I used to use netsh to capture on Windows boxes but the workflow for getting the data into pcap format was awful. Lately I’ve been using RawCap[0]. It’s a singl

I used to use netsh to capture on Windows boxes but the workflow for getting the data into pcap format was awful. Lately I’ve been using RawCap[0]. It’s a single EXE that works on stock versions of Windows and produces pcap files. It has no capture-time filtering options, which is a bummer, but it’s quicker for me to get data to look at than the netsh / convert to pcap workflow. [0] https://www.netresec.com/?page=Blog&month=2020-01&post=RawCap-Redux https://www.netresec.com/?page=Blog&month=2020-01&post=RawCa...