Winshark - Wireshark plugin to work with Event Tracing for Windows

February 10, 2022

Wireshark plugin to work with Event Tracing for Windows

Microsoft Message Analyzer is being retired and its download packages were removed from sites on November 25, 2019. Wireshark has built a huge library of network protocol dissectors. The best tool for Windows would be one that can gather and mix all types of logs...

Welcome Winshark!!!

Winshark is based on a libpcap backend to capture ETW (Event tracing for Windows), and a generator that will produce all dissectors for known ETW providers on your machine. We've added Tracelogging support to cover almost all log techniques on the Windows Operating System.

With Winshark and the power of Windows, we can now capture Network and Event Logs in the same tool. Windows exposes a lot of ETW providers, in particular one for network capture ;-) No more need for an external NDIS driver.

This is a huge improvement in terms of use:

  • Enable to mix all kind of events (system and network)
  • Enable to use of Wireshark filtering on event log
  • Enable to track network and system logs by Process ID!!!
  • Enable to capture Windows log and network trace into a unique pcap file!!!
  • Capture NamedPipe through NpEtw file system filter driver

If you want to:

Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Oldest Most Voted
Inline Feedbacks
View all comments
2 years ago

disector not found, how to fix it please?


Ryan Cuthbertson
Ryan Cuthbertson
3 years ago

Where you mention tracert as a well known ETW consumer, should that instead be tracerpt?

3 years ago

really thanks for that

3 years ago

This is very useful, thanks!

© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023
What certifications or qualifications do you hold?
Max. file size: 150 MB.

What level of experience should the ideal candidate have?
What certifications or qualifications are preferred?

Download Free eBook

Step 1 of 4


We’re committed to your privacy. Hakin9 uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.