Microsoft-Windows-Ras-NdisWanPacketCapture

Event	Title	Channel	Sample	Rule
5001	Sending NDIS Wan Packet (FragmentSize bytes).	Diagnostic	N	N
5002	Reciving NDIS Wan Packet (FragmentSize bytes).	Diagnostic	N	N
5003	Event.	Diagnostic	N	N

Event ID 5001: Sending NDIS Wan Packet (FragmentSize bytes).

Sending NDIS Wan Packet (%3 bytes)

Name	Description
`RoutingDomainID` UnicodeString
`RRASUserName` UnicodeString
`FragmentSize` UInt32
`Fragment` Binary

Reciving NDIS Wan Packet (%3 bytes)

Name	Description
`RoutingDomainID` UnicodeString
`RRASUserName` UnicodeString
`FragmentSize` UInt32
`Fragment` Binary

Event: param1

Event: %1

Name	Description
`param1` UnicodeString

ETW provider GUID d84521f7-2235-4237-a7c0-14e3a9676286

Defined in ndiswan.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB