Windows packet capturing for example for an LDAPS traffic analysis

Sun, 18 Jan 2026 18:55:54 +0000

Open a Windows Terminal or Command session As Administrator

Check existing filters
# pktmon filter list

Clear all filters
# pktmon filter remove

Check capture status
# pktmon status

Add a filter for LDAPS
# pktmon filter add -p 636

Start the capture
# pktmon start --etw

Try to connect again to the LDAP server / If you want to monitor a different port, repeat the command that generates the network traffic.

Capturing on Notities

Windows packet capturing for example for an LDAPS traffic analysis