How do I convert the .etl file from netsh trace into a format that Wireshark can read?

The .etl file cannot be opened directly by Wireshark. Use Microsoft's free Windows Message Analyzer to open the .etl file, then export it as a .cap file via File > Save as > Export. Once you have the .cap file, you can open it with Wireshark to inspect the SMB2 packets containing NTLMv2 authentication data. You may also need to convert .cap to .pcap for programmatic analysis, as shown in the full article.