Ask Your Question

Revision history [back]

There are a couple of options outside of Wireshark that can do this for you:

  1. As noted by @Chuckc, use Process Monitor from SysInternals.
  2. Use the built-in netsh trace command to capture packets and post-process the .etl files to .pcapng using the MS tool etl2pcapng. More info on netsh trace here.