Event Tracing for Windows ETW file reader

asked 2022-10-19 18:13:18 +0000

Bushman
3 ●1 ●3 ●2

Regarding the 4.0 Release Notes: "The Event Tracing for Windows (ETW) file reader now supports displaying IP packets from an event trace logfile or an event trace live session."

Is there something I need to do use the file reader for my Event Tracing for Windows .etl capture files?

4.0 gives me "The file "NetTrace.etl isn't a capture file in a format Wireshark understands" when I try to load my .etl file.

The same file can be converted via etl2pcapng successfully.

Thanks

answered 2022-10-19 21:11:27 +0000

Chuckc
3023 ●6 ●608 ●20

updated 2022-10-19 21:13:29 +0000

5876: ETW: Extract IP packets from Windows event trace

There is documentation for adding extcap and man pages for them but probably should add something more user friendly to the WSUG.

Configuration is via the Wireshark welcome screen.

image description
Click on the gear next to the extcap name.

edit flag offensive delete link

Comments

Ahh I forgot to look for an option to download extra components (Tools > Etwdump) during installation.

Thanks!

Bushman ( 2022-10-19 21:58:13 +0000 )edit

Another item for the WSUG section on extcap. :-)

Chuckc ( 2022-10-19 22:14:16 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Event Tracing for Windows ETW file reader

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Event Tracing for Windows ETW file reader edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Event Tracing for Windows ETW file reader