This is the command you can use to do an automated 5 second network capture using netmon for default net.tcp traffic on any stack such as wcf or Sapphire. The default net.tcp port is 808 so thats what we use here.
[code:c#] nmcap /network * /capture tcp.port == 808 /startwhen /timeafter 0 sec /stopwhen /timeafter 5 sec /file output.cap [/code]