This script is used exclusively for troubleshooting network problems. The script records the network traffic on the queried VM for 90 seconds and then displays it in Wireshark. This requires Wireshark on the PAW and the tool etl2pcapng on the PAW, so that the recorded file (.etl) can be converted into a .pcap file.

The script asks for the hostname/FQDN of the VM, records the network traffic, copies the file to the PAW, deletes the recorded file from the VM and terminates the PSSession. Then the file is converted to a compatible format by Wireshark and opened in this program.

Copy the files in this folder to a directory that is accessible to all users of your PAW (C:\tmp for example).

Open a Powershell with the special rights for the respective VM, change to the above directory and execute Win_TCPdump.ps1.