Event based network trace collection-using powershell

This  post is like new version of my old post

In this example I m using event id 1502 that gets generated when gpupdate completes successfully. This is an event you can generate on a domain joined machine by running gpupdate /force . so to test that's what I do. In sequential order, the powershell script and batch file are copied in my netmon installation folder in program files in my test lab. I first clean any pre-existing 1502 event from my system event log to test my script. Then I run  following power shell command. then I run my batch file, which basically starts network captures , which will stop the moment it sees ping frame of 4.3.2.1. Powershell script is looking for event from today's date onwards for source event type "Microsoft-Windows-GroupPolicy"  and event 1502. So if that event occurs, it will send ping as in $Cmdone = "Test-Connection 4.3.2.1"

which is a fake IP address and that's what my batch file is waiting for to stop the network traces. end result is that you have network trace just at the moment of event.

Power shell script that will look for event is below

______Copy from below and save it as stopnmcap.ps1 on a particular location on your system_____________________________________________

# Flag to control while loop

$Flag = 1

# to stop the Netmon

$Cmdone = "Test-Connection 4.3.2.1"

"Press Ctrl+C anytime to stop this script"

"Started Monitoring the event"

do

{

$checkevent = Get-EventLog -LogName System -EntryType Information -After 08/6/2016 -Source "Microsoft-Windows-GroupPolicy" | Where-Object {$_.EventID -eq 1502}

if($checkevent)

{

Write-Host "got the event, Stopping network trace ...."

$Flag = 0

Start-Sleep -s 5

Invoke-Expression $Cmdone

}

else

{

$Flag = 1

Write-Host "no events yet but keep looking"

}

Start-Sleep -s 10

}while($Flag)

"Press any key to stop"

 

--------------------------------------------------------------------------------------------------------------------------------------------------------------------

Batch file to start the nmcap to capture the network traces.

****************copy from below and save it as nmtrace.bat**************************************************************************

@echo off

REM Following line is wrapped
start cmd.exe /c nmcap /network * /capture /file %1 /stopwhen /frame "ipv4.DestinationAddress==4.3.2.1" /DisableConversations

***********************************************************************************************************************************