Utilities Windows
etl2pcapng
Convert Windows ndiscap ETL network captures to PCAPNG files for Wireshark with Microsoft’s free, open-source command-line utility.
Version 1.11.0 · Direct publisher file
Link checked · Download guidance
What is etl2pcapng?
etl2pcapng converts network packets from Windows ETL traces into PCAPNG files that Wireshark can open. It is useful when you already have an ndiscap capture collected with netsh trace and want to inspect the packets without relying on Microsoft Message Analyzer. Microsoft also documents moving the captured ETL file to a separate tools machine for conversion.
Run etl2pcapng.exe in.etl out.pcapng from a command prompt. Version 1.11.0 also accepts just the input filename and gives the output the same name with a .pcapng extension. After conversion, the tool prints a mapping between Windows interface indices and PCAPNG interface IDs. The download here is the executable attached to Microsoft’s v1.11.0 release.
Treat the packet PID comments as context, not reliable application attribution: the documented PID can belong to whichever process was active when the capture provider logged the packet. Also distinguish this release from newer source documentation: the 1.11.0 release warns that it is not made for pktmon captures. The screenshot is Microsoft’s historical conversion example, not a test of this download.
What it offers
- Convert ndiscap ETL packet captures into PCAPNG for Wireshark.
- Specify input and output filenames in the command line, or omit the output name in version 1.11.0.
- Print Windows interface-index to PCAPNG interface-ID mappings after conversion.
- Include packet comments with the process ID observed when packets were logged.
Good to know
- Packet PID comments frequently do not identify the process that actually sent or received the traffic.
- The v1.11.0 release warns that it is not made for pktmon captures; newer main-branch documentation must not be treated as a feature list for this executable.
- This is a command-line conversion utility, not a graphical packet analyzer.
Product images
Sources
References used for this listing. Retrieval dates do not indicate hands-on testing.
- etl2pcapng v1.11.0 — official version-specific README ↗Retrieved
- etl2pcapng — official v1.11.0 release ↗Retrieved
- etl2pcapng v1.11.0 — official release assets ↗Retrieved
- etl2pcapng — MIT license ↗Retrieved
- etl2pcapng - Download ↗Retrieved
- Converting ETL Files to PCAP Files | Microsoft Community Hub ↗Retrieved
More in utilities
View category ↗
1.1.1.1 with WARP 2026.8.2115.0
Encrypt traffic from your Mac to Cloudflare’s network with WARP, or use DNS-only mode for encrypted DNS queries to the 1.1.1.1 resolver.
1.1.1.1 with WARP 2026.8.2115.0
Encrypt traffic between your Windows PC and Cloudflare, or use encrypted DNS only, with the free 1.1.1.1 with WARP app.
3uTools 9.12.005
Manage iPhone and iPad photos, music, apps and backups from Windows with 3uTools, a free utility that also includes device checks and firmware flashing tools.