Using Wireshark's etwdump, you can capture decrypted client LDAP traffic on Windows by tapping into the ETW logs. Those logs are available if the client uses wldap32.dll, which is used by all native tools.
Demo
1. Register the executable you want to debug
As documented by Microsoft in troubleshoot-ldap-using-etw, you first need to register the program you want to capture traffic for in the registry. Just create an empty key in the correct location.
The following example is to capture the LDAP traffic of ldp.exe:
2. Start the capture
- You need Wireshark 4.7.3 or greater
- Open wireshark as Administrator
- Select
etwdumpin the interface list (if it doesn't appear, make sure you selected 'etwdump' during install) - Click on 'Add' to add a provider and select "SASL LDAP pre-encryption", then start the capture
