I'm going to recommend deadlisting/disassembly instead. Network analysis doesn't give as much context for exactly what is sent, and there seems to be - as far as I can see, yet? - a total lack of hard data and verifiable evidence about what all this "telemetry" actually is, what can be turned off, what can't, and what actually gets sent to whom, when, from what, and why.

The "evidence" I have seen so far that Windows 10 communicates with its maker is, let's be honest, pretty scaremongery and includes things like LLMNR traffic - which is link-local! - and neglects to consider that Windows Update now checks much more frequently (because of the accelerated release cadence of a rolling release) and essentially torrents its updates now, P2P-style.

If there's a real privacy issue - and there may well be, especially on default settings - we need reliable, detailed, hard information to see what binaries send what to where to begin to address it, and to see what can be turned off, what should be, etc. Does anyone know if anyone's begun that analysis yet?

(Of course it really should be Microsoft openly discussing this, but in the absence of that, the mantle inevitably falls to independent researchers.)

I would be astonished to see "below the stack" communications for anything official from Microsoft, because that takes the public conversation from "look at all these features that affect privacy" to "look at how Microsoft is TRYING TO HIDE privacy invading features."

Since MS knows that Windows communications are going to be under a microscope anyway the odds of them expecting to successfully hide the very existence of communications seem low to me, and once they're known to exist they WILL be inspected and publicized.

I'd expect the below-stack communications to be from espionage folks instead, quite frankly.

That is just plain naiveté. Big corporations don't have the accountability as individuals or smaller companies. They can just scrapgoat someone. Just watch some docus like the enron one http://www.imdb.com/title/tt1016268/. Those dystopian futures many writers romance about are going to come true soon.

Could you recommend a resource that would provide some good information on this? I keep hearing about ways to modify routers to operate this way, but have yet to come across something that clearly describes how this is done.

I have a blog explaining how to watch the traffic of a Nintendo Wii console using a USB-ethernet adapter. http://smtddr.hatenablog.com/entry/2014/02/16/tvclb_part1

It's probably overly complicated, but because I happened to have an extra router laying about it was the easiest way for me to do it. The setup ultimately looks like this: http://i.imgur.com/klNvoTS.png

The spare router is really only needed for the smartphone. Anything with an ethernet port can be connected directly to the linux laptop.

This has taught me a lot. Thank you.

As someone tech-savvy and having used WireShark, even, I'm curious to know from my sibling commenters, what are you thinking? Of course you start by buying hardware or modifying a router. Parent comment is specifically asking for "good information" and something that "clearly defines how this is done." IMO, xfalcox and lewiseason come closest to actually answering the question, because their links mention specific software.

But simply installing software isn't enough, it needs to be configured. How does one set up OpenWRT or WireShark to filter for this kind of information? What pitfalls might one encounter? Do you need a CS degree in order to interpret the data? What keywords should one use when searching for more information?

With vague answers like the ones so far, you're just making it seem more difficult and intimidating for anyone that has little to no experience in this area. If we want people to be more concerned about their privacy, it needs to be as easy (or easier) for people to take control of their information as it is for them to give it away.

Edit: smtddr has the right idea, thumbs up. Should have hit refresh one more time before posting.

As bitwise said, best is to use a small linux computer on the same lan. You could use any computer really, just make it different than the host you are trying to capture on!

The cheap and easy way to do this is to buy a hub and plug it into your router the computer you want to analyse and another computer.

Or buy/make something like this:

http://hakshop.myshopify.com/products/throwing-star-lan-tap

and a couple of USB-Ethernet adaptors

Even easier (buying hubs is hard) and possibly cheaper (switches with mirror ports aren't the cheapest) is to just stick two network cards into your linux box, set up a layer-2 bridge and sniff everything going between.

CentOS/RedHat derivitives: https://www.banym.de/linux/centos/setup-bridge-device-on-cen...

Debian/Ubuntu: https://wiki.debian.org/BridgeNetworkConnections

If you happen to have a computer with both WiFi and ethernet (many/most laptops these days), set it up as a bridge, connect the Windows machine to one of those interfaces and use the other one to connect to the internet.

The most common way is using an alternate firmware, like OpenWRT. You need a compatible router, but the official site is good enough.

http://wiki.openwrt.org/toh/start

Use a Linux box (a Raspberry Pi, for example) as a router/AP.