HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/zh-TW/nettrace.dll.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEL�!�

�"�@ �8.rdata�@@.rsrc� �@@��
�
T88��
�$��8.rdata8x.rdata$zzzdbg @.rsrc$01@$��.rsrc$02 �-�+�?�6�.6���< ^�ґ~A���
�0�0�H������x(�~@�X��p���������������������0��H��`��x������������ 0@P`p�������� 8$���$>�0%,�\D��FT�lHZ��Mx�@O,�lV���sT"�D��X����2�@��@����n�`��`�4�����h���MUI�����ד�.�O���\~k��J6l�Z@������MUIzh-TWR�Q�Nb�0�c�O����d��rKa0
PA���Y��d�0

%1!s!
  ���Y��d�0

  O(u�e_: trace start [sessionname=<�]\O���k
T1z>]
	[[scenario=]<Hh�O 1, Hh�O 2>] 
	[[globalKeywords=]keywords] [[globalLevel=]level]
	[[capture=]yes|no] [[capturetype=]physical|vmswitch|both] 
	[[report=]yes|no|disabled] [[persistent=]yes|no] 
	[[traceFile=]path\filename] [[maxSize=]filemaxsize] 
	[[fileMode=]single|circular|append] [[overwrite=]yes|no] 
	[[correlation=]yes|no|disabled] [capturefilters] 
	[[provider=]providerIdOrName] [[keywords=]keywordMaskOrSet]  
	[[level=]level] [bufferSize=<�}]�@S'Y\>]
	[[[provider=]provider2IdOrName] [[providerFilter=]yes|no]]
	[[keywords=]keyword2MaskOrSet] [[perfMerge=]yes|no] 
	[[level=]level2] ... 

�-�<P:
	capture=no (c�[d��N��d��N�N�/f&T_U(u
		\S�d�S)
	capturetype=physical (c�[/f&T���
		�Pݑ
\�[Ԛ�}��Nb�aS0�Pݑ
\[��d�N�chV�
		bTBfݑ
\�[Ԛ�}��Nb�aS�T[��d�N�chV�_U(u\S�d�S)
	report=no (c�[܈EQ1XJT/f&T#�T
		��d��jNw�"uu)
	persistent=no (c�[��d��]\O���k/f&T(W
		͑�e��_j�_|~�~�&NN(W|v�Q netsh trace stop MRc�~��_U)
	maxSize=250 MB (c�[g'Y�v��d��j'Y\�0=�l	gg'Y<P)
	bufferSize=512 (c�[�N KB �p�UMO�v��d��}]�@S'Y\�g\ 4�g'Y 16384)
	fileMode=circular
	overwrite=yes (c�[/f&T�����[�s	g�v��d�
		8��Q�j)
	correlation=disabled (c�[�vܕ�v�N�N/f&Tg�v�Nܕo�
		&N�D}(WNw�)
	perfMerge=yes (c�[/f&T��\He��-N|~nj�eTuO0R
		��d�KN-N)
	traceFile=%%LOCALAPPDATA%%\Temp\NetTraces\[sessionname]NetTrace.etl
		(c�[8��Q�jHh�vMOn)
	providerFilter=no (c�[/f&T_U(u�c�O��{x�hV)
	sessionname='' (c�[��d��]\O���k�v
T1z��N�O
		�� Y6eƖTek��d�0

d�^��SYc�[�&TGR provider ܕu�W[�-�<P�p all�N level �p 2550

�O�Y:

netsh trace start scenario=InternetClient capture=yes

	���Y��d� InternetClient �r�l�S�OX[�v�c�O��
		&N�Pݑ
\�[Ԛ�}��Nb�aS_U(u\S�d�S0
	vu|v�Q "netsh trace stop" }T�Nb/f�|q}͑�e��_jBf�
		��d�\g\Pbk0
	
\8��Q�jHhO(u�-�MOn�
T1z0�Y�g
�
		�jHhX[(W�\g���[
��jHh0

netsh trace start provider=microsoft-windows-wlan-autoconfig
	keywords=state,ut:authentication

	���Y��d� microsoft-windows-wlan-autoconfig �c�O�
	vu|v�Q "netsh trace stop" }T�Nb/f�|q}͑�e��_jBf�
		��d�\g\Pbk0
	
\8��Q�jHhO(u�-�MOn�
T1z0�Y�g
�
		�jHhX[(W�\g���[
��jHh0
	�Sg��wQ	gܕu�W[ 'state' b 'ut:authentication' �v�N�N0

	netsh trace show provider }T�N�S(u�No�:y
		/e�c�vܕu�W[�d\}0

�d�S�{x�hV: 
	�S	g(WO(u capture=yes f�x0W_U(u�d�SBf�
	Mb/e�c�d�S�{x�hV0O(u 'netsh trace show CaptureFilterHelp'
	�So�:y/e�c�v�d�S�{x�hV�vQO(u�e_�vn�U0

�c�O��{x�hV: 
		gYP�c�O�/e�c�c�O��{x�hV�&N�S(W�kP�c�O��_O(u
	providerFilter=Yes �R�N_U(u0
	O(u 'netsh trace show ProviderFilterHelp' �So�:y
	�kP�c�O��v/e�c�c�O��{x�hV�vQO(u�e_�vn�U0\Pbk��d�0
w
%1!s!

  \Pbk��d�0

  O(u�e_: [sessionname=<sessionname>] 

  �-�<P:
	sessionname='' (c�[��\Pbk�v��d��]\O���k) 

  �P;�: \Pbk�vMR2�L�-N�v�}��d�
�]\O���k
\��d��jHhI��c�p HTML 1XJT0
�
%1!s!

  \��d��jHhI��c�p HTML 1XJT0

  O(u�e_: convert [input=]tracefilename.etl [[output=]filename]
             [[dump=]CSV|XML|EVTX|TXT|No] [[report=]yes|no]
             [[overwrite=]yes|no] [[tmfpath=]pathname]

  �Sxe:

    j�            <P
    input         - 8�eQ ETL ��d��jHh
    output        - 8��Q�jHh
T1z (�-�<P�p8�eQ
T1z)
    dump          - 8��Q<h_ (�-�<P = TXT)
    report        - "uu HTML 1XJT (�-�<P = no)
    overwrite     - ���[�s	g�v�jHh (�-�<P = no)
    tmfpath       - ㉼x WPP ��d��v tmf �jHh_

  �P;�: \8�eQ ETL �jHhI��c�pc�[�v<h_0 

���Y:��e�]\O���k0
'
%1!s!

  ���Y:��e�]\O���k0

  O(u�e_: diagnose [scenario=]<scenarioname> [[namedAttribute=]<attributeValue>]
          [[saveSessionTrace=]<yes|no>] [[report=]<yes|no>] [[capture=]<yes|no>]

  �-�<P:
      saveSessionTrace=no (�Y�g	gc�[ report=yes��-�<P/f 'yes')
      capture=no
      report=no

  �P;�: ���Y:��e�]\O���k 
\��d��jHhck8^Sb�{x��p�e�v8��Q�jHh0
�
%1!s!
  \��d��jHhck8^Sb�{x��p�e�v8��Q�jHh0

  O(u�e_: trace correlate [input=]tracefilename.etl
	[output=]newtracefilename.etl 
	[[filter=]Activity_ID] [[overwrite=]yes|no] 
	[[retaincorrelationevents=]yes|no] [[retainpii=]yes|no] [[retainglobalevents=]yes|no] 

  �Sxe: 

	j�                        <P 
	input                    - 8�eQ ETL ��d��jHh 
	output                   - 8��Q�jHh
T1z 
	filter                   - �P8��Q�dk;m�R GUID �vܕ�v�N�N 
	overwrite                - ���[�s	g�v�jHh 
	retaincorrelationevents  - �OYu�v�Nܕo��N�N 
	retainpii                - �OYuS+TP�NX�%Rnj
��v�N�N 
	retainglobalevents       - �OYuhQ�W�N�N 

  �-�<P: 
	filter=none 
	overwrite=no 
	retaincorrevents=no 

etainpii=yes 
	retainglobalevents=yes 
 
  �P;�: 
	�{x�;m�RX�%R�x/f�N {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} 
	<h_h�:y�v

	GUID P�NX�%Rnj
�S�b\S�d�S�N�N 
TuO��d��jHh&N�e�X&{_�-N|~nj�e0
�
%1!s!

  TuO��d��jHh&N�e�X&{_�-N|~nj�e0

  O(u�e_: merge input1.etl input2.etl ... output.etl

  �Sxe:

      ��TuOKN ETL �jHh�vn�U
      n�U-N�vg�_NP�jHh/f8��Q

  �P;�: TuO�jHh&N�ceQ&{_�� PerfTrack -N|~nj�e0


\Hh�O/S�Q� WPR -��[�j0
�
%1!s!

  \Hh�O/S�Q� WPR -��[�j0

  O(u�e_: trace export [scenario=]<Hh�O
T1z> [[file=]<�jHh
T1z>]

  �P;�: �g\ WPP ��d�Hh�O@bS+T�v@b	g�c�O�/S�Q�
           Windows Performance Recorder ��d�-��[�j��e_/fO(u�-�
           ܕu�W[�Td\}0
PAo�:y��d�-��[0

%1!s!

 o�:y��d�-��[0
	o�:y�S(u�vHh�O0
&
%1!s!

  o�:y�S� start }T�N-dM�O(u�vHh�O�S(uHh�On�U0
o�:yHh�Onj
�0
�
%1!s!

  o�:yHh�Onj
�0

  O(u�e_: trace show scenario  [name=]<Hh�O
T1z>

  �P;�: �go�:y	gܕHh�O�vvQ�Nnj
��S�b
           'diagnose' }T�N�S����Bl�v@b	gl\'`0
           Nn�U�S��g�pc�[Hh�O_U(u�v�c�O��
           �N�S�S��gWY(u�v�-�ܕu�W[�T
           d\}0

o�:y�S(u�v�c�O�0
%
%1!s!

  o�:y�S� start }T�N-dM�O(u�v�S(u�c�O�n�U0
	o�:y�c�O�nj
�0
�
%1!s!

  o�:y�S-dM� start }T�NO(u�v�c�O�nj
�0

  O(u�e_: trace show provider [name=]<�c�O�X�%R�xb
T1z>

  �P;�: �go�:yc�[�c�O�@b/e�c�v
           ܕu�W[�Td\}0���Y��d��]\O���kBf�SO(u
           ��Nܕu�W[�Td\}0
R�QhQ�Wܕu�W[�I{}0
T
%1!s!

  o�:y�S� start }T�N-dM�O(u�vhQ�Wܕu�W[�I{}n�U0

  O(u�e_: trace show globalKeywordsAndLevels
	R�Q�S(u�v�Nb�0
4
%1!s!

  o�:y�}��Nb��vn�U0

  O(u�e_: trace show interfaces
R�Q/e�c�v�d�S�{x�hV�O(u�e_0
B
%1!s!

  R�Q/e�c�v�d�S�{x�hV�O(u�e_0

  O(u�e_: trace show CaptureFilterHelp 
o�:yTS�Rz_^�%Rnj
�0
�
%1!s!

  o�:yTS�Rz_^�%R
T1z0�c��N�S�v�OTS�Rz_
^�%R�vn�U0
  �_N�SR�QTS�Rz_^�%R�S���P�V�v9h,g�S�V��O�_n�U0

      O(u�e_: trace show helperclass [name=]<helperclassname> 
R�Q/e�c�v�c�O��{x�hV�TO(u�e_0
D
%1!s!

  R�Q/e�c�v�c�O��v�{x�hV�TO(u�e_0

  O(u�e�l: trace show ProviderFilterHelp
PAK
��d�-��[:
-------------------------------------------------------------------

�jHhMOn = %1!s!
T
�S(u�vHh�O (%1!d!):
-------------------------------------------------------------------


2�eQޞ: %1!ws!

�c�O�
---------
T
�S(u�v�c�O� (%1!d!)
-------------------------------------------------------------------
$

T1z:          %1!s!
�c�O� Guid: %2!s!
W
I{} (<P) - %1!d! CQ }
-------------------------------------------------------------------
Y
ܕu�W[ (n�i) - %1!d! CQ }
-------------------------------------------------------------------

�]b�R\Pbk��d��]\O���k0
�rKa:             ck(W�WL�
��d��jHh:         %1!s!
D��R:             %2!s!
�_�t:           %3!s!
'Y\
NP�:           %4!s!
1XJT:             %5!s!
_
�c�O�:

T1z:               %1!s!
�c�O� Guid:      %2!s!
I{}:              %3!s!
ܕu�W[:           %4!s!
S
�c�O�:

T1z:               %1!s!
�c�O� Guid:      %2!s!
�-�I{}:      %3!s!
�-�ܕu�W[:   %4!s!

1XJTMOn = %1!s!
8
8�eQ�jHh:  %1!s! 
�PpS�jHh:   %2!s! 
�PpS<h_: %3!s! 
1XJT�jHh: %4!s! 
V
    �c�:     %1!ws! 
    �Nb� GUID:  %2!S! 
    �Nb�"}_: %3!d! 
    �Nb� Luid:  0x%4!I64X! 
 i
l\'`
T1z          ^��W        �_���v        �c� 
--------------          ----        --------        ----------- 

~b0R9h,g�S�V: %1!d! 
 '
9h,g�S�V #%1!d! 
-------------- 
%2!ws! 
 
�S(u�v�O�_: %1!d! 
 -
    �O�_ #%1!d! 
    ---------- 
    %2!ws! 
 
ck(W:��e '%1!ws!' ... �[b 
 
�c�: %1!ws!

NDF ��d��jHh: '%1!ws!' 
NDF 1XJT�jHh: '%1!ws!' 
ck(W"uunj�e6eƖ�1XJT... ck(W"uu�PpS ... �[b
1YWe (/���=0x%1!X!)
X	
  �d�S�{x�hV: 
	�S	g(W�N capture=yes f�x_U(u�d�SBf�Mb/e�c�d�S�{x�hV0/e�c�v�d�S
	�{x�hV�p: 

	CaptureInterface=<interface name or GUID> 
	 �pc�[�v�Nb�
T1zb GUID _U(u\S�d�S0O(u  
	 'netsh trace show interfaces' �OR�Q�S(u�v�Nb�0 
	�{�O CaptureInterface={716A7812-4AEE-4545-9D00-C10EFD223551} 
	�{�O CaptureInterface=!{716A7812-4AEE-4545-9D00-C10EFD223551}
	�{�O CaptureInterface="Local Area Connection" 

	Ethernet.Address=<MAC address> 
	 ݑ
\�O�n�T�v�v0W MAC MO@W&{Tc�[�v�{x�hV0 
	�{�O Ethernet.Address=00-0D-56-1F-73-64 

	Ethernet.SourceAddress=<MAC address> 
	 ݑ
\�O�n MAC MO@W&{Tc�[�v�{x�hV0 
	�{�O Ethernet.SourceAddress=00-0D-56-1F-73-64 

	Ethernet.DestinationAddress=<MAC address> 
	 ݑ
\�v�v0W MAC MO@W&{Tc�[�v�{x�hV0 
	�{�O Ethernet.DestinationAddress=00-0D-56-1F-73-64 

	Ethernet.Type=<ethertype> 
	 ݑ
\ MAC ethertype &{Tc�[�v�{x�0
	�{�O Ethernet.Type=IPv4 
	�{�O Ethernet.Type=NOT(0x86DD) 
	�{�O Ethernet.Type=(IPv4,IPv6) 

	Wifi.Type=<Management|Data> 
	 ݑ
\ Wifi ^��W&{Tc�[�v�{x�hV0AQ1��v<P/f 'Management' � 'Data'0
	 �Y�g*gc�[�
NgWY(u Wifi.Type �{x�hV0
	 �la: �P�d�S�{x�hV
N/e�c�{
W0n�Ub/f&T�[0 
	�{�O Wifi.Type=Management 

	Protocol=<protocol> 
	 ݑ
\ IP �
�TS�[&{Tc�[�v�{x�hV0 
	�{�O Protocol=6 
	�{�O Protocol=!(TCP,UDP) 
	�{�O Protocol=(4-10) 

	IPv4.Address=<IPv4 address> 
	 ݑ
\�O�n�T�v�v0W IPv4 MO@W&{Tc�[�v�{x�hV0 
	�{�O IPv4.Address=157.59.136.1 
	�{�O IPv4.Address=!(157.59.136.1) 
	�{�O IPv4.Address=(157.59.136.1,157.59.136.11) 

	IPv4.SourceAddress=<IPv4 address> 
	 ݑ
\�O�n IPv4 MO@W&{Tc�[�v�{x�hV0
	�{�O IPv4.SourceAddress=157.59.136.1 

	IPv4.DestinationAddress=<IPv4 address> 
	 ݑ
\�v�v0W IPv4 MO@W&{Tc�[�v�{x�hV0 
	�{�O IPv4.DestinationAddress=157.59.136.1 

	IPv6.Address=<IPv6 address> 
	 ݑ
\�O�n�T�v�v0W IPv6 MO@W&{Tc�[�v�{x�hV0 
	�{�O IPv6.Address=fe80::5038:3c4:35de:f4c3\%%8 
	�{�O IPv6.Address=!(fe80::5038:3c4:35de:f4c3\%%8) 

	IPv6.SourceAddress=<IPv6 address> 
	 ݑ
\�O�n IPv6 MO@W&{Tc�[�v�{x�hV0
	�{�O IPv6.SourceAddress=fe80::5038:3c4:35de:f4c3\%%8 

	IPv6.DestinationAddress=<IPv6 address> 
	 ݑ
\�v�v0W IPv6 MO@W&{Tc�[�v�{x�hV0
	�{�O IPv6.DestinationAddress=fe80::5038:3c4:35de:f4c3\%%8 

	CustomMac=<type(offset,value)> 
	 ݑ
\�N MAC j-���-��vc�[MO�yKN<P�&{Tc�[�v�{x�hV0
	 �la: �P�d�S�{x�hV
N/e�c�{
W0n�Ub/f&T�[0 
	�{�O CustomMac=UINT8(0x1,0x23)
	�{�O CustomMac=ASCIISTRING(3,test)
	�{�O CustomMac=UNICODESTRING(2,test)

	CustomIp=<type(offset,value)> 
	 ݑ
\�N IP j-���-��vc�[MO�yKN<P�&{Tc�[�v�{x�hV0
	 �la: �P�d�S�{x�hV
N/e�c�{
W0n�Ub/f&T�[0 
	�{�O CustomIp=UINT16(4,0x3201)
	�{�O CustomIp=UINT32(0x2,18932)

	CaptureMultiLayer=<yes|no> 
	 _U(uYd\\S�d�S0 
	 �la: �P�d�S�{x�hV
N/e�c�{
W0n�Ub/f&T�[0 

	PacketTruncateBytes=<value> 
	 �S�d�S�kP\S�vc�[MOCQD}xe0 
	 �la: �P�d�S�{x�hV
N/e�c�{
W0n�Ub/f&T�[0 
	�{�O PacketTruncateBytes=40 
Q
�la: 
	�S�NTBfO(uYP�{x�hV0
NN��
N��͑�O(u�vT�v�{x�hV0 
	�O�Y 'netsh trace start capture=yes Ethernet.Type=IPv4 
	      IPv4.Address=157.59.136.1' 
 
	�_��Bf�f�xs���{x�hV0�Y�g*gc�[�{x�hV�g\�[���p0
N͑��
00 
	 �O�Y 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1' 
	      �\�Sg�_ 157.59.136.1 �d�S IPv4 \S��N�[_NgO(u
	      ^� IPv4 YN*Y�}�^��W�O�d�S\S��V�p*gf�xc�[ Ethernet.Type 
	      �{x�hV0	       
	 �O�Y 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1 
	       Ethernet.Type=IPv4' 
	      �\�Sg�_ 157.59.136.1 �d�S IPv4 \S0\ghc�hwQ	gvQ
	      �NYN*Y�}�^��W�v\S��V�p�]c�[f�x�v�{x�hV0 
 
	�d�S�{x�hV/e�c�{
W0n�U�T&T�[ (d�^��S	g��f)0
	 �O�Y �{
W: 'netsh trace start capture=yes Ethernet.Type=IPv4 
	              Protocol=(4-10)' 
	      �\(W�N�e 4 � 10 (+T) KN���v�
�TS�[�d�S IPv4 \S0 
	 �O�Y n�U: 'netsh trace start capture=yes Ethernet.Type=(IPv4,IPv6)' 
	      �\�Sg�d�S IPv4 � IPv6 \S0 
	 �O�Y &T�[: 'netsh trace start capture=yes Ethernet.Type=!IPv4' 
	      �\g�d�S@b	g^� IPv4 \S0 
 
	(W�g�N�`�lN�&T�[�S��g�n�UP}T0 
	 �O�Y 'netsh trace start capture=yes Ethernet.Type=!(IPv4,IPv6)' 
	       �\g�d�S@b	g�v^� IPv4 �^� IPv6 \S0
 
	�S�NO(u 'NOT' �N�S�N '!' �Oh�:y&T�[0(W��&T�[�v<PhT
W�_��c�O�b_�0
	 �O�Y 'netsh trace start capture=yes Ethernet.Type=NOT(IPv4)' 


T1z: %1!ws! 
�c�: %2!ws! 
PAI
�OX[�vTS�Rz_^�%R: 
TS�Rz_^�%R
T1z         �c� 
-----------------         ----------- 
F
9h,g�S�V %1!d!/%2!d! 
---------------- 
�c�: %3!ws! 
         ID: %4!ws! 
Q
    �O�_ %1!d!/%2!d! 
    ------------ 
    �c�: %3!ws! 
             X�%R�x: %4!ws! 
�
8�eQ�jHh:               %1!s! 
8��Q�jHh:              %2!s! 
�{x�hV:                   %3!s! 
���[:                %4!s! 
RetainCorrelationEvents:  %5!s! 
RetainPII:                %6!s! 
RetainGlobalEvents:       %7!s! 
ck(W�^�z��d�KN���vܕo�... ��d��jHh�TvQ�N�u㖒c�nj
��]�}o�b "%1!s!"0
ck(W"uunj�e6eƖ... ck(WTuO��d��jHh... {
  �c�O��{x�hV:
	YP�c�O�/e�c�c�O��{x�hV�&N�S(W�kP�c�O��_O(u
	providerFilter=Yes �R�N_U(u0/e�c�v�c�O��p:

  �c�O�: Microsoft-Windows-Ras-NdisWanPacketCapture
	RoutingDomain=<GUID>
	 �pc�[�v�1u�}�W_U(u\S�d�S0
	 O(u 'Get-NetCompartment' R�Q�S(u�v�1u�}�W0
	 �la: ��N�c�O��{x�hV/e�cn�U�T&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-Ras-NdisWanPacketCapture
	     providerFilter=Yes
	     RoutingDomain="{11111111-1111-1111-1111-111111111001}"
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-Ras-NdisWanPacketCapture
	     providerFilter=Yes RoutingDomain="(<GUID1>,<GUID2>)"
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-Ras-NdisWanPacketCapture
	     providerFilter=Yes RoutingDomain=!"(<GUID1>,<GUID2>)"
 
	VPN.UserName=<UserName/InterfaceName>
	 �pc�[�vO(u�b�Nb�
T1z_U(u\S�d�S0
	 �la: ��N�c�O��{x�hV
N/e�c�{
W0n�Ub&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-Ras-NdisWanPacketCapture
	     providerFilter=Yes VPN.UserName="UserXXX" 


  �c�O�: Microsoft-Windows-TCPIP
	TCP.AnyPort=<PORT>, TCP.SourcePort=<PORT>, TCP.DestinationPort=<PORT>
	 AQ1�(W��GRc�[�v#��c�W
N6eƖ��d�0�NN�S�NP}TO(u
N��{x�hV0
	TCP.AnyPort �SAQ1�(W�O�nb�v�v0W#��c�W&{TBf6eƖ��d�0
	
	
	 �la: ��N�c�O��{x�hV/e�cn�U0�{
W�T&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes
	     TCP.SourcePort=80 TCP.DestinationPort=1234
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes TCP.AnyPort=(80,443)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes  TCP.SourcePort=!(900-1000)
 
	ProcessId=<U�tz�^X�%R�x>
	 _U(u@b�U�tz�^X�%R�x�v ETW ��d�0
	 �la: ��N�c�O��{x�hV/e�c�{
W0n�U�T&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes ProcessId=987
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes ProcessId=(1,5,8,9)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes ProcessId=!(100-200)
 
	IPv4.Address=<IPv4 MO@W>
	IPv4.SourceAddress=<IPv4 MO@W>
	IPv4.DestinationAddress=<IPv4 MO@W>
	 _U(u@b� IPv4 MO@W�v ETW ��d�0
	 IPv4.Address �SAQ1�(W�O�nb�v�v0WMO@W&{T�{x�Bf�2�L���d�
	 0�STBfO(u�O�n�T�v�v0W�{x�
	 simultaneously.
	 �la: ��N�c�O��{x�hV/e�cn�U0�{
W�T&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)
 
	IPv6.Address=<IPv6 MO@W>
	IPv6.SourceAddress=<IPv6 MO@W>
	IPv6.DestinationAddress=<IPv6 MO@W>
	 _U(u@b� IPv6 MO@W�v ETW ��d�0
	 Ipv6.Address �SAQ1�(W�O�nb�v�v0WMO@W&{T�{x�Bf2�L���d�0
	�STBfO(u�O�n�T�v�v0W�{x�0
	
	 �la: ��N�c�O��{x�hV/e�cn�U0�{
W�T&T�[0
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv6.Address=(2001::1-2001::ffff)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv6.SourceAddress=(2001::1-2001::ffff)
	�O�Y: netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes IPv6.DestinationAddress=!(2001::ffff)
 
	RoutingDomain=<GUID>
	 �pc�[�v�1u�}�W_U(u\S�d�S0
	 O(u 'Get-NetCompartment' �OR�Q�S(u�v�1u�}�W0
	 �la: dk�c�O��{x�hV/e�cn�U�&T�[0
	�O�Y netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes
	     RoutingDomain="{B1062982-2B18-4B4F-B3D5-A78DDB9CDD49}"
	�O�Y netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes RoutingDomain="(<GUID1>,<GUID2>)"
	�O�Y netsh trace start
	     provider=Microsoft-Windows-TCPIP
	     providerFilter=Yes RoutingDomain=!"(<GUID1>,<GUID2>)"
_
�la:
	d��N�SY;�f�v�R��c�O��{x��vO(u�e_GW��d�S�{x�
	^�<O0�`�S�NO(u 'netsh trace show CaptureFilterHelp'
	 �Oo�:y�d�S�{x��vO(u�e_

	NR�c�O�/e�c�c�O��{x�0�`�S�NO(uNR}T�N
	�O�j���c�O�yr�[��f:

	Microsoft-Windows-TCPIP
	 'netsh trace show providerFilterHelp Microsoft-Windows-TCPIP'

	Microsoft-Windows-Ras-NdisWanPacketCapture
	 'netsh trace show providerFilterHelp
	      Microsoft-Windows-Ras-NdisWanPacketCapture'

�}��_gq�[b0 
 
ck(W_U�R�}��_gq... 
 Hh�O�]/S�Q�jHh: %1!ws! 

vQ�N�Nb�aS %1:

YN*Y�}�aS %1:
Token Ring �Nb�aS %1:

FDDI �Nb�aS %1:

�V��Nb�aS %1:
PPP �Nb�aS %1:

SLIP �Nb�aS %1:

�S��Nb�aS %1:
!q�}@S�W�}��Nb�aS %1:

Nf�v�Nb�aS %1:}T�Nx�� "%1!s!" 
Nck�x�v<P "%2!s!"0}T�Nx�� "%1!s!" 
Nck�x�v<P "%2!s!"0
NPbYP}T�N�v�Sxe
Nck�xbz�1Y0
PA�jHh "%1!s!" �]�}X[(W0

��d��]\O���k�](W2�L�-N0
!q�l_U�R��d��]\O���k (/���=%1!d!)0
�_�t!j_���^����v MaxSize �Sxe0
�vMR�l	g2�L�-N�v��d��]\O���k0
!q�l\Pbk��d��]\O���k (/���=0x%1!x!)0
'%1!s!' 
N/f	gHeb�]�w�v�c�O�0
D��R!j_
NAQ1� Overwrite=yes0
!q�l_U�R6e�N#S�d�SE��Rz_ (/���=0x%1!x!)0
)'%1!s!' �a(uz_�]���[�}�-��[nj�e�^0
ˊܕ��r��a(uz_�6q�_�Qf�N!k0
'%1!s!' 
N/f	gHe�vHh�O0
&!q�l\Hh�O '%1!s!' �e�X�d��]\O���k (/���=0x%2!x!)0
"!q�l\\S�d�S�c�O��e�X�d��]\O���k (/���=0x%1!x!)0
.!q�l\�_���v�v�Nܕo��c�O� (%1!s!) �e�X�d��]\O���k (/���=0x%2!x!)0
c�[�vܕu�W[
\�e�c�O� '%1!s!' ��
N/f	gHe�v0
PAc�[�vI{}
\�e�c�O� '%1!s!' ��
N/f	gHe�v0
c�[�v�jHh '%1!s!' 
NX[(W0
I��c1YWe (/���=0x%1!x!)0
'%1!s!' 
N/f	gHe�vK��{P[0
'%1!s!' 
N/f	gHe�v�{
W0
%1!s! 
N/f	gHe�v�Nb�0
'%1!s!' 
N/f	gHe�v^��W0
�d�S�{x�hV�S	g(W_U(u�d�SBfMbAQ1�0
 ˊ�S�� 'trace %1!s! help' �N�S�_s�0}��f0
'%1!s!' /f�_���v�Sxe0
�}�:��e1YWe (/���=0x%1!x!)0
'%1!s!' �v{v���v!qHe (/���=0x%2!x!)0
*vuc�[ SaveSessionTrace=no Bf�
NAQ1� Report=yes0
!'%1!ws!' 
N/f	gHe�vTS�Rz_^�%R�b/f�S��
*gck�x�[݈0
<!q�lO(u - ˊ�j�gTS�Rz_^�%R{v�> 
�v�Nܕo�1YWe (/���=0x%1!x!)0

~b
N0R;m�R "%1!s!"0
'}T�Nx�� "%1!s!" �v<P "%2!s!" !qHe - �_�/f GUID0
c�[�v_ '%1!s!' 
NX[(W0
�S	g(W_U(u�d�SBf�Mb��O(u CaptureType �Sxe0
dk CaptureType 
Ni�(u�edk�|q}�v�g�i0
�[݈ Hyper-V ҉r�KN�_�Mb��_U(u[��d�N�chV�d�S0
��d��jHhTuO1YWe (/���=0x%1!x!)0
%1!s! 
N/f	gHe�v�1u�}�W0
PA f�JT: !q�l\Pbk6e�N#S�d�SE��Rz_ (/���=0x%1!x!)0
f�JT: !q�l2QX[�]\O���knj
� (/���=0x%1!x!)0
f�JT: "uu1XJT1YWe (/���=0x%1!x!)0
3f�JT: 'NT Kernel Logger' �v�O��]�}(W�WL�0
	 
Ng\�|q}nj
��e�X�d��jHh0
!f�JT: 
Ng\�|q}nj
��e�X�d��jHh0(/���=0x%1!x!)0
!f�JT: !q�l�d�STS�Rz_^�%Rl\'` (/���=0x%1!08X!)0
f�JT: NDF ��d��jHh!q�lO(u0
&f�JT: �V�p	g'Yϑ�v�N�N�@b�N*g�d�S�g�N�N�N0
ˊ�naO(u�{x�hV�On\xeϑ
f�JT: �[hQ!j_-N
N/e�c1XJT"uu0
f�JT: �[hQ!j_-N
N/e�c\S�d�S0
PAܕ����_U/f&T�}�:��eG�Pnj�e6eƖhVƖT�]wQg(W,g_j�|q}
N6eƖ�}�vܕ�vnj�e0��6eƖ�vnj�eS�b�}�CQ�N��d�0{v�_j�x��N�S�STS�R�u㖒c㉲}�vܕOUL��v�|q}lxԚnj
�0Microsoft Windows �}��d�	Microsoft�}�nj
�6eƖhV�]\P(u00L	0	0lPP|��������a��c������Y

\Pbk

�P�

͑'Y

/���

f�JT

nj
�

s�0}nj
�

\Microsoft-Windows-Networking-Correlation

pMicrosoft-Windows-Networking-Correlation/Diagnostic

`Dummy event for standard level enumeration

HSource Provider: %1 Context: %2

HSource Provider: %1 Context: %2

HSource Provider: %1 Context: %2

�4VS_VERSION_INFO��
aJ
aJ?�StringFileInfo�040404B0LCompanyNameMicrosoft Corporation:	FileDescription�}��d�TS�Rz_h$FileVersion10.0.19041.1 (WinBuild.160101.0800):
InternalNamenettrace.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.JOriginalFilenamenettrace.dll.muij%ProductNameMicrosoft� Windows� Operating System>
ProductVersion10.0.19041.1DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGX