When using NETSH to capture a network trace, it generates a specialized file with an ETL file extension. You can read all about what NETSH can be used for here. NETSH is a great tool built into the Windows OS and can be used to configure many parts of the networking stack within your Windows OS. If your issue requires network traces to be captured, Microsoft Support will often ask you to capture the m running a built-in utility called NETSH. Maybe you or your staff also has the technical expertise to review the data and make some preliminary observations while waiting for Microsoft Support to complete the investigation. Maybe y ou want to review that data yourself. Sean Greenbaum here with a tale from the field.Īs many of you have probably experienced, when working with Microsoft Premier support, you’ll often be asked to capture some data and upload it to Microsoft for analysis.

Otherwise for more programmatic control of packet replay one could use scapy as suggested in this answer, though one would need to extract the HTTP content and resend it on new connection(s).Hello. However the latest version of tcpreplay suite from AppNeta now provides a tool tcpliveplay that says it can replay TCP streams so that seems like it could be the best option.

One approach would be to extract the HTTP content from the packet trace and resend that over a new TCP connection - Wireshark does allow for HTTP traces to be extracted which could be resent.

It's not straightforward to just resend a HTTP interactions that have been captured by Wireshark as the the HTTP is transported over TCP which needs to set up a new connection for each interaction so things like the TCP sequence numbers would need to be different. If the HTTP requests are being sent from a browser then you can take advantage of the Web Developer mode available in most modern browsers - by going to the 'Network' section and right clicking on a particular GET/POST requests and then one can optionally modify and resend selected requests and/or using curl (e.g.

Wireshark pcap