Primary Purpose:
etl2pcapng is a utility designed to convert .etl files, generated by Windows tools like pktmon and ndiscap, into the .pcapng format. This allows seamless viewing and analysis using Wireshark, addressing performance limitations of older methods such as WinPcap.
Key Features:
Conversion Support: Converts .etl files from pktmon and ndiscap into a compatible .pcapng format for Wireshark.
Interface Preservation: Maintains all components as pcapng interfaces with detailed descriptions, including IP addresses and MAC details.
Packet Correlation: Uses the PacketId option to link multiple packet appearances, aiding in comprehensive analysis.
Dropped Packet Indication: Marks packets dropped by the OS using the verdict option for clear visibility.
Additional Data Export: Includes trace provider messages as systemd journal exports for enhanced analysis.
Performance Enhancements: Offers significant speed improvements over previous versions.
Audience & Benefit:
Ideal for network engineers, developers, and IT professionals utilizing Wireshark on Windows. etl2pcapng streamlines packet capture analysis by eliminating the need for third-party tools, ensuring accurate and efficient data interpretation directly within Wireshark.
Installation:
Available via winget for easy setup.
This tool is essential for anyone seeking precise and streamlined network packet analysis on the Windows platform.
README
About
This tool enables you to view ndiscap and pktmon packet captures with Wireshark. Due to performance problems with the other popular packet capture method (WinPcap, which was included with older versions of Wireshark), these inbox tools should be preferred.
Windows has several inbox components capable of packet capture:
"pktmon" is implemented as an integral part of the Windows operating system. It's capable of capturing packets in many components of the operating system, giving full visibility into the life of the packet as it traverses the system. A capture can be collected with:
pktmon start --capture
pktmon stop
"ndiscap" which is implemented as an ETW trace provider. A capture can be collected with:
The files generated by these tools are etl files, which can be opened by ETW-centric tools like Microsoft Message Analyzer, but cannot be opened by Wireshark, which is the preferred tool for many engineers. Etl2pcapng.exe can convert the etl file to a pcapng file for opening with Wireshark, or for analysis with languages that have pcapng libraries available such as Python and Rust.
Note: pktmon has a built-in etl2pcap conversion utility ("pktmon etl2pcap ") which is also capable of producing basic pcapng files. etl2pcapng provides a similar conversion capability to the built-in utility with the following additions:
Preserving all used components as pcapng interfaces.
Providing additional information about each interface in the interface description block such as the Name, Description, IP address (IPv4 and IPv6), and MAC address when available.
Preserving pktmon pktgroupid on each packet for correlating multiple appearances of the same packet. This is stored in the PacketId option field of the enhanced packet block.
Marking packets dropped by the operating system in the verdict option field of the enhanced packet block.
Outputting additional trace provider messages as systemd journal export blocks.
After converting the file, the tool prints a table which shows mappings between Windows
interface indices and pcapng interface IDs.
The output pcapng file will have a comment on each packet indicating the PID
of the current process when the packet was logged. WARNING: this is frequently
not the same as the actual PID of the process which caused the packet to be
sent or to which the packet was delivered, since the packet capture provider
often runs in a DPC (which runs in an arbitrary process). The user should keep
this in mind when using the PID information.
The binary will be at build/Release/etl2pcapng.exe
History
1.12.0 - Add support for etl files generated by pktmon and writing of other provider events as systemd journal export blocks.
1.11.0 - Allows output filename to be omitted (e.g. "etl2pcapng.exe foo.etl". The output filename becomes "foo.pcapng").
1.10.0 - 10x faster.
1.9.0 - Adding support of Microsoft-Windows-Ras-NdisWanPacketCapture (VPN/RemoteAccess) events decoding + adding ThreadID (TID) to packet comments
1.8.0 - Adding RSS Hash value to packet comments for VMSwitch packets.
1.7.0 - Include VMSwitch packet info in packet comments.
1.6.0 - Enable ControlFlowGuard.
1.5.0 - Write iftype and ifindex into interface description blocks and statically link C runtime so vcredist doesn't need to be installed.
1.4.1 - Fix a bug leading to writing corrupt packets.
1.4.0 - Automatically infer original fragment length if captured fragments were truncated.
1.3.0 - Add a comment to each packet containing the process id (PID).
1.2.0 - Write direction info of each packet (epb_flags).
1.1.0 - Added support for multi-event packets found in traces from Win8 and older.
Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
When you submit a pull request, a CLA bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.