So someone had this question. It’s a good one. I didn’t know the answer so I found out….
The Test: I built a Windows 8 VM in my lab. Updated it, updated default Windows Store Applications, created a new user account that I had never logged in as and then setup a netsh trace session from an elevated command prompt:
netsh trace LAN capture=yes report=yes tracefile=c:\trace\file.etl
And then I logged out and logged into the new ID. The plan was to run it for 20-30 minutes but I went downstairs to talk to the wife and you know how that goes so an hour or so later I remembered my test! Went upstairs and logged out, logged in as my administrator user and opened an elevated command prompt and did:
netsh trace stop
It looked like this:
Which isn’t horribly exciting, but the etl file and file.cab file are
So I put them on my debugging machine via SkyDrive and went to town.
Very little traffic, most of it in spurts, every 5 minutes as expected.
You can see it in the graphic above. I’ll actually need to do a longer trace to get a better feel for statistics, but I wouldn’t sweat a Windows 8 RT or Pro device on your network.