the reference is here: http://blogs.msdn.com/b/ntdebugging/archive/2009/04/24/using-netmon-to-figure-out-the-source-of-high-cpu-in-wmiprvse-exe.aspx