Windows 10: saddr and daddr of ETW event trace TcpIpRecvIPv4 and UdpIpRecvIPv4

Using Wireshark, we observe either sending a packet with saddr = my machine, or receiving a packet with daddr = my machine. But in ETW event TcpIpRecvIPv4 and UdpIpRecvIPv4, we often found saddr and daddr appears in the opposite way.

:)

 

ETW Event Tracing

Is it possible to consume ETW events in device drivers (kernel mode)?

 

ETW

I, too, am having difficulty capturing ETW events within a container. The listening process is running inside the container where the ETW events should be getting generated.

 

ETW

Is it possible to monitor processes running inside a docker windows container with ETW? I've tried to run it using logman, and using providers that log events perfectly outside of a container result in an empty log when run inside a container (even when
run with --isolation=hyperv).

Any help would be much appreciated.