Window 7 – WIFI Trace Capture using Microsoft Message Analyser
Overview: Windows 7 built-in trace templates allow to captures Wi-Fi logs for analyses using Microsoft Message Analyser.
Microsoft Message Analyzer is a tool for capturing, displaying, and analyzing protocol messaging traffic, events, and other system or application messages in network troubleshooting and other diagnostic scenarios.
Kit: Windows 7 Laptop
Wireless Card: Intel(R) Dual Band Wireless-AC 7265
Microsoft Message Analyzer V1.4
Wireless Card: Intel(R) Dual Band Wireless-AC 7265
Microsoft Message Analyzer V1.4
Enable Trace Servicenetsh ras set tracing * enabled

Trace Built-in ProfilesNetsh Trace show scenarios

Start Trace Captuenetsh trace start capture=yes scenario=wlan report=yes tracefile=q:\output\wlantrace1.etl

Stop Trace Capturenetsh trace stop

Disable Trace Servicenetsh ras set tracing * disabled

Browse to Q:\output folder

Open trace file Q:\output\wlantrace1.etl using Microsoft Message Analyzer program.
Apply below filter to the trace:
EAPOL or
Microsoft_Windows_WLAN_AutoConfig or
Microsoft_Windows_NWiFi or
Microsoft_Windows_NDIS
Microsoft_Windows_WLAN_AutoConfig or
Microsoft_Windows_NWiFi or
Microsoft_Windows_NDIS

Trace Capture – Sucessful connection to WI-FI NetworkSSID: Vodafone-CFE3
Security: WPA2-PSK
Security: WPA2-PSK

Logs returns with 4_WAY_COMPLETION message.

Successful connection.

Trace Capture – Unsucessful connection to WI-FI Network (incorrect PSK)SSID: UPC31
Security: WPA2-PSK
Security: WPA2-PSK

Logs returns with PSK_MISMATCH message.
