Cannot set cellular modem to promiscuous *or* non-promiscuous mode

asked 2021-06-14 20:25:25 +0000

This question seems quite related to this other question: https://ask.wireshark.org/question/21... .

I have a windows laptop with a cellular modem card installed. I'd like to sniff traffic on the interface. However, tshark/wireshark cannot set the mode of the device.

If I choose to place the device into promiscuous mode, I get an error that the adapter cannot be placed into promiscuous mode. If I change the sniffer options to NOT place the device in promiscuous mode, I get an error that the device cannot be set non-promiscuous mode.

These errors occur even if Wireshark/tshark are run with administrative rights on Windows. I guess whatever happens under the hood to set +promisc/-promisc on the hardware, simply isn't supported by any modern cellular modems. Which is fine because the connections are point-to-point anyway...

I suspect that some combo of *shark or npcap needs updating such that, if the device cannot have its mode set, either the user is prompted to accept that they may lose packets, or simply that the device does not support configuration of the mode (and continue to allow packet capture, would be ideal).

edit retag flag offensive close merge delete

Comments

What version of Npcap is on your machine? If it's older than 1.31, try going to the Npcap Web site, download the 1.31 installer, and run that to upgrade to 1.31.

If you do that, and the problem persists, or if 1.31 is what you have installed, what is the exact error message reported?

Guy Harris gravatar imageGuy Harris ( 2021-06-14 21:02:59 +0000 )edit

Thank you for the reply.

I have updated NPCap to 1.31. I am still unable to capture packets.

Error when I choose to leave the adapter in non-promiscuous mode:

The capture session could not be initiated on interface '\Device\NPF_{DE6064D3A-264F-46ED-ADF8-98BBAD35632F} (failed to set hardware filter to non-promiscuous mode: Couldn't get error message for error (3758096571)).

Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe selected.

Error when I choose to set the adapter to promiscuous mode:

The capture session could not be initiated on interface '\Device\NPF_{DE6064D3A-264F-46ED-ADF8-98BBAD35632F} (failed to set hardware filter to promiscuous mode: Couldn't get error message for error (3758096571)).

Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe selected.

This occurs even when I run Wireshark with elevated/Admin privileges, as well as when ...(more)

reidmefirst gravatar imagereidmefirst ( 2021-06-14 21:36:04 +0000 )edit