ndisdump

A no-dependencies network packet capture tool for Windows.

Introduction

Windows systems come with a pre-installed network filter, ndiscap.sys,
which is used by netsh trace command to perform network captures
into an .etl file. The file which must then be converted to .pcapng with
another tool.

This repository contains ndisdump, a tool that uses ndiscap.sys
to perform network capture directly into .pcapng file.

Usage: ndisdump [-s SNAPLEN] -w FILE
-w FILE      The name of the output .pcapng file.
-s SNAPLEN   Truncate packets to SNAPLEN to save disk space.

You can terminate the capture with Ctrl+C.

TODO

The ultimate aim is for this tool to have the same command-line interface
as tcpdump, including the filter language.