Windows 10: PKTMON filter not applied

Hello, I'm trying to use PKTMON to troubleshoot DHCP problems. After tracking the packets from the source through the network devices, I'm trying to control their reception and response from the DHCP server. A Windows 2022 server.I wanted to use PKTMON on the same principle as the tcpdump used previously.However, I can't figure out how filtering works.I have the same problem on my Windows 11 workstation for a simple ICMP test.Here's an example:To view ICMP packets on my workstation, I proceed as follows: 1/ I list the interfaces and find the ID of the component carrying my IP address. 2/ I c

:)

 

pktmon inacurate help information

My Windows 10 is 20H2

pktmon version is 10.0.19041.906

There is no switch --etw described in the online help, but if You use it it works!

 

Use pktmon to solve problem with client connecting to Windows Home Server

Yes, I still use WHS even though it's old and likely not secure but it has come in very handy in the past. My old WHS became unstable so I installed it on a different server. I ran the WHS connector on laptop A (all laptops are Windows 10) and everything went fine. I then ran the connector software on laptop B and although it found the WHS server, after entering the password I got a message saying "The operation cannot be completed at this time". The same thing happened on laptop C.

I see nothing in the WHS event viewer but in the laptop B event viewer I see a warning for HomeServer that says

"Server ID is not set yet. On the client it means that the server discovery (discovery.exe) was not run or was not run successfully".

After some investigation and finding posts from WHS users on mediasmartserver.net, I saw that the executables and most of the registry entries were in place, so using the working laptop A for guidance, I entered the missing entries on laptop B and got it working (meaning I can backup laptop B to WHS, not that I stopped the error from happening).

I applied the same basic steps on laptop C, but in the event viewer I see this error:

Please, run Discovery.exe again. This machine certificate CD7635257C9BA41BBAA866AF6B48B0432 is missing. It normally means that the server discovery (discovery.exe) was not run or was not run successfully.

The certificate value listed is the letter "C" plus the GUID (minus the dashes) from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Home Server\Transport in the registry for the laptop.

I've followed steps here: Can't turn on Network Discovery - Windows Client. I tried turning SMB1 on (although neither of the other two laptops are that way) but it didn't work so I turned it off again. I disabled the Norton firewall to no avail. I can RDP to the WHS Server from the problem laptop. Compared to the other two machines, the registry entries look OK. I've had a few issues copying files to laptop C in the past like not being able to copy files in file explorer, but a .bat file copies with no problem.

Now (finally) the question: can I use pktmon to diagnose what's wrong? I created this filter and ran it while I ran the WHS connector, but I don't know what I'm looking at in the output or even if I've chosen the right filter:

pktmon filter add WHSSYN -i 192.168.1.11 -t TCP SYN

Any suggestions would be appreciated. Thanks.

 

Windows 10 infinite restart black screen


The tutorials provided are just a list of troubleshooting steps. Use only the steps which apply to you.

Since none of the troubleshooting steps here worked, I'd suggest you do a Clean install.

John