CaptureSetup/ETW

By using ETW logs (with etwdump), Wireshark can capture various debugging traces from Windows. Those scenarios are inspired by the (now defunct) "Microsoft Message Analyzer".

Those traces are very useful for debugging Windows Machines.

See also

• Capture decrypted HTTPS traffic on Windows
• Capture decrypted LDAP traffic on Windows
• Capture decrypted SMB traffic on Windows
• Bluetooth capture setup