CaptureSetup/ETW/SMB

Using Wireshark's etwdump, you can capture decrypted SMB client/server traffic on Windows by tapping into the ETW logs. Those logs are internal Windows traces that enable capturing traffic before SMB encryption.

Capture SMB Client traffic

0. You need Wireshark 4.7.3 or greater
1. Open wireshark as Administrator
2. Select etwdump in the interface list (if it doesn't appear, make sure you selected 'etwdump' during install)
3. Click on 'Add' to add a provider and select "SMB Client Payloads", then start the capture

Demo

Capture SMB Server traffic

0. You need Wireshark 4.7.3 or greater
1. Open wireshark as Administrator
2. Select etwdump in the interface list (if it doesn't appear, make sure you selected 'etwdump' during install)
3. Click on 'Add' to add a provider and select "SMB Server Payloads", then start the capture

See also

• Capture other ETW traces using etwdump