How to consume real-time ETW events from the Microsoft-Windows-NDIS-PacketCapture provider?

Question

The larger question is how to consume real-time ETW network stack events in general but I\'m particularly interested in the Microsoft-Windows-NDIS-PacketCapture provider

Answer 1

For what it's worth, I did find one example of a real-time ETW consumer (the example is for IIS web server): http://blogs.iis.net/eokim/archive/2009/05/15/consume-iis-etw-tracing.aspx