Revision history [back]

To capture traffic you only need WinPcap or npcap. Once captured, the files can be copied elsewhere for examination.

I would concentrate on getting WinPcap installed, and then familiarising yourself with the windump command line options to make a capture.

There is also a built-in mechanism to capture traffic, but the files it produces can only be read using Microsoft Message Analyzer or the older NetMon, see here.