# how to kill dumpcap.exe

i noticed if i select multiple trace files in windows explorer, there is a 90% chance that Wireshark will hang while loading.

i can kill the wireshark.exe process but not the dumpcap.exe process.

i tried doing it from the an elevated/admin command prompt and the taskkill command as well as a bunch of other utilitlies with no luck.

In one of the forums someone suggested renaming the exe file and/or filder and that didnt work either.

my computer wont even even restart or shutdown properly and i have to hold the power button down to force a shutdown.

i am using Windows 8.1 and Wireshark 2.4.3

edit retag close merge delete

So taskkill doesn't work? How about just Task Manager? Edit: Was taskkill run as an administrator?

( 2018-01-08 05:02:49 +0000 )edit

I've experienced this as well on client's PC running Windows 10 and Wireshark 2.4.3. Client also had to force shutdown the PC to kill all of the "Dumpcap.exe" processes.

( 2018-01-08 06:18:30 +0000 )edit

nope taskkill doesnt work. i also tried various utilities from nirsoft and sysinternals.

( 2018-01-08 16:52:54 +0000 )edit

funny spoke to quite a few people who told me they have the same issue but never reported or pursued a solution to it.

FYI.. rebooting is not the answer..

( 2018-01-09 18:54:01 +0000 )edit

Well, has anyone ever reported a bug for this? I could have missed it, but I only see the somewhat related Bug 1419, but while dumpcap may continue to run in that case, there's no report of the inability to kill it.

It's hard for developers to fix something if they're not even made aware of the problem, so if others have experienced this but not reported it, then they have to at least partially blame themselves for it not being fixed. And since Wireshark is open source, anyone can submit a fix. In this case, if the problem can't be reproduced by one of the developers, then it may very well take someone who can reproduce it to fix it. Either way, it should be reported as a bug so it can be tracked. (If it has been reported or will be reported, then please ...(more)

( 2018-01-09 19:12:10 +0000 )edit