1ETWDUMP(1) ETWDUMP(1)
2
3
4
6 etwdump - Provide an interface to read ETW
7
9 etwdump [ --help ] [ --version ] [ --extcap-interfaces ]
10 [ --extcap-dlts ] [ --extcap-interface=<interface> ]
11 [ --extcap-config ] [ --capture ] [ --fifo=<path to file or pipe> ]
12 [ --iue=<Should undecidable events be included> ]
13 [ --etlfile=<etl file> ] [ --params=<filter parameters> ]
14
16 etwdump is a extcap tool that provides access to a etl file. It is only
17 used to display event trace on Windows.
18
20 --help
21
22 Print program arguments.
23
24 --version
25
26 Print program version.
27
28 --extcap-interfaces
29
30 List available interfaces.
31
32 --extcap-interface=<interface>
33
34 Use specified interfaces.
35
36 --extcap-dlts
37
38 List DLTs of specified interface.
39
40 --extcap-config
41
42 List configuration options of specified interface.
43
44 --capture
45
46 Start capturing from specified interface save saved it in place
47 specified by --fifo.
48
49 --fifo=<path to file or pipe>
50
51 Save captured packet to file or send it through pipe.
52
53 --iue=<Should undecidable events be included>
54
55 Choose if the undecidable event is included.
56
57 --etlfile=<Etl file>
58
59 Select etl file to display in Wireshark.
60
61 --params=<filter parameters>
62
63 Input providers, keyword and level filters for the etl file and
64 live session.
65
67 To see program arguments:
68
69 etwdump --help
70
71 To see program version:
72
73 etwdump --version
74
75 To see interfaces:
76
77 etwdump --extcap-interfaces
78
79 Example output
80
81 interface {value=etwdump}{display=ETW reader}
82
83 To see interface DLTs:
84
85 etwdump --extcap-interface=etwdump --extcap-dlts
86
87 Example output
88
89 dlt {number=1}{name=etwdump}{display=DLT_ETW}
90
91 To see interface configuration options:
92
93 etwdump --extcap-interface=etwdump --extcap-config
94
95 Example output
96
97 arg {number=0}{call=--etlfile}{display=etl file}{type=fileselect}{tooltip=Select etl file to display in Wireshark}{group=Capture}
98 arg {number=1}{call=--params}{display=filter parmeters}{type=string}{tooltip=Input providers, keyword and level filters for the etl file and live session}{group=Capture}
99 arg {number=2}{call=--iue}{display=Should undecidable events be included}{type=boolflag}{default=false}{tooltip=Choose if the undecidable event is included}{group=Capture}
100
101 To capture:
102
103 etwdump --extcap-interface etwdump --fifo=/tmp/etw.pcapng --capture --params "--p=Microsoft-Windows-Wmbclass-Opn --p=Microsoft-Windows-wmbclass --k=0xff --l=4"
104
105 Note
106 To stop capturing CTRL+C/kill/terminate application.
107
109 wireshark(1), tshark(1), dumpcap(1), extcap(4)
110
112 etwdump is part of the Wireshark distribution. The latest version of
113 Wireshark can be found at https://www.wireshark.org.
114
115 HTML versions of the Wireshark project man pages are available at
116 https://www.wireshark.org/docs/man-pages.
117
119 Original Author
120 Odysseus Yang L
121 wiresharkyyh@outlook.com
122
123
124
125 2022-02-16 ETWDUMP(1)