=]tracefilename.etl [output=]filename [dump=]CSV|XML|EVTX|TXT|No [report=]yes|no |
| 22 | + [overwrite=]yes|no [metadata=]yes|no [tmfpath=]pathname [manpath=]pathname |
| 23 | +``` |
| 24 | + |
| 25 | +``` |
| 26 | +netsh trace correlate [input=]tracefilename.etl [output=]newtracefilename.etl [filter=]Activity_ID |
| 27 | + [overwrite=]yes|no [retaincorrelationevents=]yes|no [retainpii=]yes|no |
| 28 | + [retainglobalevents=]yes|no |
| 29 | +``` |
| 30 | + |
| 31 | +``` |
| 32 | +netsh trace diagnose [scenario=]<scenarioname> [namedAttribute=]<attributeValue> |
| 33 | + [saveSessionTrace=]<yes|no> [report=]<yes|no> [capture=]<yes|no> |
| 34 | +``` |
| 35 | + |
| 36 | +``` |
| 37 | +netsh trace dump |
| 38 | +``` |
| 39 | + |
| 40 | +``` |
| 41 | +netsh trace export [scenario=]<scenarioname> [file=]<filename> |
| 42 | +``` |
| 43 | + |
| 44 | +``` |
| 45 | +netsh trace merge |
| 46 | +``` |
| 47 | + |
| 48 | +``` |
| 49 | +netsh trace postreset |
| 50 | +``` |
| 51 | + |
| 52 | +``` |
| 53 | +netsh trace show <capturefilterhelp> |
| 54 | + <globalkeywordsandlevels> |
| 55 | + <helperclass> [name=]<helperclassname> |
| 56 | + <interfaces> |
| 57 | + <provider> [name=]<providerIdOrName> |
| 58 | + <providerfilerhelp> |
| 59 | + <providers> |
| 60 | + <scenario> [name=]<scenarioname> |
| 61 | + <scenarios> |
| 62 | + <status> |
| 63 | +``` |
| 64 | + |
| 65 | +``` |
| 66 | +netsh trace start [sessionname]=<sessionname> [scenario=]<scenario1,scenario2> [globalKeywords=]keywords |
| 67 | + [globalLevel=]level [[capture=]yes|no] [capturetype=]physical|vmswitch|both |
| 68 | + [report=]yes|no|disabled [persistent=]yes|no [traceFile=]path\filename |
| 69 | + [maxSize=]filemaxsize [fileMode=]single|circular|append [overwrite=]yes|no |
| 70 | + [correlation=]yes|no|disabled [capturefilters] [provider=]providerIdOrName |
| 71 | + [keywords=]keywordMaskOrSet [level=]level [bufferSize=]<bufferSize> |
| 72 | + [provider=]provider2IdOrName [providerFilter=]yes|no [keywords=]keyword2MaskOrSet |
| 73 | + [perfMerge=]yes|no [level=]level2 ... |
| 74 | +``` |
| 75 | + |
| 76 | +## Parameters |
| 77 | + |
| 78 | +> [!NOTE] |
| 79 | +> Certain commands and parameters might only function fully in previous versions of Windows and Windows Server, which are no longer in support. |
| 80 | +
|
| 81 | +| Command | Description | |
| 82 | +|--|--| |
| 83 | +| trace `convert` | Converts a trace file to an HTML report. <br><br> `input`: Specifies the input Event Trace Log (ETL) file. <br> `output`: Sets the output file name. If not specified, defaults to the input file name. <br> `dump`: Chooses the output format: `TXT` (default), `CSV`, `XML`, `EVTX`, or `No` (no dump). <br> `report`: Generates an HTML report if set to `yes`. Default is `no`. <br> `overwrite`: Overwrites existing files if set to `yes`. Default is `no`. <br> `metadata`: Includes metadata traces in the output if set to `yes`. Default is `no`. <br> `tmfpath`: Provides the path to the Trace Message Format (TMF) files for decoding the Windows Software Trace Preprocessor (WPP) traces. <br> `manpath`: Provides the path to manifest files for decoding Event Traces for Windows (ETW) traces. | |
| 84 | +| trace `correlate` | Normalizes or filters a trace file, producing a new output file. You can filter by Activity ID (a GUID in the format `{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}`) to include only related events. The command can also retain correlation events, personal data (such as packet capture events), and global events. <br><br> `input`: Specifies the input ETL trace file. <br> `output`: Sets the output file name and path. <br> `filter`: Outputs only events related to the specified Activity GUID. Default is none. <br> `overwrite`: Overwrites existing files if set to `yes`. Default is `no`. <br> `retaincorrelationevents`: Retains correlation events if set to `yes`. Default is `no`. <br> `retainpii`: Retains events containing personal data if set to `yes` (default). <br> `retainglobalevents`: Retains global events if set to `yes` (default). | |
| 85 | +| trace `diagnose` | Starts a diagnostic session. <br><br> `scenario`: Specifies a diagnostic scenario name (example, `InternetClient`). <br> `namedAttribute`: Supply the additional details or options for the scenario, which is dependent on the scenario chosen. <br> `saveSessionTrace`: If set to `yes`, saves the trace data from the session for later analysis. If `no`, the trace isn't saved. This option defaults to `yes` if `report=yes`. <br> `report`: If set to `yes`, generates a diagnostic report after running the scenario. If `no` (default), no report is created. <br> `capture`: If set to `yes`, captures network traffic during the diagnosis. If `no` (default), traffic isn't captured. | |
| 86 | +| trace `dump` | Creates a script containing the current context configuration. The script can be saved to a file and used to restore settings if they're altered or need to be replicated on another system. | |
| 87 | +| trace `export` | Exports a scenario to a Windows Performance Recorder (WPR) profile. <br><br> `scenario`: Specifies the name of the tracing scenario to export. <br> `file`: Sets the output file name and path for the exported WPR profile. | |
| 88 | +| trace `merge` | Merges multiple trace files into one and enriches the output with symbol and PerfTrack metadata for improved analysis. | |
| 89 | +| trace `postreset` | Restores the global tracing settings to default after a network stack reset. | |
| 90 | +| trace `show` | Displays information for the following parameters: <br><br> `capturefilterhelp`: Lists all supported capture filters and provides usage examples. <br> `globalkeywordsandlevels`: Displays available global keywords and tracing levels for configuration. <br> `helperclass`: Provides information about helper classes used in tracing. <br> `interfaces`: Lists all network interfaces available for tracing. <br> `provider`: Displays detailed information about a specific trace provider. <br> `providerfilterhelp`: Lists supported provider filters and explains their usage. <br> `providers`: Shows all trace providers available on the system. <br> `scenario`: Displays details about a specific tracing scenario. <br> `scenarios`: Lists all available tracing scenarios. <br> `status`: Shows the current tracing configuration and session status. | |
| 91 | +| trace `start` | Starts a trace session. <br><br> `sessionname`: Specifies the name of the trace session. <br> `scenario`: Specifies a predefined scenario (`LAN`, `InternetClient`, etc.) <br> `globalKeywords`: Filters events for all providers using ETW keywords. <br> `globalLevel`: Sets the verbosity for global events: <br> - `1` (Critical): Only critical events. <br> - `2` (Error): Critical and error events. <br> - `3` (Warning): Critical, error, and warning events. <br> - `4` (Informational): Adds informational events. <br> - `5` (Verbose): Captures all events, including detailed debug info. <br> `capture`: Whether to capture network packets (`yes` or `no`). <br> `capturetype`: Specifies the packet capture type (`physical`, `vmswitch`, or `both`). <br> `report`: Generate an HTML report after tracing (`yes`, `no`, or `disabled`). <br> `persistent`: Keeps the session running after a system reboot (`yes` or `no`). <br> `traceFile`: Full path and filename for the trace output. <br> `maxSize`: Maximum size of the trace file in megabytes. <br> `fileMode`: Specifies the method of file writing mode: <br> - `single`: All data is written to one file up to the specified file size in megabytes. <br> - `circular`: Overwrites oldest data when file reaches max size (acts as a ring buffer). <br> - `append`: Adds new trace data to the end of an existing file. <br> `overwrite`: Overwrites existing trace file (`yes` or `no`). <br> `correlation`: Enables correlation for events (`yes`, `no`, or `disabled`). <br> `capturefilters`: Filters for captured packets (IP, TCP port, etc.). <br> `provider`: Specifies the ETW provider by GUID or name. <br> `keywords`: *Provider*-specific keyword filtering. <br> `level`: *Provider*-specific verbosity. <br> `bufferSize`: Size of the trace buffer in megabytes. <br> `providerFilter`: Enables *provider*-specific filtering (`yes` or `no`). <br> `perfMerge`: Merges performance data (`yes` or `no`). <br><br> Some parameters are scenario-specific and might be ignored if not relevant. Defaults are used if omitted. Using `capture=yes` can generate large files quickly. `fileMode=circular` overwrites old data when max size is reached. | |
| 92 | +| `help` *or* `?` | Displays a list of commands and their descriptions in the current context. | |
| 93 | + |
| 94 | +## Examples |
| 95 | + |
| 96 | +To convert an ETL log file to XML, run the following command: |
| 97 | + |
| 98 | +```cmd |
| 99 | +netsh trace convert input="C:\Logs\mytrace.etl" output="C:\Logs\mytrace.xml" |
| 100 | +``` |
| 101 | + |
| 102 | +To analyze and correlate the data between multiple ETL files into a single correlated file, run the following command: |
| 103 | + |
| 104 | +```cmd |
| 105 | +netsh trace correlate input="C:\Logs\trace1.etl,C:\Logs\trace2.etl" output="C:\Logs\correlated_trace.etl" |
| 106 | +``` |
| 107 | + |
| 108 | +To export an ETL to a text file (`.txt`), run the following command: |
| 109 | + |
| 110 | +```cmd |
| 111 | +netsh trace export input="C:\Logs\mytrace.etl" output="C:\Logs\mytrace.txt" |
| 112 | +``` |
| 113 | + |
| 114 | +To merge multiple ETL files into a single trace file, run the following command: |
| 115 | + |
| 116 | +```cmd |
| 117 | +netsh trace merge input="C:\Logs\trace1.etl,C:\Logs\trace2.etl" output="C:\Logs\merged_trace.etl" |
| 118 | +``` |
| 119 | + |
| 120 | +To list all network interfaces available for tracing, run the following command: |
| 121 | + |
| 122 | +```cmd |
| 123 | +netsh trace show interfaces |
| 124 | +``` |
| 125 | + |
| 126 | +To start a new trace session and save the log to a specific file path, run the following command:** |
| 127 | + |
| 128 | +```cmd |
| 129 | +netsh trace start capture=yes tracefile="C:\Logs\networktrace.etl" |
| 130 | +``` |
| 131 | + |
| 132 | +## See also |
| 133 | + |
| 134 | +- [Command-Line Syntax Key](command-line-syntax-key.md) |
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments