Pktmon

Filter to the addresses, ports or protocols involved, start Pktmon, and use component counters to follow traffic through the Windows networking stack. Stop the capture before converting its ETL log to text or PCAPNG for analysis. This can expose a drop inside a virtual switch or another supported host component, rather than only at the physical adapter. The logging settings matter: the documented default saves 128 bytes per packet, and circular mode replaces old entries when the size limit is reached. Multiple snapshots may represent the same packet at different components. Check the installed command help because available flags and capabilities vary with the Windows build.