Wireshark · Wireshark-users: [Wireshark-users] Question regarding cap export from netsh etl using message analyzer

[Ran Shenhar <ran.shenhar@xxxxxxxxx>]

I have a Win machine I can't install Wireshark on.

So I figured I'd use "netsh trace start capture=yes Ethernet.Type=IPv4 traceFile=d:\ip.trace2.etl maxsize=20" to capture, then follow http://blogs.technet.com/b/yongrhee/archive/2013/08/16/so-you-want-to-use-wireshark-to-read-the-netsh-trace-output-etl.aspx to export and read in Wireshark.

The problem is that the exported file opens up with all packets marked as TZSP and malformed.

Is there a better way to doing that? Other tools to convert etl to pcap?

Thanks,