Nmcap.exe

Command-line packet capture utility from Microsoft Network Monitor 3.x.

Reconnaissance

Capture network traffic on windows to collect sensitive data.

nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}

Start capture on all network adapters and save to specified .cap (circular) file. Optionally, one can add: - `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds); - `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time; - `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed. — MITRE: T1040 — Privileges: Administrator