Command-line packet capture utility from Microsoft Network Monitor 3.x. Located at: C:\Program Files\Microsoft Network Monitor 3\nmcap.exe; C:\Program Files (x86)\Microsoft Network Monitor 3\nmcap.exe.
nmcapnmcapSandbox: execFile · Timeout: 30s
recon.enumeration Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Start capture on all network adapters and save to specified .cap (circular) file. Optionally, one can add: - `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds); - `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time; - `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed. (Capture network traffic on windows to collect sensitive data.)
nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}nmcap is a Windows LOLBin. Command-line packet capture utility from Microsoft Network Monitor 3.x. Located at: C:\Program Files\Microsoft Network Monitor 3\nmcap.exe; C:\Program Files (x86)\Microsoft Network Monitor 3\nmcap.exe.