netsh

Capture

netsh trace start capture=yes tracefile=C:\Users\Administrator\Documents\cap.etl

Stop

netsh trace stop

Convert to PCAP

• https://github.com/microsoft/etl2pcapng

etl2pcapng.exe in.etl out.pcapng