To learn more about PEF message providers and the Microsoft-Windows-NDIS-PacketCapture provider, see the More Information section below. The Microsoft-Windows-NDIS-PacketCapture provider also has an Advanced Settings dialog that provides special features and capabilities, for example, specifying advanced filtering configurations when capturing traffic from remote hosts and virtual machines (VMs) that are serviced by a Hyper-V-Switch. Note that the Microsoft-PEF-NDIS-PacketCapture provider has an Advanced Settings dialog that enables you to configure Fast Filter groups. Captures traffic at and above the Link Layer. Local Network Interfaces scenario - uses the Microsoft-PEF-NDIS-PacketCapture provider on computers running the Windows 7, Windows 8, or Windows Server 2012 operating systems, or uses the Microsoft-Windows-NDIS-PacketCapture provider on computers running Windows 8.1, Windows Server 2012 R2, Windows 10, or later.They use one or more message providers to return specific types of message data after you start a Live Trace Session: The following are a few examples of built-in Trace Scenarios that serve as input sources for Message Analyzer. These scenarios are available for selection when you are configuring a Live Trace Session. Moreover, certain message providers are combined and included in built-in Trace Scenarios to optimize each scenario for capturing specific data. As such, these message providers and various combinations thereof are the means of targeting live data of different types as input to Message Analyzer. To capture this traffic, Message Analyzer makes use of several Microsoft Protocol Engineering Framework (PEF) providers that are designed to capture messages at different stack entry points (layers), which includes the capture of events at the ETW layer, along with a host of other Windows ETW-instrumented message providers that capture events from various Windows components at the ETW layer, for example, DNS, DHCP, Active Directory, and many other providers that are available from the Add System Providers dialog. Message Analyzer enables you to capture live traffic from network protocols, ETW-instrumented Windows system components, certain devices, and application communications.

Windows message analyzer download