Microsoft Windows [Version 6.1.7000] (C) Copyright 2009 Microsoft Corp. C:\Windows>netsh wfp capture start ?
Usage: capture start
[[ cab = ] (ON | OFF) ][[ traceonly = ] (ON | OFF) ][[ keywords = ] (NONE | BCAST | MCAST | BCAST+MCAST) ][[ file = ]]
Parameters:
Tag Value
cab - Can be ON or OFF. The default is ON.
ON compiles the files in a single .cab file.
OFF leaves the output files uncompressed.
This is useful if doing your own troubleshooting,
rather than collecting data for others.
traceonly - Can be ON or OFF. The default is OFF.
ON collects only event tracing data,
which reduces the output file size.
keywords - Can be NONE, BCAST, MCAST, or BCAST+MCAST.
The default is BCAST+MCAST.
Sets the net event keywords used for the session.
BCAST includes broadcast events and MCAST includes
multicast events. To reduce the file size for long-
running captures, set to NONE.
file - Output file name. The default is 'wfpdiag.cab'.
If the cab option is ON, the file name should not
include the extension since the .cab is
automatically added to the output file.
Remarks: Starts an interactive capture session.
To stop capture, run 'capture stop'.
