Hi there !
I've installed the pcap "Win10pcap" http://www.win10pcap.org/ Now I can see the vlan-taggings with the vlan-ids. :)
It seems to be working well. But: Is it a good idea to change the pcap? Is it possible to install both pcaps (npcap and Win10pcap, third may be Winpcap for other tools) and then activate or choose one of them in wireshark?
In a word no.
Win10pcap is abandonware and hasn't been updated in 4 years.
npcap is actively supported by the nmap team, is distributed with the current releases of Wireshark for Windows and can be installed in npcap mode or in a WinPcap compatibility mode.
WinPcap still works as well as it ever did, even on Windows 10, but is unsupported.
Recent versions of Wireshark (2.6 or greater I think) will use npcap if it's found, else will fall back to any WinPcap compatible driver.
I would recommend using npcap in npcap mode. If there's something that it doesn't do, then contact the nmap team with an enhancement request.
From the Npcap Users' Guide:
/vlan_support (deprecated, ignored)
Support 802.1Q VLAN tag when capturing and sending data (currently unsupported). This feature was disabled in 2016 to prevent a crash and has not been re-enabled.
@grahamb's suggestion of contacting the nmap team is a good one. You could also just open an issue asking for this feature to be added again on the Npcap issue tracker.
Asked: 2019-08-06 09:51:22 +0000
Seen: 1,515 times
Last updated: Aug 06 '19
