microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
607 stars 114 forks source link

Decoding VMSwitch-Packetfragment #45

Closed ViDou83 closed 2 years ago

ViDou83 commented 2 years ago

VMSwitch-PacketFragment event are generated ONLY when trace is started with capturetype=both option: netsh trace start capture=yes report=di capturetype=both

It means that decoding regular trace should not be impacted by this change.

ghost commented 2 years ago

CLA assistant check
All CLA requirements met.