ETWDUMP(1)

💅 ETWDUMP — like, the etwdump manual page, bestie ✨

okay so this is the etwdump(1) page from the Wireshark fam 🫶 — it's a whole extcap tool situation and we're gonna get through it together, no cap.

🌸 NAME 🌸

etwdump — lowkey provides an interface to read Event Tracing for Windows (aka ETW), and yes it's giving main character energy.

✨ SYNOPSIS ✨

etwdump [ --help ] [ --version ] [ --extcap-interfaces ]
[ --extcap-dlts ] [ --extcap-interface=<interface> ] [ --extcap-config ]
[ --capture ] [ --fifo=<path to file or pipe> ]
[ --iue=<Should undecidable events be included> ]
[ --etlfile=<etl file> ] [ --params=<filter parameters> ]

like, that's the whole vibe check right there ⬆️

🦋 DESCRIPTION 🦋

So etwdump is an extcap tool, and what it does is give you access to an event trace log file or an event trace live session — whichever you're feeling tbh. Its whole moment is displaying event traces on Windows, and those traces include readable text messages plus different protocols (think MBIM and IP packets, iykyk). Obsessed honestly.

🎀 OPTIONS 🎀

• --help — prints the program arguments. that's it, that's the whole thing 💫
• --version — prints the program version. so you know what you're working with, ngl.
• --extcap-interfaces — lists the available interfaces. window shopping fr 🛍️
• --extcap-interface=<interface> — uses the interface you specified. pick your fave ✨
• --extcap-dlts — lists the DLTs of the specified interface. very demure, very informational.
• --extcap-config — lists the configuration options of the specified interface. settings reveal 💅
• --capture — starts capturing from the specified interface and saves it in the place specified by --fifo. it's giving go time 🔥
• --fifo=<path to file or pipe> — saves the captured packet to a file, or sends it through a pipe. your choice, bestie 🫶
• --iue=<Should undecidable events be included> — chooses whether the undecidable event gets included. the undecidable ones are literally the drama queens of events 💀
• --etlfile=<Etl file> — selects the etl file to display in Wireshark. 🧚
• --params=<filter parameters> — inputs providers, keyword and level filters for the etl file and for the live session. the glow-up filter of it all 🌈

🌟 EXAMPLES 🌟

to see program arguments:

etwdump --help

to see program version:

etwdump --version

to see interfaces:

etwdump --extcap-interfaces

example output 👇

interface {value=etwdump}{display=ETW reader}

to see interface DLTs:

etwdump --extcap-interface=etwdump --extcap-dlts

example output 👇

dlt {number=1}{name=etwdump}{display=DLT_ETW}

to see interface configuration options:

etwdump --extcap-interface=etwdump --extcap-config

example output 👇

arg {number=0}{call=--etlfile}{display=etl file}{type=fileselect}{tooltip=Select etl file to display in Wireshark}{group=Capture}
arg {number=1}{call=--params}{display=filter parameters}{type=string}{tooltip=Input providers, keyword and level filters for the etl file and live session}{group=Capture}
arg {number=2}{call=--iue}{display=Should undecidable events be included}{type=boolflag}{default=false}{tooltip=Choose if the undecidable event is included}{group=Capture}

to capture:

etwdump --extcap-interface etwdump --fifo=/tmp/etw.pcapng --capture --params "--p=Microsoft-Windows-Wmbclass-Opn --p=Microsoft-Windows-wmbclass --k=0xff --l=4"
etwdump --extcap-interface etwdump --fifo=/tmp/etw.pcapng --capture --params "--p=Microsoft-Windows-Wmbclass-Opn --p=Microsoft-Windows-NDIS-PacketCapture"

note 🚨 — to stop capturing, CTRL+C/kill/terminate the application. it will not stop on its own, bestie, you gotta do it yourself 💀

🧚 SEE ALSO 🧚

wireshark(1), tshark(1), dumpcap(1), extcap(4) — go read those too, they're iconic 👑

💜 NOTES 💜

etwdump is part of the Wireshark distribution. The latest version of Wireshark can be found at https://www.wireshark.org.

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages.

🍓 AUTHORS 🍓

Original Author Odysseus Yang wiresharkyyh@outlook.com

---

and that's a wrap, babe 💖 this page is dated 2026-05-24 and it's the ETWDUMP(1) manual page, living happily inside the Wireshark distribution — mwah, slay, periodt ✨🎀🦋