Vedang Agarwal
Vedang Agarwal

Reputation: 1

To fetch bytes sent/received per sec for particular application

Need to find amount of incoming outgoing network bytes using cmd/powershell command for specific application.

So I researched and found that there isn't any direct way to filter this data using netsat/various other network commands or the powershell counters. You can find bytes sent/received per second for the system but not for any application. ALthough there were multiple pages which led me to log through ETW logs/trace session. I was using provider: Microsoft-Windows-Kernel-Network to filter data sent and data received Opcodes, but I noticed all of them were for the system's processId and not for any application/other services. Can anyone help me through this? Or suggest a different provider for it.

Below is the powershell code I tried

$log_path = "<Your_log_location"
$filterXML = '*[System[Opcode = 11 or Opcode = 27 or Opcode = 43 or Opcode = 59]]'
logman create trace "KernelNetworkTraceSession2" -p "Microsoft-Windows-Kernel-Network" -o $log_path -ets
logman stop "KernelNetworkTraceSession2" -ets
Get-WinEvent -Path $log_path -Oldest -FilterXPath $filterXML -MaxEvents 10  | Format-List -Property *

Upvotes: 0

Views: 84

Answers (0)

Related Questions