capture network traffic on windows ce

When developing network applications, it's always necessary to capture network traffic. Windows ce has built-in sniffer tool, netlog for this purpose. It captures network traffics to a file that can be examined with wireshark or network monitor.

To enable it, we need to select NDIS Packet Capturing DLL and NDIS User-mode I/O Protocol Driver in visual studio, as shown below.





Then, we can capture network traffic with following commands.

1. set capture file lacation:

netlogctl file "/Storage Card/net"2. start capture

netlogctl start3. perform network activities

4. stop capture

netlogctl stop5. copy /Storage Card/net.cap[i].cap to computer and open with wireshark

NetLogctl usage:

netlogctl start - start the loggging.

netlogctl load - start the loggging.

netlogctl stop - stops the loggging.

netlogctl unload - causes networking to unload the netlog component. (may destabilize system)

netlogctl pkt_size XX - sets maximum packet size captured.

netlogctl cap_size XX - sets maximum size of half capture file.

netlogctl file XXX - sets the name of the file to log.

netlogctl usb XXX - 1 => log usb , 0 => stop logging usb.

netlogctl state - print state.

netlogctl trace - print trace message state for all modules.

netlogctl trace <module> - print trace message state for specified module.

netlogctl trace <module> <filter> - set trace message state for specified module.