Ask Your Question

Revision history [back]

Wireshark installs a capture library (currently npcap, previously WinPcap) to perform the capture and this inserts itself into the network stack as an "NDIS filter driver". This driver will also enable promiscuous mode on the NIC when requested by the user setting the flag in the Wireshark capture dialog, it's possible that this might be causing the effect you see.

You could try NOT enabling promiscuous mode to see if that helps, if not, then this is another example of why performing on-machine captures should be a last resort due to the potential of introducing unexpected effects to the machine's networking stack.

As the issue is almost certainly caused by the capture library, and presuming you are using a recent version of Wireshark (3.x onwards) you should contact the npcap maintainers, nmap, for support. There is no support for WinPcap.