windows-host-packet-capture.ps1

#Accepts hostname or IP
#Runs Powershell netsh with and the ethernet types / IP addresses
#Stops the trace after X time
#Waits for the command to save the file and exit
#Copies file back to analyst machine
#removes all trace of the packet capture file



$IpAddress = (Get-NetIPAddress | Where-Object {($_.PrefixOrigin -eq "Dhcp") -and ($_.InterfaceAlias -eq "Local Area Connection")}).IpAddress
$destinationHost = ''

if ($IpAddress -eq $null) {
    $IpAddress = (Get-NetIPAddress | Where-Object {($_.PrefixOrigin -eq "Dhcp") -and ($_.InterfaceAlias -eq "Wireless Network Connection")}).IpAddress
}

if ($IpAddress -eq $null) {
    Write-Host "Failed to get local IP address"
} else {
    
    netsh trace start capture=yes Ethernet.Type=IPv4  IPv4.SourceAddress=<sourceIP> IPv4.Address=!$($IpAddress) tracefile=\\$($destinationHost)\c$\<path>\test.etl maxSize=0    

    Start-Sleep -s 10

    netsh trace stop

    $s = New-PefTraceSession -path "C:\Users\<username>\AppData\Local\Temp\NetTraces\outfile.cap" -SaveOnStop
    $s | Add-PefMessageProvider -Provider "C:\Users\<username>\AppData\Local\Temp\NetTraces\NetTrace.etl"
    $s | Start-PefTraceSession
}