Window 7 – WIFI Trace Capture using Microsoft Message Analyser


Overview: Windows 7 built-in  trace  templates allow to captures Wi-Fi logs for analyses using Microsoft Message Analyser.
Microsoft Message Analyzer is a  tool for capturing, displaying, and analyzing protocol messaging traffic, events, and other system or application messages in network troubleshooting and other diagnostic scenarios.
Kit: Windows 7 Laptop
Wireless Card: Intel(R) Dual Band Wireless-AC 7265
Microsoft Message Analyzer V1.4
Enable Trace Servicenetsh ras set tracing * enabled
Trace Built-in ProfilesNetsh Trace show scenarios
Start Trace Captuenetsh trace start capture=yes scenario=wlan report=yes tracefile=q:\output\wlantrace1.etl
Stop Trace Capturenetsh trace stop
Disable Trace Servicenetsh ras set tracing * disabled
Browse to Q:\output folder
Open trace file Q:\output\wlantrace1.etl using Microsoft Message Analyzer program.
Apply below filter to the trace:
EAPOL or
Microsoft_Windows_WLAN_AutoConfig or
Microsoft_Windows_NWiFi or
Microsoft_Windows_NDIS
Trace Capture – Sucessful connection to  WI-FI NetworkSSID: Vodafone-CFE3
Security: WPA2-PSK
Logs returns with 4_WAY_COMPLETION message.
Successful connection.
Trace Capture – Unsucessful connection to  WI-FI Network (incorrect PSK)SSID: UPC31
Security: WPA2-PSK
Logs returns with PSK_MISMATCH message.