etl2pcapng
netmon_cli
Our great sponsors
| etl2pcapng | netmon_cli | |
|---|---|---|
| 7 | 3 | |
| 584 | 9 | |
| 3.3% | - | |
| 3.1 | 0.0 | |
| about 2 months ago | over 3 years ago | |
| C | C | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
etl2pcapng
-
Windows server core, packet captured options? Wireshark etc
Copy the ETL file to a workstation, then use etl2pcapng converter from Microsoft. (https://github.com/microsoft/etl2pcapng)
-
IT Pro Tuesday #202 - Wireshark etl Tool, Security Podcast, EOL Database & More
etl2pcapng allows you to view ndiscap packet captures with Wireshark, thus overcoming the Windows use of etl files intended for ETW-centric tools like Microsoft Message Analyzer. NotAnExpert2020 explains, it "converts a netsh trace start/stop trace into something wireshark can read."
-
Share your greatest free tools
https://github.com/microsoft/etl2pcapng - etl2pcapng - converts a netsh trace start/stop trace into something wireshark can read.
- Wireshark Labs
-
sniffing a process?
netsh trace can do this out of the box. With the death of Message Analyzer, the easiest way to get packet data out of the ETL generated is this utility from MS: https://github.com/microsoft/etl2pcapng
-
Capturing network traffic on a PC
Going to say not wireshark. Use the built in native windows packet capture) and convert it to a pcapng for analysis within wireshark with etl2pcapng.
-
A stupid question regarding UDP traffic
If you have an older version of Windows Server that doesn't have pktmon on it you can also use the netsh method to capture to an ETL file. - Netsh trace start#start) - Now it used to be that I would convert the ETL file to .cap using Message Analyzer, but Microsoft has retired it and you can't download it anymore. In good news it appears that Microsoft has actually released a converter, https://github.com/microsoft/etl2pcapng, to do exactly this.
netmon_cli
What are some alternatives?
termshark - A terminal UI for tshark, inspired by Wireshark
GameNetworkingResources - A Curated List of Multiplayer Game Network Programming Resources
pyshark - Python wrapper for tshark, allowing python packet parsing using wireshark dissectors
dte - A small, configurable console text editor (mirrored from https://gitlab.com/craigbarnes/dte)
Visual Studio Code - Visual Studio Code
netsniff-ng - A Swiss army knife for your daily Linux network plumbing.
esp_wifi_repeater - A full functional WiFi Repeater (correctly: a WiFi NAT Router)
npcap - Nmap Project's Windows packet capture and transmission library
Wireshark - Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. ⚠️ GitHub won't let us disable pull requests. ⚠️ THEY WILL BE IGNORED HERE ⚠️ Upload them at GitLab instead.
scrcpy - Display and control your Android device
AutoHotkey - AutoHotkey - macro-creation and automation-oriented scripting utility for Windows.
sublime_text - Issue tracker for Sublime Text