Validate packet capture outcomes and narrow cleanup inventory

Network.ps1

@@ -12,17 +12,26 @@ $stateRoot=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'MsP
 if($Mode -eq 'Plan'){$x=Get-WindNetworkPlan -Profile $Profile -RollbackMinutes $RollbackMinutes;if($Json){$x|ConvertTo-Json -Depth 8}else{$x.Items|Format-Table -Wrap};return}
 if($Mode -eq 'Validate'){$x=Get-WindNetworkValidation;if($Json){$x|ConvertTo-Json -Depth 8}else{$x|Format-List};return}
 if($Mode -eq 'CaptureStart'){
- Assert-WindMutationAllowed;if(-not (Get-Command pktmon.exe -ErrorAction SilentlyContinue)){throw 'pktmon.exe is unavailable.'}
- if(-not $CaptureDirectory){$CaptureDirectory=Join-Path $stateRoot ('capture-'+(Get-Date -Format 'yyyyMMdd-HHmmss'))}
+ if(-not $CaptureDirectory){$CaptureDirectory=Join-Path $stateRoot ('capture-'+[guid]::NewGuid().ToString('N'))}
+ $CaptureDirectory=Resolve-WindCaptureDirectory -Path $CaptureDirectory -StateRoot $stateRoot
+ $etl=Join-Path $CaptureDirectory 'capture.etl';if(Test-Path -LiteralPath $etl){throw 'Capture output already exists. Choose a new capture directory.'}
+ if(-not $PSCmdlet.ShouldProcess($CaptureDirectory,'Start packet capture')){return}
+ Assert-WindMutationAllowed
  [IO.Directory]::CreateDirectory($CaptureDirectory)|Out-Null
- $etl=Join-Path $CaptureDirectory 'capture.etl';& pktmon.exe start --capture --comp nics --pkt-size 0 --file-name $etl|Out-Host
+ Invoke-WindPacketMonitor -ArgumentList @('start','--capture','--comp','nics','--pkt-size','0','--file-name',$etl)
  [pscustomobject]@{Status='Running';Directory=$CaptureDirectory;Warning='Capture can contain private addresses and DNS names. Stop and delete or export it explicitly.'}|ConvertTo-Json
  return
 }
 if($Mode -eq 'CaptureStop'){
- if(-not $CaptureDirectory){throw 'CaptureStop requires -CaptureDirectory.'};$full=[IO.Path]::GetFullPath($CaptureDirectory)
- if(-not $full.StartsWith([IO.Path]::GetFullPath($stateRoot)+'\',[StringComparison]::OrdinalIgnoreCase)){throw 'Capture directory must be inside the ms-private local state directory.'}
- & pktmon.exe stop|Out-Host;$etl=Join-Path $full 'capture.etl';$pcap=Join-Path $full 'capture.pcapng';if(Test-Path $etl){& pktmon.exe etl2pcap $etl --out $pcap|Out-Host}
+ if(-not $CaptureDirectory){throw 'CaptureStop requires -CaptureDirectory.'};$full=Resolve-WindCaptureDirectory -Path $CaptureDirectory -StateRoot $stateRoot
+ if(-not $PSCmdlet.ShouldProcess($full,'Stop packet capture and convert to PCAPNG')){return}
+ Assert-WindMutationAllowed
+ $etl=Join-Path $full 'capture.etl';$pcap=Join-Path $full 'capture.pcapng'
+ if(-not(Test-Path -LiteralPath $etl -PathType Leaf)){throw 'Capture ETL file is missing; no capture was stopped.'}
+ if(Test-Path -LiteralPath $pcap){throw 'Converted capture already exists; preserve or move it before retrying conversion.'}
+ Invoke-WindPacketMonitor -ArgumentList @('stop')
+ Invoke-WindPacketMonitor -ArgumentList @('etl2pcap',$etl,'--out',$pcap)
+ if(-not(Test-Path -LiteralPath $pcap -PathType Leaf)){throw 'Packet capture conversion returned success without creating the PCAPNG file.'}
  Save-WindJournal -Journal (Get-WindNetworkValidation) -Path (Join-Path $full 'connections.json')
  Write-Output "Capture stopped: $full";return
 }