Convert ETL to PCAP

Posted Under: Pktmon, Shell, Tutorials, Windows on Dec 15, 2020
Convert ETL to PCAP
Windows Trace command and Pktmon produce there output in Event Trace Log (ETL) format. ETL is Microsoft propitiatory format and mostly incompatible with other popular and widely accepted and standardized packet capture formats like PCAP and PCAPNG. On Windows 10 Microsoft provides a utility Pktmon that convert ETL file to Wireshark's latest format PCAPNG. Following command on an elevated command prompt will do the job.

pktmon pcapng C:\Path\To\Capture.etl -o C:\Path\To\Capture.pcapng
Specify the input etl file and output pcapng file.

Pktmon etl to pcap