There is always Ethereal's poor cousin windump.
This is a Windows port of tcpdump. The only thing to watch out for is that you need to tell it what interface you want to capture from.
You can tell it to stop after capturing a certain numebr of packets and you could use a batch file or whatever to rotate the file names.
I put in a few different kinds of packet here including TCP telnet.
H:\\>windump -D
1.\\Device\\NPF_GenericDialupAdapter (Adapter for generic dialup and VPN capture)
2.\\Device\\NPF_{0325987F-4C34-4972-8F1C-CD37084F} (Compaq Ethernet/Fast Ethernet Adapter/Module (Microsoft's Packet Scheduler) )
3.\\Device\\NPF_{554899B0-FAF8-4DFE-9ED2-D0562FFC} (Broadcom NetXtreme Gigabit Ethernet Driver (Microsoft's Packet Scheduler) )
H:\\>windump -i 3 -n -vv host 192.168.77.1 windump: listening on \\Device\\NPF_{554899B0-FAF8-4DFE-9ED2-D0562FFC}
10:48:05.562387 IP (tos 0xc0, ttl 1, id 56167, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:06.122440 IP (tos 0xc0, ttl 1, id 56204, len 76) 192.168.77.1 >
224.0.0.5: OSPFv2-hello 56: [len 44]
10:48:06.130666 IP (tos 0x0, ttl 128, id 58483, len 60) 192.168.77.249
icmp 40: echo request seq 16528
10:48:06.131286 IP (tos 0x0, ttl 255, id 58483, len 60) 192.168.77.1 >
192.168.77.249: icmp 40: echo reply seq 16528
10:48:06.287708 arp who-has 192.168.77.167 tell 192.168.77.1
10:48:06.542507 IP (tos 0xc0, ttl 1, id 56230, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:07.131824 IP (tos 0x0, ttl 128, id 58489, len 60) 192.168.77.249
icmp 40: echo request seq 17040
10:48:07.132461 IP (tos 0x0, ttl 255, id 58489, len 60) 192.168.77.1 >
192.168.77.249: icmp 40: echo reply seq 17040
10:48:07.531989 IP (tos 0xc0, ttl 1, id 56283, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:14.659828 arp who-has 192.168.77.167 tell 192.168.77.1
10:48:15.443294 IP (tos 0xc0, ttl 1, id 56727, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:15.599915 arp who-has 192.168.77.111 tell 192.168.77.1
10:48:16.123364 IP (tos 0xc0, ttl 1, id 56770, len 76) 192.168.77.1 >
224.0.0.5: OSPFv2-hello 56: [len 44]
10:48:16.431393 IP (tos 0xc0, ttl 1, id 56788, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:17.412261 IP (tos 0xc0, ttl 1, id 56841, len 54) 192.168.77.1 >
224.0.0.13: pim v2 Hello (Hold-time 3s) (Genid: 0x00000527) (DR-Priority: 1) (State Refresh Capable; v1)
10:48:17.837960 IP (tos 0x0, ttl 128, id 58554, len 48)
192.168.77.249.3078 > 192.168.77.1.23: S [tcp sum ok] 1475676875:1475676875(0) win 64512 (DF)
10:48:17.839158 IP (tos 0x0, ttl 255, id 0, len 44) 192.168.77.1.23 >
192.168.77.249.3078: S [tcp sum ok] 2854354119:2854354119(0) ack 1475676876 win 4128
10:48:17.839192 IP (tos 0x0, ttl 128, id 58555, len 40)
192.168.77.249.3078 > 192.168.77.1.23: . [tcp sum ok] 1:1(0) ack 1 win 64512 (DF)
10:48:17.841634 IP (tos 0xc0, ttl 255, id 1, len 52) 192.168.77.1.23 >
192.168.77.249.3078: P [tcp sum ok] 1:13(12) ack 1 win 4128 [telnet WILL ECHO, WILL SUPPRESS GO AHEAD, DO TERMINAL TYPE, DO NAWS]
10:48:17.841819 IP (tos 0x0, ttl 128, id 58556, len 43)
192.168.77.249.3078 > 192.168.77.1.23: P [tcp sum ok] 1:4(3) ack 13 win 64500 [telnet DO ECHO] (DF)
15257 packets received by filter
0 packets dropped by kernel
H:\\>
