You are subscribed to the MSCOM ops blog, right? Then you already saw this nifty tip about Netcap.exe, right?