Open .ETL Files with NetworkMiner and CapLoader
Windows event tracing .etl files can now be read by NetworkMiner and
CapLoader without having to first convert them to .pcap or .pcapng.
The ETL support is included in NetworkMiner 2.7.2 and CapLoader 1.9.3, which were both released this morning.
What is an ETL Trace File?
ETL is short for Event Trace Log, which is
ETW session data that has been logged to a file.
You can, for example, extract EVTX logs from ETL files.
But in this blog post we’re gonna focus on network traffic that has been captured to an ETL file with a command like:
…wait while packets are being captured…
Pro-tip: You can specify a capture NIC explicitly with “CaptureInterface=<GUID>”
NetworkMiner and CapLoader can also read packets in Pktmon ETL files, which actually are different from those created with netsh.
Capturing packets to an ETL file with Pktmon is very simple:
…wait while packets are being captured…
Pro-tip: You can specify capture filters with “pktmon filter add”
You can also capture packets to ETL files with PowerShell:
Add-NetEventPacketCaptureProvider
Start-NetEventSession -Name sniffer
…wait while packets are being captured…
Remove-NetEventSession -Name sniffer
Pro-tip: You capture packets on a remote PC by specifying a CimSession
Advantages
The built-in support for ETL files in NetworkMiner and CapLoader makes it easy to work with ETL files.
Not only will you no longer need to go through the extra step of converting the ETL file to PCAP using
etl2pcapng or Microsoft Message Analyzer (which was retired in 2019),
the analysis will also be faster because both CapLoader and NetworkMiner read ETL files faster compared to etl2pcapng and MMA.
Limitations
The primary limitation with NetworkMiner and CapLoader’s ETL support is that it only works in Windows.
This means that you will not be able to open ETL files when running
NetworkMiner in Linux or
macOS.
Another limitation is that both NetworkMiner and CapLoader might fail to parse logged packets if the event trace
was created on an OS version with an event manifest
that is incompatible with the OS version on which the ETL file is opened.
Under the Hood
Both NetworkMiner and CapLoader leverage Windows specific API calls to read packets from ETL files.
An ETL file opened in CapLoader first get converted to PcapNG, then CapLoader parses that PcapNG file.
NetworkMiner, on the other hand, parses the packets in the ETL file directly to extract artifacts like files, images and parameters.
NetworkMiner’s approach is both simpler and quicker, but by converting the ETL file to PcapNG CapLoader can utilize its
packet indexing feature to rapidly extract any subset of the captured traffic upon request by the user.
CapLoader’s approach is also useful for users who are wondering how to open ETL files in Wireshark,
since the packets from an ETL file can be opened in Wireshark by dragging the PcapNG file from the CapLoader GUI onto Wireshark.
Image: NetTrace.etl converted to PcapNG in CapLoader can be drag-and-dropped onto Wireshark.
Additional Updates in NetworkMiner
The ETL support is not the only new feature in NetworkMiner 2.7.2 though.
We have also added support for the ERSPAN protocol.
The FTP parser has also been improved to support additional commands, such as AUTH (RFC2228).
We’ve also added a useful little feature to the context menu of the Parameter’s tab,
which allows users to send extracted parameters to CyberChef (on gchq.github.io) for decoding.
Image: Right-clicking a parameter brings up a context menu with “Submit to CyberChef” option.
Additional Updates in CapLoader
The only major improvement in CapLoader 1.9.3, apart from the built-in ETL-to-PcapNG converter,
is that the protocol identification speed and precision has been improved.
We’ve also separated the identification of SSL (version 2.0 to 3.0) and TLS (SSL 3.1 and later) as two separate protocols in this version,
whereas they previously both were fingerprinted as “SSL”.
Credits
We’d like to thank Dick Svensson and
Glenn Larsson for their input on reading ETL files.
We also want to thank Markus Schewe for recommending us to add ERSPAN support to NetworkMiner!
Share on Facebook 
Tweet 
Submit to reddit.com
*** This is a Security Bloggers Network syndicated blog from NETRESEC Network Security Blog authored by Erik Hjelmvik. Read the original post at: https://www.netresec.com/?page=Blog&month=2021-11&post=Open--ETL-Files-with-NetworkMiner-and-CapLoader