etl2pcapng
Utility that converts an .etl file containing a Windows network packet capture into .pcapng format. (by microsoft)
npcap
Nmap Project's Windows packet capture and transmission library (by nmap)
| etl2pcapng | npcap | |
|---|---|---|
| 7 | 12 | |
| 584 | 2,843 | |
| 1.4% | 0.9% | |
| 3.1 | 7.8 | |
| about 2 months ago | about 1 month ago | |
| C | C | |
| MIT License | GNU General Public License v3.0 or later |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
etl2pcapng
Posts with mentions or reviews of etl2pcapng.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-05-24.
-
Windows server core, packet captured options? Wireshark etc
Copy the ETL file to a workstation, then use etl2pcapng converter from Microsoft. (https://github.com/microsoft/etl2pcapng)
-
IT Pro Tuesday #202 - Wireshark etl Tool, Security Podcast, EOL Database & More
etl2pcapng allows you to view ndiscap packet captures with Wireshark, thus overcoming the Windows use of etl files intended for ETW-centric tools like Microsoft Message Analyzer. NotAnExpert2020 explains, it "converts a netsh trace start/stop trace into something wireshark can read."
-
Share your greatest free tools
https://github.com/microsoft/etl2pcapng - etl2pcapng - converts a netsh trace start/stop trace into something wireshark can read.
- Wireshark Labs
-
sniffing a process?
netsh trace can do this out of the box. With the death of Message Analyzer, the easiest way to get packet data out of the ETL generated is this utility from MS: https://github.com/microsoft/etl2pcapng
-
Capturing network traffic on a PC
Going to say not wireshark. Use the built in native windows packet capture) and convert it to a pcapng for analysis within wireshark with etl2pcapng.
-
A stupid question regarding UDP traffic
If you have an older version of Windows Server that doesn't have pktmon on it you can also use the netsh method to capture to an ETL file. - Netsh trace start#start) - Now it used to be that I would convert the ETL file to .cap using Message Analyzer, but Microsoft has retired it and you can't download it anymore. In good news it appears that Microsoft has actually released a converter, https://github.com/microsoft/etl2pcapng, to do exactly this.
npcap
Posts with mentions or reviews of npcap.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-05-28.
-
GNS3 ethernet cloud error
Might be related to this: https://github.com/nmap/npcap/issues/628 https://gitlab.com/wireshark/wireshark/-/issues/18414
- Windows 10 Problems with Wlanhelper
- Lol! Developer got no chill!
- wireshark was working fine, then I had to nuke my PC , after reinstalling it I can't get anything. windows 11 on arm
- Npcap 1.70 released - faster interface listing, faster injection, Windows 11 support, and more
-
what is this?...
In and of itself it is safe and open source - https://github.com/nmap/npcap
-
nmap not working with wireguard?
This is a known issue with Npcap that we hope to fix in the next release: https://github.com/nmap/npcap/issues/173
-
New forum for discussing the Npcap Windows packet capturing/sending software
I just created this subreddit in case anyone wishes to discuss or ask questions about Npcap. Might as well reserve the name now!
-
"No such devices" when trying to use NMAP with VPN
Make sure you are using the latest version of Npcap from https://npcap.org/#download first. We are working on ways to support more device types, and VPNs are high on our priority list. Depending on the type of VPN it may not support layer-2 packets, which is what Nmap uses on Windows for most raw packet features.
What are some alternatives?
When comparing etl2pcapng and npcap you can also consider the following projects:
termshark - A terminal UI for tshark, inspired by Wireshark
Fribbels-Epic-7-Optimizer - A gear optimizer for the mobile game Epic 7
netmon_cli - A simple and lightweight terminal packet sniffer.
libpcap - the LIBpcap interface to various kernel packet capture mechanism
pyshark - Python wrapper for tshark, allowing python packet parsing using wireshark dissectors
Wireshark - Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. ⚠️ GitHub won't let us disable pull requests. ⚠️ THEY WILL BE IGNORED HERE ⚠️ Upload them at GitLab instead.
Visual Studio Code - Visual Studio Code
Divert - WinDivert: Windows Packet Divert
netsniff-ng - A Swiss army knife for your daily Linux network plumbing.
api - V2 - EpicSevenDB.com API for Website, Tools and Discord Bot
esp_wifi_repeater - A full functional WiFi Repeater (correctly: a WiFi NAT Router)
wireshark