--- title: "Catching Windows in the Act with Proxmox Packet Capture" url: https://daily.dev/posts/catching-windows-in-the-act-with-proxmox-packet-capture-jxlptslzo source_url: https://www.youtube.com/watch?v=lie51NxuZB8 type: video:youtube source: "Lawrence Systems" published: 2026-07-08T23:56:22.741Z updated: 2026-07-08T23:56:44.175Z tags: ["security", "proxmox", "wireshark"] reading_time: 8 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Catching Windows in the Act with Proxmox Packet Capture **[Lawrence Systems](https://daily.dev/sources/lawrencesystems)** · 8 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough of using Proxmox's built-in tcpdump to capture all network traffic from a fresh Windows 11 VM from the very first packet. By attaching to the VM's tap interface and saving a PCAP file, you can see exactly what Windows phones home to by default — even with a local account and minimal telemetry settings. The captured file is then analyzed in Wireshark and in SOCRATES (Security Onion Containerized Rapid Analysis), a Docker-based PCAP analysis tool by Security Onion's creator. Results show 76 DNS queries and multiple TLS connections to Microsoft and other services before any user interaction. The author concludes that blocking Windows telemetry is a cat-and-mouse game that updates can undo, and recommends avoiding Windows entirely if privacy is a concern. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [I stopped using Wireshark for first-line troubleshooting after discovering Windows' built-in packet capture tool](https://daily.dev/posts/i-stopped-using-wireshark-for-first-line-troubleshooting-after-discovering-windows-built-in-packet--x4ki42qwx) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#proxmox](https://daily.dev/tags/proxmox), [#wireshark](https://daily.dev/tags/wireshark) [View this post on daily.dev](https://daily.dev/posts/catching-windows-in-the-act-with-proxmox-packet-capture-jxlptslzo)