Revision history  [back]

I think this is a bug. You could open a Gitlab Issue asking that it be looked into. (please add a link back to this question if you do)

For testing, opening a non-IP file (small-system-misc-ping.etl (MS ETL) Various events, ping and browser packets.) from Wiki samples with etwdump allows the field to be set.

For an IP capture, disable the ethernet protocol and see Destination column updated by Lua.