Network Performance Monitoring on Windows#

Network performance monitoring is critical for maintaining healthy IT infrastructure. This guide provides comprehensive solutions for monitoring network performance on Windows systems, from basic PowerShell scripts to enterprise-grade monitoring integrations.

Windows Network Monitoring Architecture#

Understanding Windows network monitoring capabilities helps in building effective monitoring solutions:

1
graph TB
2
    subgraph "Windows Network Stack"
3
        subgraph "Data Sources"
4
            WMI[WMI Classes]
5
            PerfCounters[Performance Counters]
6
            ETW[Event Tracing]
7
            NetEvents[Network Events]
8
        end
9

10
        subgraph "Collection Methods"
11
            PowerShell[PowerShell]
12
            PerfMon[Performance Monitor]
13
            NetMon[Network Monitor]
14
            WPA[Windows Performance Analyzer]
15
        end
16

17
        subgraph "Metrics"
18
            Bandwidth[Bandwidth Usage]
19
            Latency[Network Latency]
20
            PacketLoss[Packet Loss]
21
            Errors[Interface Errors]
22
            Connections[TCP Connections]
23
            DNS[DNS Performance]
24
        end
25
    end
26

27
    subgraph "Monitoring Solutions"
28
        PRTG[PRTG Network Monitor]
29
        Zabbix[Zabbix Agent]
30
        Prometheus[Windows Exporter]
31
        SCOM[System Center]
32
    end
33

34
    WMI --> PowerShell
35
    PerfCounters --> PerfMon
36
    ETW --> WPA
37
    NetEvents --> NetMon
38

39
    PowerShell --> Bandwidth
40
    PowerShell --> Latency
41
    PerfMon --> PacketLoss
42
    NetMon --> Connections
43

44
    Bandwidth --> PRTG
45
    Latency --> Zabbix
46
    Errors --> Prometheus
47
    DNS --> SCOM
48

49
    style WMI fill:#f96,stroke:#333,stroke-width:2px
50
    style PowerShell fill:#9f9,stroke:#333,stroke-width:2px

PowerShell Network Monitoring Framework#

Comprehensive Network Monitor Script#

1
# Enterprise-grade network performance monitoring for Windows
2

3
param(
4
    [string]$OutputPath = "C:\Monitoring\NetworkMetrics",
5
    [int]$IntervalSeconds = 60,
6
    [string]$LogServer = "syslog.company.com",
7
    [int]$LogPort = 514,
8
    [switch]$EnableAlerts,
9
    [string]$SmtpServer = "smtp.company.com",
10
    [string[]]$AlertRecipients = @("netops@company.com")
11
)
12

13
# Initialize monitoring framework
14
$ErrorActionPreference = "Stop"
15
$VerbosePreference = "Continue"
16

17
# Create output directory if it doesn't exist
18
if (!(Test-Path $OutputPath)) {
19
    New-Item -Path $OutputPath -ItemType Directory -Force | Out-Null
20
}
21

22
# Logging function
23
function Write-NetworkLog {
24
    param(
25
        [string]$Message,
26
        [string]$Level = "INFO"
27
    )
28

29
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
30
    $logEntry = "$timestamp [$Level] $Message"
31

32
    # Write to file
33
    $logFile = Join-Path $OutputPath "networkmonitor_$(Get-Date -Format 'yyyyMMdd').log"
34
    Add-Content -Path $logFile -Value $logEntry
35

36
    # Send to syslog if configured
37
    if ($LogServer) {
38
        Send-SyslogMessage -Server $LogServer -Port $LogPort -Message $logEntry -Facility Local0 -Severity $Level
39
    }
40

41
    # Console output
42
    switch ($Level) {
43
        "ERROR" { Write-Host $logEntry -ForegroundColor Red }
44
        "WARN"  { Write-Host $logEntry -ForegroundColor Yellow }
45
        "INFO"  { Write-Host $logEntry -ForegroundColor Green }
46
        default { Write-Host $logEntry }
47
    }
48
}
49

50
# Network adapter information collection
51
function Get-NetworkAdapterMetrics {
52
    $adapters = Get-NetAdapter | Where-Object { $_.Status -eq "Up" }
53
    $metrics = @()
54

55
    foreach ($adapter in $adapters) {
56
        Write-Verbose "Collecting metrics for adapter: $($adapter.Name)"
57

58
        # Get adapter statistics
59
        $stats = Get-NetAdapterStatistics -Name $adapter.Name
60

61
        # Get IP configuration
62
        $ipConfig = Get-NetIPConfiguration -InterfaceAlias $adapter.Name
63

64
        # Get performance counters
65
        $perfCounters = @(
66
            "\Network Interface($($adapter.Description))\Bytes Total/sec",
67
            "\Network Interface($($adapter.Description))\Bytes Sent/sec",
68
            "\Network Interface($($adapter.Description))\Bytes Received/sec",
69
            "\Network Interface($($adapter.Description))\Packets/sec",
70
            "\Network Interface($($adapter.Description))\Packets Sent/sec",
71
            "\Network Interface($($adapter.Description))\Packets Received/sec",
72
            "\Network Interface($($adapter.Description))\Packets Outbound Errors",
73
            "\Network Interface($($adapter.Description))\Packets Received Errors",
74
            "\Network Interface($($adapter.Description))\Current Bandwidth"
75
        )
76

77
        $perfData = @{}
78
        foreach ($counter in $perfCounters) {
79
            try {
80
                $value = (Get-Counter -Counter $counter -ErrorAction SilentlyContinue).CounterSamples[0].CookedValue
81
                $perfData[$counter.Split('\')[-1]] = $value
82
            } catch {
83
                Write-NetworkLog "Failed to get counter: $counter" -Level "WARN"
84
            }
85
        }
86

87
        $metric = [PSCustomObject]@{
88
            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
89
            AdapterName = $adapter.Name
90
            AdapterDescription = $adapter.Description
91
            MacAddress = $adapter.MacAddress
92
            LinkSpeed = $adapter.LinkSpeed
93
            Status = $adapter.Status
94
            IPAddress = $ipConfig.IPv4Address.IPAddress
95
            Gateway = $ipConfig.IPv4DefaultGateway.NextHop
96
            DNSServer = ($ipConfig.DNSServer.ServerAddresses -join ',')
97
            BytesSent = $stats.SentBytes
98
            BytesReceived = $stats.ReceivedBytes
99
            PacketsSent = $stats.SentUnicastPackets
100
            PacketsReceived = $stats.ReceivedUnicastPackets
101
            Errors = $stats.ReceivedPacketErrors + $stats.OutboundPacketErrors
102
            Discards = $stats.ReceivedDiscardedPackets + $stats.OutboundDiscardedPackets
103
            BytesPerSecond = $perfData['Bytes Total/sec']
104
            CurrentBandwidth = $perfData['Current Bandwidth']
105
            Utilization = if ($perfData['Current Bandwidth'] -gt 0) {
106
                ($perfData['Bytes Total/sec'] * 8 / $perfData['Current Bandwidth']) * 100
107
            } else { 0 }
108
        }
109

110
        $metrics += $metric
111
    }
112

113
    return $metrics
114
}
115

116
# TCP connection monitoring
117
function Get-TCPConnectionMetrics {
118
    $connections = Get-NetTCPConnection
119

120
    $connectionStats = @{
121
        Total = $connections.Count
122
        Established = ($connections | Where-Object { $_.State -eq "Established" }).Count
123
        Listen = ($connections | Where-Object { $_.State -eq "Listen" }).Count
124
        TimeWait = ($connections | Where-Object { $_.State -eq "TimeWait" }).Count
125
        CloseWait = ($connections | Where-Object { $_.State -eq "CloseWait" }).Count
126
        SynSent = ($connections | Where-Object { $_.State -eq "SynSent" }).Count
127
        SynReceived = ($connections | Where-Object { $_.State -eq "SynReceived" }).Count
128
    }
129

130
    # Get connection details by service
131
    $serviceConnections = @{}
132
    foreach ($conn in $connections | Where-Object { $_.State -eq "Established" }) {
133
        try {
134
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
135
            if ($process) {
136
                if (!$serviceConnections.ContainsKey($process.ProcessName)) {
137
                    $serviceConnections[$process.ProcessName] = 0
138
                }
139
                $serviceConnections[$process.ProcessName]++
140
            }
141
        } catch {
142
            # Process might have terminated
143
        }
144
    }
145

146
    return [PSCustomObject]@{
147
        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
148
        ConnectionStates = $connectionStats
149
        ServiceConnections = $serviceConnections
150
        TopServices = ($serviceConnections.GetEnumerator() | Sort-Object Value -Descending | Select-Object -First 10)
151
    }
152
}
153

154
# Network latency testing
155
function Test-NetworkLatency {
156
    param(
157
        [string[]]$Targets = @("8.8.8.8", "1.1.1.1", "gateway")
158
    )
159

160
    $results = @()
161

162
    foreach ($target in $Targets) {
163
        if ($target -eq "gateway") {
164
            $gateway = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Select-Object -First 1).NextHop
165
            if ($gateway) {
166
                $target = $gateway
167
            } else {
168
                continue
169
            }
170
        }
171

172
        Write-Verbose "Testing latency to $target"
173

174
        try {
175
            $pingResults = Test-Connection -ComputerName $target -Count 10 -ErrorAction Stop
176

177
            $latencies = $pingResults | ForEach-Object { $_.ResponseTime }
178
            $avgLatency = ($latencies | Measure-Object -Average).Average
179
            $minLatency = ($latencies | Measure-Object -Minimum).Minimum
180
            $maxLatency = ($latencies | Measure-Object -Maximum).Maximum
181

182
            # Calculate jitter (standard deviation)
183
            $mean = $avgLatency
184
            $variance = ($latencies | ForEach-Object { [Math]::Pow($_ - $mean, 2) } | Measure-Object -Average).Average
185
            $jitter = [Math]::Sqrt($variance)
186

187
            # Calculate packet loss
188
            $packetLoss = (10 - $pingResults.Count) / 10 * 100
189

190
            $result = [PSCustomObject]@{
191
                Target = $target
192
                AverageLatency = [Math]::Round($avgLatency, 2)
193
                MinimumLatency = $minLatency
194
                MaximumLatency = $maxLatency
195
                Jitter = [Math]::Round($jitter, 2)
196
                PacketLoss = $packetLoss
197
                Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
198
            }
199

200
            $results += $result
201

202
        } catch {
203
            Write-NetworkLog "Failed to ping $target : $_" -Level "WARN"
204
            $results += [PSCustomObject]@{
205
                Target = $target
206
                AverageLatency = -1
207
                MinimumLatency = -1
208
                MaximumLatency = -1
209
                Jitter = -1
210
                PacketLoss = 100
211
                Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
212
            }
213
        }
214
    }
215

216
    return $results
217
}
218

219
# DNS performance testing
220
function Test-DNSPerformance {
221
    param(
222
        [string[]]$TestDomains = @("google.com", "microsoft.com", "cloudflare.com")
223
    )
224

225
    $dnsServers = (Get-DnsClientServerAddress -AddressFamily IPv4 |
226
                   Where-Object { $_.ServerAddresses } |
227
                   Select-Object -ExpandProperty ServerAddresses -Unique)
228

229
    $results = @()
230

231
    foreach ($server in $dnsServers) {
232
        foreach ($domain in $TestDomains) {
233
            Write-Verbose "Testing DNS resolution for $domain using $server"
234

235
            $measurements = @()
236

237
            for ($i = 0; $i -lt 5; $i++) {
238
                $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
239

240
                try {
241
                    Resolve-DnsName -Name $domain -Server $server -ErrorAction Stop | Out-Null
242
                    $stopwatch.Stop()
243
                    $measurements += $stopwatch.ElapsedMilliseconds
244
                } catch {
245
                    Write-NetworkLog "DNS resolution failed for $domain on $server" -Level "WARN"
246
                    $measurements += -1
247
                }
248
            }
249

250
            $validMeasurements = $measurements | Where-Object { $_ -gt 0 }
251

252
            if ($validMeasurements) {
253
                $avgTime = ($validMeasurements | Measure-Object -Average).Average
254
                $successRate = ($validMeasurements.Count / 5) * 100
255
            } else {
256
                $avgTime = -1
257
                $successRate = 0
258
            }
259

260
            $results += [PSCustomObject]@{
261
                DNSServer = $server
262
                Domain = $domain
263
                AverageResponseTime = [Math]::Round($avgTime, 2)
264
                SuccessRate = $successRate
265
                Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
266
            }
267
        }
268
    }
269

270
    return $results
271
}
272

273
# Alert function
274
function Send-NetworkAlert {
275
    param(
276
        [string]$Subject,
277
        [string]$Body,
278
        [string]$Priority = "Normal"
279
    )
280

281
    if ($EnableAlerts -and $SmtpServer -and $AlertRecipients) {
282
        try {
283
            $mailParams = @{
284
                To = $AlertRecipients
285
                From = "networkmonitor@company.com"
286
                Subject = "Network Alert: $Subject"
287
                Body = $Body
288
                SmtpServer = $SmtpServer
289
                Priority = $Priority
290
            }
291

292
            Send-MailMessage @mailParams
293
            Write-NetworkLog "Alert sent: $Subject" -Level "INFO"
294
        } catch {
295
            Write-NetworkLog "Failed to send alert: $_" -Level "ERROR"
296
        }
297
    }
298
}
299

300
# Threshold checking
301
function Check-NetworkThresholds {
302
    param(
303
        [object]$Metrics
304
    )
305

306
    # Check bandwidth utilization
307
    foreach ($adapter in $Metrics.AdapterMetrics) {
308
        if ($adapter.Utilization -gt 80) {
309
            Send-NetworkAlert -Subject "High Network Utilization" `
310
                -Body "Network adapter $($adapter.AdapterName) is at $([Math]::Round($adapter.Utilization, 2))% utilization" `
311
                -Priority "High"
312
        }
313

314
        if ($adapter.Errors -gt 100) {
315
            Send-NetworkAlert -Subject "High Network Errors" `
316
                -Body "Network adapter $($adapter.AdapterName) has $($adapter.Errors) errors" `
317
                -Priority "High"
318
        }
319
    }
320

321
    # Check latency
322
    foreach ($latency in $Metrics.LatencyMetrics) {
323
        if ($latency.AverageLatency -gt 100 -and $latency.AverageLatency -ne -1) {
324
            Send-NetworkAlert -Subject "High Network Latency" `
325
                -Body "Latency to $($latency.Target) is $($latency.AverageLatency)ms" `
326
                -Priority "Normal"
327
        }
328

329
        if ($latency.PacketLoss -gt 5) {
330
            Send-NetworkAlert -Subject "Packet Loss Detected" `
331
                -Body "Packet loss to $($latency.Target) is $($latency.PacketLoss)%" `
332
                -Priority "High"
333
        }
334
    }
335

336
    # Check DNS performance
337
    foreach ($dns in $Metrics.DNSMetrics) {
338
        if ($dns.SuccessRate -lt 80) {
339
            Send-NetworkAlert -Subject "DNS Resolution Issues" `
340
                -Body "DNS server $($dns.DNSServer) has only $($dns.SuccessRate)% success rate for $($dns.Domain)" `
341
                -Priority "High"
342
        }
343
    }
344
}
345

346
# Export metrics to various formats
347
function Export-NetworkMetrics {
348
    param(
349
        [object]$Metrics,
350
        [string]$Format = "JSON"
351
    )
352

353
    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
354

355
    switch ($Format) {
356
        "JSON" {
357
            $outputFile = Join-Path $OutputPath "network_metrics_$timestamp.json"
358
            $Metrics | ConvertTo-Json -Depth 10 | Out-File $outputFile
359
        }
360
        "CSV" {
361
            # Export adapter metrics
362
            $adapterFile = Join-Path $OutputPath "adapter_metrics_$timestamp.csv"
363
            $Metrics.AdapterMetrics | Export-Csv -Path $adapterFile -NoTypeInformation
364

365
            # Export latency metrics
366
            $latencyFile = Join-Path $OutputPath "latency_metrics_$timestamp.csv"
367
            $Metrics.LatencyMetrics | Export-Csv -Path $latencyFile -NoTypeInformation
368

369
            # Export DNS metrics
370
            $dnsFile = Join-Path $OutputPath "dns_metrics_$timestamp.csv"
371
            $Metrics.DNSMetrics | Export-Csv -Path $dnsFile -NoTypeInformation
372
        }
373
        "InfluxDB" {
374
            # Format for InfluxDB line protocol
375
            $lines = @()
376

377
            foreach ($adapter in $Metrics.AdapterMetrics) {
378
                $tags = "adapter=$($adapter.AdapterName.Replace(' ','_')),host=$env:COMPUTERNAME"
379
                $fields = "bytes_sent=$($adapter.BytesSent)i,bytes_received=$($adapter.BytesReceived)i,utilization=$($adapter.Utilization),errors=$($adapter.Errors)i"
380
                $timestamp = [DateTimeOffset]::Now.ToUnixTimeMilliseconds() * 1000000
381
                $lines += "network_adapter,$tags $fields $timestamp"
382
            }
383

384
            $influxFile = Join-Path $OutputPath "influx_metrics_$timestamp.txt"
385
            $lines | Out-File $influxFile
386
        }
387
    }
388

389
    Write-NetworkLog "Metrics exported to $OutputPath in $Format format" -Level "INFO"
390
}
391

392
# Main monitoring loop
393
function Start-NetworkMonitoring {
394
    Write-NetworkLog "Starting Network Performance Monitor" -Level "INFO"
395
    Write-NetworkLog "Output Path: $OutputPath" -Level "INFO"
396
    Write-NetworkLog "Monitoring Interval: $IntervalSeconds seconds" -Level "INFO"
397

398
    while ($true) {
399
        try {
400
            $startTime = Get-Date
401
            Write-NetworkLog "Starting metrics collection cycle" -Level "INFO"
402

403
            # Collect all metrics
404
            $metrics = @{
405
                CollectionTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
406
                Hostname = $env:COMPUTERNAME
407
                AdapterMetrics = Get-NetworkAdapterMetrics
408
                ConnectionMetrics = Get-TCPConnectionMetrics
409
                LatencyMetrics = Test-NetworkLatency
410
                DNSMetrics = Test-DNSPerformance
411
            }
412

413
            # Check thresholds and send alerts
414
            Check-NetworkThresholds -Metrics $metrics
415

416
            # Export metrics
417
            Export-NetworkMetrics -Metrics $metrics -Format "JSON"
418
            Export-NetworkMetrics -Metrics $metrics -Format "CSV"
419

420
            # Calculate collection time
421
            $endTime = Get-Date
422
            $duration = ($endTime - $startTime).TotalSeconds
423
            Write-NetworkLog "Metrics collection completed in $duration seconds" -Level "INFO"
424

425
            # Sleep for the remaining interval
426
            $sleepTime = [Math]::Max(0, $IntervalSeconds - $duration)
427
            if ($sleepTime -gt 0) {
428
                Start-Sleep -Seconds $sleepTime
429
            }
430

431
        } catch {
432
            Write-NetworkLog "Error in monitoring loop: $_" -Level "ERROR"
433
            Start-Sleep -Seconds 60
434
        }
435
    }
436
}
437

438
# Start monitoring
439
Start-NetworkMonitoring

Performance Monitor Configuration#

Custom Data Collector Set#

1
<?xml version="1.0" encoding="UTF-8"?>
2
<DataCollectorSet>
3
    <Name>Network Performance Monitoring</Name>
4
    <Description>Comprehensive network performance data collection</Description>
5
    <SchedulesEnabled>true</SchedulesEnabled>
6

7
    <Schedule>
8
        <Days>127</Days>
9
        <StartTime>00:00:00</StartTime>
10
        <EndTime>23:59:59</EndTime>
11
    </Schedule>
12

13
    <PerformanceCounterDataCollector>
14
        <Name>Network Counters</Name>
15
        <FileName>NetworkPerf</FileName>
16
        <FileNameFormat>3</FileNameFormat>
17
        <FileNameFormatPattern>yyyyMMdd-HHmm</FileNameFormatPattern>
18
        <LogFileFormat>3</LogFileFormat>
19
        <SampleInterval>15</SampleInterval>
20
        <SegmentMaxRecords>0</SegmentMaxRecords>
21

22
        <CounterDisplayName>\Network Interface(*)\Bytes Total/sec</CounterDisplayName>
23
        <CounterDisplayName>\Network Interface(*)\Bytes Sent/sec</CounterDisplayName>
24
        <CounterDisplayName>\Network Interface(*)\Bytes Received/sec</CounterDisplayName>
25
        <CounterDisplayName>\Network Interface(*)\Packets/sec</CounterDisplayName>
26
        <CounterDisplayName>\Network Interface(*)\Packets Sent/sec</CounterDisplayName>
27
        <CounterDisplayName>\Network Interface(*)\Packets Received/sec</CounterDisplayName>
28
        <CounterDisplayName>\Network Interface(*)\Packets Outbound Errors</CounterDisplayName>
29
        <CounterDisplayName>\Network Interface(*)\Packets Received Errors</CounterDisplayName>
30
        <CounterDisplayName>\Network Interface(*)\Packets Outbound Discarded</CounterDisplayName>
31
        <CounterDisplayName>\Network Interface(*)\Packets Received Discarded</CounterDisplayName>
32
        <CounterDisplayName>\Network Interface(*)\Current Bandwidth</CounterDisplayName>
33
        <CounterDisplayName>\Network Interface(*)\Output Queue Length</CounterDisplayName>
34

35
        <CounterDisplayName>\TCPv4\Segments/sec</CounterDisplayName>
36
        <CounterDisplayName>\TCPv4\Segments Sent/sec</CounterDisplayName>
37
        <CounterDisplayName>\TCPv4\Segments Received/sec</CounterDisplayName>
38
        <CounterDisplayName>\TCPv4\Segments Retransmitted/sec</CounterDisplayName>
39
        <CounterDisplayName>\TCPv4\Connection Failures</CounterDisplayName>
40
        <CounterDisplayName>\TCPv4\Connections Active</CounterDisplayName>
41
        <CounterDisplayName>\TCPv4\Connections Established</CounterDisplayName>
42

43
        <CounterDisplayName>\UDPv4\Datagrams/sec</CounterDisplayName>
44
        <CounterDisplayName>\UDPv4\Datagrams Sent/sec</CounterDisplayName>
45
        <CounterDisplayName>\UDPv4\Datagrams Received/sec</CounterDisplayName>
46
        <CounterDisplayName>\UDPv4\Datagrams No Port/sec</CounterDisplayName>
47
        <CounterDisplayName>\UDPv4\Datagrams Received Errors</CounterDisplayName>
48
    </PerformanceCounterDataCollector>
49

50
    <DataManager>
51
        <Enabled>true</Enabled>
52
        <CheckBeforeRunning>true</CheckBeforeRunning>
53
        <MinFreeDisk>1024</MinFreeDisk>
54
        <MaxSize>1024</MaxSize>
55
        <MaxFolderCount>100</MaxFolderCount>
56
        <ResourcePolicy>0</ResourcePolicy>
57
    </DataManager>
58
</DataCollectorSet>

PowerShell Script to Create Data Collector#

1
function New-NetworkPerformanceCollector {
2
    param(
3
        [string]$CollectorName = "Network Performance Monitoring",
4
        [string]$OutputPath = "C:\PerfLogs\Network",
5
        [int]$SampleInterval = 15,
6
        [int]$MaxSizeMB = 1024
7
    )
8

9
    # Create output directory
10
    if (!(Test-Path $OutputPath)) {
11
        New-Item -Path $OutputPath -ItemType Directory -Force
12
    }
13

14
    # Define counters
15
    $counters = @(
16
        "\Network Interface(*)\Bytes Total/sec",
17
        "\Network Interface(*)\Bytes Sent/sec",
18
        "\Network Interface(*)\Bytes Received/sec",
19
        "\Network Interface(*)\Packets/sec",
20
        "\Network Interface(*)\Packets Sent/sec",
21
        "\Network Interface(*)\Packets Received/sec",
22
        "\Network Interface(*)\Packets Outbound Errors",
23
        "\Network Interface(*)\Packets Received Errors",
24
        "\Network Interface(*)\Current Bandwidth",
25
        "\Network Interface(*)\Output Queue Length",
26
        "\TCPv4\Segments/sec",
27
        "\TCPv4\Segments Retransmitted/sec",
28
        "\TCPv4\Connection Failures",
29
        "\TCPv4\Connections Established",
30
        "\UDPv4\Datagrams/sec",
31
        "\UDPv4\Datagrams Received Errors",
32
        "\IPv4\Datagrams/sec",
33
        "\IPv4\Datagrams Forwarded/sec",
34
        "\IPv4\Datagrams Outbound Discarded",
35
        "\IPv4\Datagrams Outbound No Route"
36
    )
37

38
    # Create Data Collector Set
39
    $datacollectorset = New-Object -COM Pla.DataCollectorSet
40
    $datacollectorset.DisplayName = $CollectorName
41
    $datacollectorset.Duration = 0
42
    $datacollectorset.SubdirectoryFormat = 1
43
    $datacollectorset.SubdirectoryFormatPattern = "yyyy-MM-dd"
44
    $datacollectorset.RootPath = $OutputPath
45

46
    # Create Performance Counter Data Collector
47
    $collector = $datacollectorset.DataCollectors.CreateDataCollector(0)
48
    $collector.Name = "Network Performance Counters"
49
    $collector.FileName = "NetworkPerf"
50
    $collector.FileNameFormat = 0x1
51
    $collector.FileNameFormatPattern = "yyyy-MM-dd_HH-mm"
52
    $collector.SampleInterval = $SampleInterval
53
    $collector.LogFileFormat = 0x3  # Binary format
54

55
    # Add counters
56
    $collector.PerformanceCounters = $counters
57

58
    # Add collector to set
59
    $datacollectorset.DataCollectors.Add($collector)
60

61
    # Set schedule
62
    $schedule = $datacollectorset.Schedules.CreateSchedule()
63
    $schedule.Days = 127  # Every day
64
    $schedule.StartDate = (Get-Date).ToString("M/d/yyyy")
65
    $schedule.StartTime = (Get-Date "12:00 AM").ToString("HH:mm:ss")
66
    $datacollectorset.Schedules.Add($schedule)
67

68
    # Configure data management
69
    $datacollectorset.Segment = $true
70
    $datacollectorset.SegmentMaxDuration = 3600  # 1 hour segments
71
    $datacollectorset.SegmentMaxSize = 100  # 100 MB segments
72

73
    try {
74
        # Commit and start
75
        $datacollectorset.Commit($CollectorName, $null, 0x0003)  # Create or modify
76
        $datacollectorset.Start($false)
77

78
        Write-Host "Data Collector Set '$CollectorName' created and started successfully" -ForegroundColor Green
79
        Write-Host "Output path: $OutputPath" -ForegroundColor Yellow
80
    } catch {
81
        Write-Error "Failed to create Data Collector Set: $_"
82
    }
83
}
84

85
# Create the collector
86
New-NetworkPerformanceCollector

WMI-Based Network Monitoring#

Advanced WMI Network Monitor#

1
class WMINetworkMonitor {
2
    [string]$ComputerName
3
    [System.Management.Automation.PSCredential]$Credential
4

5
    WMINetworkMonitor([string]$computerName = "localhost") {
6
        $this.ComputerName = $computerName
7
    }
8

9
    [object[]] GetNetworkAdapterConfiguration() {
10
        $query = "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE"
11

12
        $params = @{
13
            Query = $query
14
            ComputerName = $this.ComputerName
15
        }
16

17
        if ($this.Credential) {
18
            $params.Credential = $this.Credential
19
        }
20

21
        return Get-WmiObject @params
22
    }
23

24
    [object[]] GetNetworkAdapterStatistics() {
25
        $configs = $this.GetNetworkAdapterConfiguration()
26
        $results = @()
27

28
        foreach ($config in $configs) {
29
            # Get corresponding adapter
30
            $adapter = Get-WmiObject -Query "SELECT * FROM Win32_NetworkAdapter WHERE Index = $($config.Index)" `
31
                -ComputerName $this.ComputerName
32

33
            # Get performance data
34
            $perfQuery = "SELECT * FROM Win32_PerfRawData_Tcpip_NetworkInterface WHERE Name LIKE '%$($adapter.Name)%'"
35
            $perfData = Get-WmiObject -Query $perfQuery -ComputerName $this.ComputerName
36

37
            if ($perfData) {
38
                $result = [PSCustomObject]@{
39
                    AdapterName = $adapter.Name
40
                    Description = $adapter.Description
41
                    MACAddress = $config.MACAddress
42
                    IPAddress = $config.IPAddress -join ", "
43
                    SubnetMask = $config.IPSubnet -join ", "
44
                    DefaultGateway = $config.DefaultIPGateway -join ", "
45
                    DNSServers = $config.DNSServerSearchOrder -join ", "
46
                    DHCPEnabled = $config.DHCPEnabled
47
                    Speed = $adapter.Speed
48
                    BytesReceivedPerSec = $perfData.BytesReceivedPerSec
49
                    BytesSentPerSec = $perfData.BytesSentPerSec
50
                    PacketsReceivedPerSec = $perfData.PacketsReceivedPerSec
51
                    PacketsSentPerSec = $perfData.PacketsSentPerSec
52
                    PacketsReceivedErrors = $perfData.PacketsReceivedErrors
53
                    PacketsOutboundErrors = $perfData.PacketsOutboundErrors
54
                    OutputQueueLength = $perfData.OutputQueueLength
55
                    Timestamp = Get-Date
56
                }
57

58
                $results += $result
59
            }
60
        }
61

62
        return $results
63
    }
64

65
    [object[]] GetTCPConnections() {
66
        $query = "SELECT * FROM Win32_PerfRawData_Tcpip_TCPv4"
67
        $tcpStats = Get-WmiObject -Query $query -ComputerName $this.ComputerName
68

69
        return [PSCustomObject]@{
70
            ConnectionsActive = $tcpStats.ConnectionsActive
71
            ConnectionsEstablished = $tcpStats.ConnectionsEstablished
72
            ConnectionFailures = $tcpStats.ConnectionFailures
73
            ConnectionsPassive = $tcpStats.ConnectionsPassive
74
            ConnectionsReset = $tcpStats.ConnectionsReset
75
            SegmentsPerSec = $tcpStats.SegmentsPerSec
76
            SegmentsReceivedPerSec = $tcpStats.SegmentsReceivedPerSec
77
            SegmentsSentPerSec = $tcpStats.SegmentsSentPerSec
78
            SegmentsRetransmittedPerSec = $tcpStats.SegmentsRetransmittedPerSec
79
            Timestamp = Get-Date
80
        }
81
    }
82

83
    [object] GetNetworkUtilization() {
84
        $adapters = $this.GetNetworkAdapterStatistics()
85
        $utilization = @{}
86

87
        foreach ($adapter in $adapters) {
88
            if ($adapter.Speed -gt 0) {
89
                $totalBytes = $adapter.BytesReceivedPerSec + $adapter.BytesSentPerSec
90
                $utilizationPercent = ($totalBytes * 8 / $adapter.Speed) * 100
91

92
                $utilization[$adapter.AdapterName] = [PSCustomObject]@{
93
                    AdapterName = $adapter.AdapterName
94
                    Speed = $adapter.Speed
95
                    BytesPerSec = $totalBytes
96
                    UtilizationPercent = [Math]::Round($utilizationPercent, 2)
97
                    Direction = if ($adapter.BytesSentPerSec -gt $adapter.BytesReceivedPerSec) { "Outbound" } else { "Inbound" }
98
                }
99
            }
100
        }
101

102
        return $utilization
103
    }
104
}
105

106
# Usage example
107
$monitor = [WMINetworkMonitor]::new("localhost")
108

109
# Get network statistics
110
$stats = $monitor.GetNetworkAdapterStatistics()
111
$stats | Format-Table -AutoSize
112

113
# Get TCP connection information
114
$tcpInfo = $monitor.GetTCPConnections()
115
$tcpInfo | Format-List
116

117
# Get network utilization
118
$utilization = $monitor.GetNetworkUtilization()
119
$utilization.Values | Format-Table -AutoSize

Event-Based Network Monitoring#

Network Event Monitor#

1
function Start-NetworkEventMonitoring {
2
    param(
3
        [string]$LogPath = "C:\Monitoring\NetworkEvents",
4
        [string[]]$EventSources = @(
5
            "Microsoft-Windows-TCPIP",
6
            "Microsoft-Windows-DNS-Client",
7
            "Microsoft-Windows-NetworkProfile",
8
            "Microsoft-Windows-NCSI",
9
            "Microsoft-Windows-Dhcp-Client"
10
        )
11
    )
12

13
    # Create log directory
14
    if (!(Test-Path $LogPath)) {
15
        New-Item -Path $LogPath -ItemType Directory -Force
16
    }
17

18
    # Define event monitoring queries
19
    $queries = @{
20
        "NetworkConnectivity" = @{
21
            LogName = "Microsoft-Windows-NetworkProfile/Operational"
22
            ID = @(10000, 10001)  # Network connected/disconnected
23
        }
24
        "DHCPEvents" = @{
25
            LogName = "Microsoft-Windows-Dhcp-Client/Operational"
26
            ID = @(50001, 50002, 50061, 50062)  # DHCP lease events
27
        }
28
        "DNSEvents" = @{
29
            LogName = "Microsoft-Windows-DNS-Client/Operational"
30
            ID = @(3006, 3008, 3019, 3020)  # DNS query events
31
        }
32
        "TCPIPErrors" = @{
33
            LogName = "System"
34
            Source = "Tcpip"
35
            Level = @(2, 3)  # Warning and Error
36
        }
37
    }
38

39
    # Register event handlers
40
    foreach ($queryName in $queries.Keys) {
41
        $query = $queries[$queryName]
42

43
        $filterXml = @"
44
<QueryList>
45
  <Query Id="0" Path="$($query.LogName)">
46
    <Select Path="$($query.LogName)">
47
"@
48

49
        if ($query.ID) {
50
            $idFilter = ($query.ID | ForEach-Object { "EventID=$_" }) -join " or "
51
            $filterXml += "*[System[($idFilter)]]"
52
        } elseif ($query.Source -and $query.Level) {
53
            $levelFilter = ($query.Level | ForEach-Object { "Level=$_" }) -join " or "
54
            $filterXml += "*[System[Provider[@Name='$($query.Source)'] and ($levelFilter)]]"
55
        }
56

57
        $filterXml += @"
58
    </Select>
59
  </Query>
60
</QueryList>
61
"@
62

63
        $action = {
64
            $event = $Event.SourceEventArgs.NewEvent
65
            $logEntry = [PSCustomObject]@{
66
                TimeCreated = $event.TimeCreated
67
                EventID = $event.Id
68
                Level = $event.LevelDisplayName
69
                Source = $event.ProviderName
70
                Message = $event.Message
71
                Computer = $event.MachineName
72
            }
73

74
            # Log to file
75
            $logFile = Join-Path $using:LogPath "NetworkEvents_$(Get-Date -Format 'yyyyMMdd').json"
76
            $logEntry | ConvertTo-Json -Compress | Add-Content -Path $logFile
77

78
            # Display critical events
79
            if ($event.Level -le 3) {
80
                Write-Warning "Network Event: $($event.Message)"
81
            }
82
        }
83

84
        try {
85
            Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_NTLogEvent'" `
86
                -Action $action `
87
                -SourceIdentifier "NetworkEvent_$queryName"
88

89
            Write-Host "Registered event monitor for $queryName" -ForegroundColor Green
90
        } catch {
91
            Write-Error "Failed to register event monitor for $queryName : $_"
92
        }
93
    }
94

95
    Write-Host "Network event monitoring started. Press Ctrl+C to stop." -ForegroundColor Yellow
96

97
    try {
98
        while ($true) {
99
            Start-Sleep -Seconds 60
100
        }
101
    } finally {
102
        # Cleanup
103
        Get-EventSubscriber | Where-Object { $_.SourceIdentifier -like "NetworkEvent_*" } | Unregister-Event
104
    }
105
}
106

107
# Start monitoring
108
Start-NetworkEventMonitoring

Integration with Monitoring Platforms#

Prometheus Windows Exporter Configuration#

1
collectors:
2
  enabled:
3
    - cpu
4
    - cs
5
    - logical_disk
6
    - memory
7
    - net
8
    - os
9
    - process
10
    - tcp
11

12
  # Network collector configuration
13
  net:
14
    # Network interface whitelist
15
    nic-whitelist: ".*"
16
    # Metrics to collect
17
    metrics:
18
      - bytes_received_total
19
      - bytes_sent_total
20
      - bytes_total
21
      - packets_received_total
22
      - packets_sent_total
23
      - packets_total
24
      - receive_errors_total
25
      - transmit_errors_total
26
      - receive_dropped_total
27
      - transmit_dropped_total
28
      - receive_fifo_total
29
      - transmit_fifo_total
30
      - receive_compressed_total
31
      - transmit_compressed_total
32
      - receive_multicast_total
33

34
  # TCP collector configuration
35
  tcp:
36
    # Connection states to monitor
37
    states:
38
      - established
39
      - syn_sent
40
      - syn_recv
41
      - fin_wait1
42
      - fin_wait2
43
      - time_wait
44
      - close
45
      - close_wait
46
      - last_ack
47
      - listen
48
      - closing

Zabbix Agent Configuration#

1
# zabbix_agentd.conf - Network monitoring additions
2

3
# Network interface discovery
4
UserParameter=net.if.discovery,powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Select-Object @{Name='{\"{#IFNAME}\"';Expression={$_.Name}}, @{Name='{\"{#IFDESCR}\"';Expression={$_.Description}} | ConvertTo-Json }"
5

6
# Custom network metrics
7
UserParameter=net.if.utilization[*],powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $adapter = Get-NetAdapter -Name '$1'; $stats = Get-NetAdapterStatistics -Name '$1'; $perf = Get-Counter -Counter \"\Network Interface($($adapter.Description))\Bytes Total/sec\" -SampleInterval 1 -MaxSamples 1; $bandwidth = $adapter.LinkSpeed; if ($bandwidth -gt 0) { ($perf.CounterSamples[0].CookedValue * 8 / $bandwidth) * 100 } else { 0 } }"
8

9
UserParameter=net.tcp.connections[*],powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { (Get-NetTCPConnection -State $1 -ErrorAction SilentlyContinue).Count }"
10

11
UserParameter=net.tcp.service.connections[*],powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $connections = Get-NetTCPConnection -State Established; $proc = Get-Process -Name '$1' -ErrorAction SilentlyContinue; if ($proc) { ($connections | Where-Object { $_.OwningProcess -in $proc.Id }).Count } else { 0 } }"
12

13
UserParameter=net.dns.query.time[*],powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $sw = [System.Diagnostics.Stopwatch]::StartNew(); Resolve-DnsName -Name '$1' -Server '$2' -ErrorAction SilentlyContinue | Out-Null; $sw.Stop(); $sw.ElapsedMilliseconds }"
14

15
UserParameter=net.latency[*],powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $result = Test-Connection -ComputerName '$1' -Count 4 -ErrorAction SilentlyContinue; if ($result) { ($result | Measure-Object -Property ResponseTime -Average).Average } else { -1 } }"

Real-time Network Dashboard#

PowerShell Network Dashboard#

1
# Real-time network monitoring dashboard
2

3
Add-Type -AssemblyName System.Windows.Forms
4
Add-Type -AssemblyName System.Drawing
5

6
# Create form
7
$form = New-Object System.Windows.Forms.Form
8
$form.Text = "Network Performance Dashboard"
9
$form.Size = New-Object System.Drawing.Size(1200, 800)
10
$form.StartPosition = "CenterScreen"
11
$form.BackColor = [System.Drawing.Color]::FromArgb(30, 30, 30)
12

13
# Create timer for updates
14
$timer = New-Object System.Windows.Forms.Timer
15
$timer.Interval = 1000  # Update every second
16

17
# Create charts
18
$chartBandwidth = New-Object System.Windows.Forms.DataVisualization.Charting.Chart
19
$chartBandwidth.Size = New-Object System.Drawing.Size(580, 250)
20
$chartBandwidth.Location = New-Object System.Drawing.Point(10, 10)
21
$chartBandwidth.BackColor = [System.Drawing.Color]::FromArgb(45, 45, 45)
22

23
$chartArea1 = New-Object System.Windows.Forms.DataVisualization.Charting.ChartArea
24
$chartArea1.BackColor = [System.Drawing.Color]::FromArgb(45, 45, 45)
25
$chartArea1.AxisX.LabelStyle.ForeColor = [System.Drawing.Color]::White
26
$chartArea1.AxisY.LabelStyle.ForeColor = [System.Drawing.Color]::White
27
$chartBandwidth.ChartAreas.Add($chartArea1)
28

29
$seriesRx = New-Object System.Windows.Forms.DataVisualization.Charting.Series
30
$seriesRx.Name = "Received"
31
$seriesRx.ChartType = "Line"
32
$seriesRx.Color = [System.Drawing.Color]::LimeGreen
33
$seriesRx.BorderWidth = 2
34
$chartBandwidth.Series.Add($seriesRx)
35

36
$seriesTx = New-Object System.Windows.Forms.DataVisualization.Charting.Series
37
$seriesTx.Name = "Sent"
38
$seriesTx.ChartType = "Line"
39
$seriesTx.Color = [System.Drawing.Color]::Orange
40
$seriesTx.BorderWidth = 2
41
$chartBandwidth.Series.Add($seriesTx)
42

43
$form.Controls.Add($chartBandwidth)
44

45
# Create status panel
46
$statusPanel = New-Object System.Windows.Forms.Panel
47
$statusPanel.Size = New-Object System.Drawing.Size(580, 250)
48
$statusPanel.Location = New-Object System.Drawing.Point(600, 10)
49
$statusPanel.BackColor = [System.Drawing.Color]::FromArgb(45, 45, 45)
50
$form.Controls.Add($statusPanel)
51

52
# Status labels
53
$lblStatus = New-Object System.Windows.Forms.Label
54
$lblStatus.Size = New-Object System.Drawing.Size(560, 230)
55
$lblStatus.Location = New-Object System.Drawing.Point(10, 10)
56
$lblStatus.ForeColor = [System.Drawing.Color]::White
57
$lblStatus.Font = New-Object System.Drawing.Font("Consolas", 10)
58
$statusPanel.Controls.Add($lblStatus)
59

60
# Data grid for connections
61
$gridConnections = New-Object System.Windows.Forms.DataGridView
62
$gridConnections.Size = New-Object System.Drawing.Size(1180, 300)
63
$gridConnections.Location = New-Object System.Drawing.Point(10, 270)
64
$gridConnections.BackgroundColor = [System.Drawing.Color]::FromArgb(45, 45, 45)
65
$gridConnections.ForeColor = [System.Drawing.Color]::White
66
$gridConnections.GridColor = [System.Drawing.Color]::FromArgb(60, 60, 60)
67
$gridConnections.EnableHeadersVisualStyles = $false
68
$gridConnections.ColumnHeadersDefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(60, 60, 60)
69
$gridConnections.ColumnHeadersDefaultCellStyle.ForeColor = [System.Drawing.Color]::White
70
$gridConnections.DefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(45, 45, 45)
71
$gridConnections.DefaultCellStyle.ForeColor = [System.Drawing.Color]::White
72
$form.Controls.Add($gridConnections)
73

74
# Initialize data
75
$script:dataPoints = 60
76
$script:rxData = New-Object System.Collections.ArrayList
77
$script:txData = New-Object System.Collections.ArrayList
78
$script:timeLabels = New-Object System.Collections.ArrayList
79

80
# Initialize with zeros
81
for ($i = 0; $i -lt $dataPoints; $i++) {
82
    [void]$rxData.Add(0)
83
    [void]$txData.Add(0)
84
    [void]$timeLabels.Add("")
85
}
86

87
# Update function
88
$updateDashboard = {
89
    try {
90
        # Get primary network adapter
91
        $adapter = Get-NetAdapter | Where-Object { $_.Status -eq "Up" -and $_.PhysicalMediaType -ne "Unspecified" } | Select-Object -First 1
92

93
        if ($adapter) {
94
            # Get current statistics
95
            $stats = Get-NetAdapterStatistics -Name $adapter.Name
96

97
            # Get performance counters
98
            $rxCounter = Get-Counter -Counter "\Network Interface($($adapter.Description))\Bytes Received/sec" -ErrorAction SilentlyContinue
99
            $txCounter = Get-Counter -Counter "\Network Interface($($adapter.Description))\Bytes Sent/sec" -ErrorAction SilentlyContinue
100

101
            $rxBytesPerSec = if ($rxCounter) { $rxCounter.CounterSamples[0].CookedValue } else { 0 }
102
            $txBytesPerSec = if ($txCounter) { $txCounter.CounterSamples[0].CookedValue } else { 0 }
103

104
            # Update data arrays
105
            $rxData.RemoveAt(0)
106
            $txData.RemoveAt(0)
107
            $timeLabels.RemoveAt(0)
108

109
            [void]$rxData.Add($rxBytesPerSec / 1MB)  # Convert to MB/s
110
            [void]$txData.Add($txBytesPerSec / 1MB)
111
            [void]$timeLabels.Add((Get-Date).ToString("HH:mm:ss"))
112

113
            # Update chart
114
            $chartBandwidth.Series["Received"].Points.Clear()
115
            $chartBandwidth.Series["Sent"].Points.Clear()
116

117
            for ($i = 0; $i -lt $dataPoints; $i++) {
118
                [void]$chartBandwidth.Series["Received"].Points.AddXY($i, $rxData[$i])
119
                [void]$chartBandwidth.Series["Sent"].Points.AddXY($i, $txData[$i])
120
            }
121

122
            # Update status
123
            $utilization = if ($adapter.LinkSpeed -gt 0) {
124
                (($rxBytesPerSec + $txBytesPerSec) * 8 / $adapter.LinkSpeed) * 100
125
            } else { 0 }
126

127
            $statusText = @"
128
Network Adapter: $($adapter.Name)
129
Status: $($adapter.Status)
130
Link Speed: $($adapter.LinkSpeed / 1GB) Gbps
131
MAC Address: $($adapter.MacAddress)
132

133
Current Performance:
134
  Download: $([Math]::Round($rxBytesPerSec / 1MB, 2)) MB/s
135
  Upload: $([Math]::Round($txBytesPerSec / 1MB, 2)) MB/s
136
  Total: $([Math]::Round(($rxBytesPerSec + $txBytesPerSec) / 1MB, 2)) MB/s
137
  Utilization: $([Math]::Round($utilization, 2))%
138

139
Total Statistics:
140
  Bytes Received: $([Math]::Round($stats.ReceivedBytes / 1GB, 2)) GB
141
  Bytes Sent: $([Math]::Round($stats.SentBytes / 1GB, 2)) GB
142
  Packets Received: $($stats.ReceivedUnicastPackets)
143
  Packets Sent: $($stats.SentUnicastPackets)
144
  Errors: $($stats.ReceivedPacketErrors + $stats.OutboundPacketErrors)
145
"@
146

147
            $lblStatus.Text = $statusText
148

149
            # Update connections grid
150
            $connections = Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } |
151
                Select-Object @{Name='Process';Expression={
152
                    try { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName } catch { "Unknown" }
153
                }}, LocalAddress, LocalPort, RemoteAddress, RemotePort, State |
154
                Group-Object Process |
155
                Select-Object @{Name='Process';Expression={$_.Name}},
156
                             @{Name='Connections';Expression={$_.Count}},
157
                             @{Name='Details';Expression={
158
                                 ($_.Group | ForEach-Object { "$($_.RemoteAddress):$($_.RemotePort)" } |
159
                                  Select-Object -Unique) -join ", " |
160
                                  ForEach-Object { if ($_.Length -gt 100) { $_.Substring(0, 97) + "..." } else { $_ } }
161
                             }}
162

163
            $gridConnections.DataSource = $null
164
            $gridConnections.DataSource = @($connections)
165
            $gridConnections.Columns[0].Width = 150
166
            $gridConnections.Columns[1].Width = 100
167
            $gridConnections.Columns[2].Width = 900
168
        }
169
    } catch {
170
        Write-Host "Error updating dashboard: $_" -ForegroundColor Red
171
    }
172
}
173

174
# Assign update function to timer
175
$timer.Add_Tick($updateDashboard)
176
$timer.Start()
177

178
# Form closing event
179
$form.Add_FormClosing({
180
    $timer.Stop()
181
    $timer.Dispose()
182
})
183

184
# Show form
185
[void]$form.ShowDialog()

Automated Reporting#

Network Performance Report Generator#

1
function New-NetworkPerformanceReport {
2
    param(
3
        [string]$ReportPath = "C:\Reports\Network",
4
        [int]$DaysToAnalyze = 7,
5
        [string]$SMTPServer = "smtp.company.com",
6
        [string[]]$Recipients = @("netops@company.com")
7
    )
8

9
    # Create report directory
10
    if (!(Test-Path $ReportPath)) {
11
        New-Item -Path $ReportPath -ItemType Directory -Force
12
    }
13

14
    $reportDate = Get-Date
15
    $reportFile = Join-Path $ReportPath "NetworkReport_$(Get-Date -Format 'yyyyMMdd').html"
16

17
    # Collect data
18
    Write-Host "Collecting network performance data..." -ForegroundColor Yellow
19

20
    # Get adapters
21
    $adapters = Get-NetAdapter | Where-Object { $_.Status -eq "Up" }
22

23
    # Build HTML report
24
    $html = @"
25
<!DOCTYPE html>
26
<html>
27
<head>
28
    <title>Network Performance Report - $($reportDate.ToString('yyyy-MM-dd'))</title>
29
    <style>
30
        body { font-family: Arial, sans-serif; margin: 20px; background-color: #f5f5f5; }
31
        h1, h2 { color: #333; }
32
        table { border-collapse: collapse; width: 100%; margin-bottom: 20px; background-color: white; }
33
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
34
        th { background-color: #4CAF50; color: white; }
35
        tr:nth-child(even) { background-color: #f2f2f2; }
36
        .metric { display: inline-block; margin: 10px; padding: 15px; background-color: white; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
37
        .metric-value { font-size: 24px; font-weight: bold; color: #4CAF50; }
38
        .warning { color: #ff9800; }
39
        .error { color: #f44336; }
40
        .chart { margin: 20px 0; }
41
    </style>
42
    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
43
</head>
44
<body>
45
    <h1>Network Performance Report</h1>
46
    <p>Generated: $($reportDate.ToString('yyyy-MM-dd HH:mm:ss'))</p>
47
    <p>System: $env:COMPUTERNAME</p>
48

49
    <h2>Executive Summary</h2>
50
    <div class="metrics">
51
"@
52

53
    # Calculate summary metrics
54
    $totalBandwidth = 0
55
    $totalUtilization = 0
56
    $totalErrors = 0
57

58
    foreach ($adapter in $adapters) {
59
        $stats = Get-NetAdapterStatistics -Name $adapter.Name
60
        $totalBandwidth += $adapter.LinkSpeed
61
        $totalErrors += $stats.ReceivedPacketErrors + $stats.OutboundPacketErrors
62

63
        # Get current utilization
64
        $rxCounter = Get-Counter -Counter "\Network Interface($($adapter.Description))\Bytes Received/sec" -ErrorAction SilentlyContinue
65
        $txCounter = Get-Counter -Counter "\Network Interface($($adapter.Description))\Bytes Sent/sec" -ErrorAction SilentlyContinue
66

67
        if ($rxCounter -and $txCounter -and $adapter.LinkSpeed -gt 0) {
68
            $utilization = (($rxCounter.CounterSamples[0].CookedValue + $txCounter.CounterSamples[0].CookedValue) * 8 / $adapter.LinkSpeed) * 100
69
            $totalUtilization += $utilization
70
        }
71
    }
72

73
    $avgUtilization = if ($adapters.Count -gt 0) { $totalUtilization / $adapters.Count } else { 0 }
74

75
    $html += @"
76
        <div class="metric">
77
            <div>Total Bandwidth</div>
78
            <div class="metric-value">$([Math]::Round($totalBandwidth / 1GB, 2)) Gbps</div>
79
        </div>
80
        <div class="metric">
81
            <div>Average Utilization</div>
82
            <div class="metric-value $( if ($avgUtilization -gt 80) { 'error' } elseif ($avgUtilization -gt 60) { 'warning' } )">$([Math]::Round($avgUtilization, 2))%</div>
83
        </div>
84
        <div class="metric">
85
            <div>Total Errors (7 days)</div>
86
            <div class="metric-value $( if ($totalErrors -gt 1000) { 'error' } elseif ($totalErrors -gt 100) { 'warning' } )">$totalErrors</div>
87
        </div>
88
    </div>
89

90
    <h2>Network Adapters</h2>
91
    <table>
92
        <tr>
93
            <th>Adapter</th>
94
            <th>Status</th>
95
            <th>Speed</th>
96
            <th>IP Address</th>
97
            <th>Bytes Sent</th>
98
            <th>Bytes Received</th>
99
            <th>Errors</th>
100
        </tr>
101
"@
102

103
    foreach ($adapter in $adapters) {
104
        $stats = Get-NetAdapterStatistics -Name $adapter.Name
105
        $ipConfig = Get-NetIPConfiguration -InterfaceAlias $adapter.Name
106

107
        $html += @"
108
        <tr>
109
            <td>$($adapter.Name)</td>
110
            <td>$($adapter.Status)</td>
111
            <td>$($adapter.LinkSpeed / 1GB) Gbps</td>
112
            <td>$($ipConfig.IPv4Address.IPAddress)</td>
113
            <td>$([Math]::Round($stats.SentBytes / 1GB, 2)) GB</td>
114
            <td>$([Math]::Round($stats.ReceivedBytes / 1GB, 2)) GB</td>
115
            <td class="$( if (($stats.ReceivedPacketErrors + $stats.OutboundPacketErrors) -gt 100) { 'error' } )">$($stats.ReceivedPacketErrors + $stats.OutboundPacketErrors)</td>
116
        </tr>
117
"@
118
    }
119

120
    $html += @"
121
    </table>
122

123
    <h2>Performance Trends</h2>
124
    <div class="chart">
125
        <canvas id="performanceChart" width="400" height="200"></canvas>
126
    </div>
127

128
    <script>
129
    // Add chart initialization here
130
    var ctx = document.getElementById('performanceChart').getContext('2d');
131
    var chart = new Chart(ctx, {
132
        type: 'line',
133
        data: {
134
            labels: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'],
135
            datasets: [{
136
                label: 'Network Utilization %',
137
                data: [65, 59, 80, 81, 56, 55, 40],
138
                borderColor: 'rgb(75, 192, 192)',
139
                tension: 0.1
140
            }]
141
        },
142
        options: {
143
            responsive: true,
144
            scales: {
145
                y: {
146
                    beginAtZero: true,
147
                    max: 100
148
                }
149
            }
150
        }
151
    });
152
    </script>
153

154
    <h2>Recommendations</h2>
155
    <ul>
156
"@
157

158
    # Add recommendations based on findings
159
    if ($avgUtilization -gt 80) {
160
        $html += "<li class='error'>Critical: Network utilization is very high. Consider upgrading network capacity.</li>"
161
    } elseif ($avgUtilization -gt 60) {
162
        $html += "<li class='warning'>Warning: Network utilization is elevated. Monitor for potential bottlenecks.</li>"
163
    }
164

165
    if ($totalErrors -gt 1000) {
166
        $html += "<li class='error'>Critical: High number of network errors detected. Investigate network hardware and configurations.</li>"
167
    } elseif ($totalErrors -gt 100) {
168
        $html += "<li class='warning'>Warning: Moderate network errors detected. Review network logs for patterns.</li>"
169
    }
170

171
    $html += @"
172
    </ul>
173
</body>
174
</html>
175
"@
176

177
    # Save report
178
    $html | Out-File -FilePath $reportFile -Encoding UTF8
179
    Write-Host "Report saved to: $reportFile" -ForegroundColor Green
180

181
    # Email report
182
    if ($SMTPServer -and $Recipients) {
183
        Send-MailMessage -To $Recipients `
184
            -From "networkmonitor@company.com" `
185
            -Subject "Network Performance Report - $($reportDate.ToString('yyyy-MM-dd'))" `
186
            -Body "Please find attached the network performance report for $env:COMPUTERNAME" `
187
            -Attachments $reportFile `
188
            -SmtpServer $SMTPServer
189

190
        Write-Host "Report emailed to: $($Recipients -join ', ')" -ForegroundColor Green
191
    }
192
}
193

194
# Generate report
195
New-NetworkPerformanceReport

Troubleshooting Common Issues#

Network Diagnostics Script#

1
function Invoke-NetworkDiagnostics {
2
    param(
3
        [string]$OutputPath = "C:\Diagnostics\Network",
4
        [switch]$IncludePacketCapture,
5
        [int]$CaptureDurationSeconds = 60
6
    )
7

8
    Write-Host "Starting comprehensive network diagnostics..." -ForegroundColor Yellow
9

10
    # Create output directory
11
    if (!(Test-Path $OutputPath)) {
12
        New-Item -Path $OutputPath -ItemType Directory -Force
13
    }
14

15
    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
16
    $diagPath = Join-Path $OutputPath "NetDiag_$timestamp"
17
    New-Item -Path $diagPath -ItemType Directory -Force
18

19
    # 1. Basic connectivity tests
20
    Write-Host "Testing basic connectivity..." -ForegroundColor Cyan
21

22
    $connectivityTests = @{
23
        "Gateway" = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Select-Object -First 1).NextHop
24
        "DNS" = (Get-DnsClientServerAddress -AddressFamily IPv4 | Select-Object -First 1).ServerAddresses[0]
25
        "Internet" = "8.8.8.8"
26
        "Microsoft" = "microsoft.com"
27
    }
28

29
    $connectivityResults = @()
30
    foreach ($test in $connectivityTests.GetEnumerator()) {
31
        $result = Test-NetConnection -ComputerName $test.Value -InformationLevel Detailed
32
        $connectivityResults += [PSCustomObject]@{
33
            Target = $test.Key
34
            Address = $test.Value
35
            PingSucceeded = $result.PingSucceeded
36
            Latency = $result.PingReplyDetails.RoundtripTime
37
            NameResolution = $result.NameResolutionSucceeded
38
            Details = $result
39
        }
40
    }
41

42
    $connectivityResults | Export-Csv -Path "$diagPath\connectivity_test.csv" -NoTypeInformation
43

44
    # 2. Network configuration
45
    Write-Host "Collecting network configuration..." -ForegroundColor Cyan
46

47
    Get-NetIPConfiguration -Detailed | Out-File "$diagPath\ip_configuration.txt"
48
    Get-NetAdapter -IncludeHidden | Format-List * | Out-File "$diagPath\network_adapters.txt"
49
    Get-NetRoute | Export-Csv -Path "$diagPath\routing_table.csv" -NoTypeInformation
50
    Get-DnsClientCache | Export-Csv -Path "$diagPath\dns_cache.csv" -NoTypeInformation
51

52
    # 3. Performance metrics
53
    Write-Host "Collecting performance metrics..." -ForegroundColor Cyan
54

55
    $perfCounters = @(
56
        "\Network Interface(*)\Bytes Total/sec",
57
        "\Network Interface(*)\Packets/sec",
58
        "\Network Interface(*)\Packets Received Errors",
59
        "\Network Interface(*)\Packets Outbound Errors",
60
        "\TCPv4\Segments Retransmitted/sec",
61
        "\TCPv4\Connection Failures"
62
    )
63

64
    $perfData = Get-Counter -Counter $perfCounters -SampleInterval 1 -MaxSamples 10
65
    $perfData | Export-Counter -Path "$diagPath\performance_counters.blg" -Force
66

67
    # 4. TCP/IP statistics
68
    Write-Host "Collecting TCP/IP statistics..." -ForegroundColor Cyan
69

70
    netstat -s | Out-File "$diagPath\netstat_statistics.txt"
71
    netstat -ano | Out-File "$diagPath\netstat_connections.txt"
72
    Get-NetTCPConnection | Export-Csv -Path "$diagPath\tcp_connections.csv" -NoTypeInformation
73
    Get-NetUDPEndpoint | Export-Csv -Path "$diagPath\udp_endpoints.csv" -NoTypeInformation
74

75
    # 5. Firewall rules
76
    Write-Host "Collecting firewall rules..." -ForegroundColor Cyan
77

78
    Get-NetFirewallRule | Where-Object { $_.Enabled -eq $true } |
79
        Select-Object DisplayName, Direction, Action, Protocol, LocalPort, RemotePort |
80
        Export-Csv -Path "$diagPath\firewall_rules.csv" -NoTypeInformation
81

82
    # 6. Event logs
83
    Write-Host "Collecting event logs..." -ForegroundColor Cyan
84

85
    $logNames = @(
86
        "System",
87
        "Microsoft-Windows-TCPIP/Operational",
88
        "Microsoft-Windows-DNS-Client/Operational",
89
        "Microsoft-Windows-NetworkProfile/Operational"
90
    )
91

92
    foreach ($logName in $logNames) {
93
        try {
94
            $events = Get-WinEvent -LogName $logName -MaxEvents 1000 |
95
                Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-1) }
96

97
            $events | Select-Object TimeCreated, Id, LevelDisplayName, Message |
98
                Export-Csv -Path "$diagPath\events_$($logName.Replace('/', '_')).csv" -NoTypeInformation
99
        } catch {
100
            Write-Warning "Could not retrieve events from $logName"
101
        }
102
    }
103

104
    # 7. Packet capture (optional)
105
    if ($IncludePacketCapture) {
106
        Write-Host "Starting packet capture for $CaptureDurationSeconds seconds..." -ForegroundColor Cyan
107

108
        $capturePath = "$diagPath\packet_capture.etl"
109
        $captureCmd = "netsh trace start capture=yes tracefile=$capturePath provider=Microsoft-Windows-TCPIP level=5 maxsize=100 overwrite=yes"
110

111
        Invoke-Expression $captureCmd
112
        Start-Sleep -Seconds $CaptureDurationSeconds
113
        netsh trace stop
114
    }
115

116
    # 8. Generate summary report
117
    Write-Host "Generating summary report..." -ForegroundColor Cyan
118

119
    $summary = @"
120
Network Diagnostics Summary
121
Generated: $(Get-Date)
122
Computer: $env:COMPUTERNAME
123

124
CONNECTIVITY TEST RESULTS:
125
$($connectivityResults | Format-Table -AutoSize | Out-String)
126

127
ACTIVE NETWORK ADAPTERS:
128
$(Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | Format-Table Name, Status, LinkSpeed, MacAddress -AutoSize | Out-String)
129

130
TCP CONNECTION SUMMARY:
131
$(Get-NetTCPConnection | Group-Object State | Select-Object Name, Count | Format-Table -AutoSize | Out-String)
132

133
TOP PROCESSES BY NETWORK CONNECTIONS:
134
$(Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } |
135
    Group-Object OwningProcess |
136
    ForEach-Object {
137
        $proc = Get-Process -Id $_.Name -ErrorAction SilentlyContinue
138
        [PSCustomObject]@{
139
            Process = if ($proc) { $proc.ProcessName } else { "PID: $($_.Name)" }
140
            Connections = $_.Count
141
        }
142
    } |
143
    Sort-Object Connections -Descending |
144
    Select-Object -First 10 |
145
    Format-Table -AutoSize | Out-String)
146

147
RECENT NETWORK ERRORS:
148
$(Get-WinEvent -LogName System -MaxEvents 100 |
149
    Where-Object { $_.ProviderName -match "Tcpip|DNS|DHCP" -and $_.LevelDisplayName -match "Warning|Error" } |
150
    Select-Object -First 10 TimeCreated, ProviderName, Message |
151
    Format-Table -AutoSize | Out-String)
152
"@
153

154
    $summary | Out-File "$diagPath\summary.txt"
155

156
    # Compress results
157
    $zipPath = "$OutputPath\NetworkDiagnostics_$timestamp.zip"
158
    Compress-Archive -Path $diagPath -DestinationPath $zipPath -Force
159

160
    Write-Host "Diagnostics complete. Results saved to: $zipPath" -ForegroundColor Green
161

162
    # Cleanup
163
    Remove-Item -Path $diagPath -Recurse -Force
164
}
165

166
# Run diagnostics
167
Invoke-NetworkDiagnostics

Best Practices Summary#

1
graph TD
2
    subgraph "Network Monitoring Best Practices"
3
        subgraph "Collection"
4
            A[Multiple Data Sources]
5
            B[Regular Intervals]
6
            C[Historical Data]
7
            D[Real-time Alerts]
8
        end
9

10
        subgraph "Analysis"
11
            E[Baseline Establishment]
12
            F[Trend Analysis]
13
            G[Anomaly Detection]
14
            H[Correlation]
15
        end
16

17
        subgraph "Response"
18
            I[Automated Alerts]
19
            J[Diagnostic Scripts]
20
            K[Remediation Actions]
21
            L[Documentation]
22
        end
23

24
        subgraph "Integration"
25
            M[SIEM Integration]
26
            N[Ticketing System]
27
            O[Dashboard Display]
28
            P[Reporting]
29
        end
30
    end
31

32
    A --> E
33
    B --> F
34
    C --> G
35
    D --> I
36

37
    E --> J
38
    F --> K
39
    G --> L
40
    H --> M
41

42
    I --> N
43
    J --> O
44
    K --> P
45

46
    style A fill:#f96,stroke:#333,stroke-width:2px
47
    style E fill:#9f9,stroke:#333,stroke-width:2px
48
    style I fill:#99f,stroke:#333,stroke-width:2px

Conclusion#

Effective network performance monitoring on Windows requires a multi-layered approach combining native tools, PowerShell automation, and integration with enterprise monitoring platforms. By implementing the scripts and configurations provided in this guide, you can build a comprehensive monitoring solution that provides visibility into network health, enables proactive problem detection, and facilitates rapid troubleshooting.

Key takeaways:

Leverage Windows native capabilities (WMI, Performance Counters, ETW)
Automate monitoring with PowerShell scripts
Integrate with enterprise monitoring platforms
Implement real-time alerting for critical issues
Maintain historical data for trend analysis
Use visualization tools for better insights
Regular reporting for stakeholders