This is the command you can use to do an automated 5 second network capture using netmon for default net.tcp traffic on any stack such as wcf or Sapphire. The default net.tcp port is 808 so thats what we use here.

[code:c#] nmcap /network * /capture tcp.port == 808 /startwhen /timeafter 0 sec /stopwhen /timeafter 5 sec /file output.cap [/code]

• You can download network monitor from here 
• Check out this post incase you are not aware of nmcap.