No interface found (Windows 10 Build 1903)

asked 2019-10-01 12:25:15 +0000

zulroxx
1 ●1 ●1 ●1

updated 2019-10-01 13:47:01 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

image description

Version 3.0.5 (v3.0.5-0-g752a55954770) 
Copyright 1998-2019 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 

Compiled (64-bit) with Qt 5.12.5, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with LZ4, with Snappy, with libxml2 2.9.9, with QtMultimedia, with AirPcap, with SBC, with SpanDSP, with bcg729. 

Running on 64-bit Windows 10 (1903), build 18362, with AMD Ryzen 3 2200U with Radeon Vega Mobile Gfx (with SSE4.2), with 7068 MB of physical memory, with locale English_United States.1252, with Npcap version 0.9983, based on libpcap version 1.9.1-PRE-GIT, with GnuTLS 3.6.3, with Gcrypt 1.8.3, without AirPcap, binary plugins supported (14 loaded). Built using Microsoft Visual Studio 2017 (VC++ 14.16, build 27034). 
Wireshark is Open Source Software released under the GNU General Public License. 
Check the man page and https://www.wireshark.org for more information.

Trying install npcap after installing wireshark installing winpcap (not using npcap) run as administration using win10pcap (not using nopcap or winpcap) re-installing wireshark

after remove winpcap and installing winpcap again, "sc query npf" > The specified service does not exist as an installed service.

make zero grades in college, very upset X(

edit retag flag offensive close merge delete

Comments

There have been a few reports of this, but unfortunately no resolution has been found. Normally I would suggest this is an npcap problem, but as you're tried various capture libraries to no avail it would seem that the issue is specific to your machine environment.

I would ensure you have uninstalled all of npcap, WinPcap and win10pcap, reboot, install npcap and if there's still a problem work with the npcap maintainers to resolve the issue. Please report back here if you do find a solution for the benefit of others.

grahamb ( 2019-10-01 13:50:53 +0000 )edit

Does this happen with both Admin and non-Admin users?

wbenton ( 2019-10-02 01:58:25 +0000 )edit

I'm having the exact same problem. The only difference is that USBPcap is working fine with both local and admin. Even did the sc query npf with the same results.

Version 3.0.5 (v3.0.5-0-g752a55954770)

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 

Compiled (64-bit) with Qt 5.12.5, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 ...

(more)

MacCrivens ( 2019-10-13 20:01:07 +0000 )edit

Observation #1, never run Wireshark as an admin. There are millions of lines of unaudited code and exposing them to random internet traffic is a potential risk.

Observation #2, USB capture uses USBPcap, a different capture library than npcap used for most other interfaces.

Observation #3, the sc query npf command is only for use with WinPcap, or npcap when installed in WinPcap compatibility mode.

Observation #4, the npcap folks have a very slightly newer version (currently 0.9983) over that their website, please uninstall your current version, reboot and install the newer one.

The npcap developers have provided a diagnostic report capability (usually C:\Program Files\npcap\DiagReport.bat, or .ps1), please run that from an elevated prompt and post the contents of the report back here.

grahamb ( 2019-10-13 20:15:42 +0000 )edit

File Info:

    Directory: C:\Program Files\Npcap


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----        4/30/2019  12:59 PM            862 CheckStatus.bat                                                       
-a----       10/14/2019   2:26 AM              0 DiagReport-20191014-022618.txt                                        
-a----       11/29/2016   4:43 PM           1034 DiagReport.bat                                                        
-a----        12/5/2018  12:12 AM           8908 DiagReport.ps1                                                        
-a----         9/4/2019   2:14 PM           2959 FixInstall.bat                                                        
-a----       10/14/2019   1:33 AM         184310 install.log                                                           
-a----        6/10/2019   1:58 PM          10087 LICENSE                                                               
-a----       10/14/2019   1:33 AM              1 loopback.ini                                                          
-a----        8/30/2019  10:55 AM          10871 npcap.cat                                                             
-a----        8/30/2019  10:55 AM           8656 npcap.inf                                                             
-a----        8/30/2019  10:55 AM          78648 npcap.sys                                                             
-a----        8/28/2019   4:25 PM           2403 npcap_wfp.inf                                                         
-a----         9/4/2019   3:24 PM         270648 NPFInstall.exe                                                        
-a----       10/14/2019   1:33 AM         521351 NPFInstall.log ...

(more)

MacCrivens ( 2019-10-14 07:36:33 +0000 )edit

see more comments

2 Answers

Sort by » oldest newest most voted

answered 2019-10-25 15:02:24 +0000

GTrek
1

OK, this is an installation issue. If you Install NPCAP first on it's own it registers and runs as a service. Then install Wireshark without NPCAP and the installation removes the NPCAP service and nothing will work.

Uninstall everything, install wireshark without NPCAP. Then download NPCAP and install it. Now wireshark works.

I'm installing this on Windows 10, version 1903, 64bit

edit flag offensive delete link

Comments

If only it was that easy. There is something disrupting the service on some machines and re-installs of npcap don't help, or don't persist over a reboot. I've never been so "unlucky", it just works for me.

Just now, on one machine I uninstalled Wireshark, which offered to uninstall npcap which I chose to do, rebooted, installed Wireshark 3.0.6, allowed it to install npcap, and everything came up fine. This is on a 4 year old system that has lots of odd things installed on it, so potential for mishap is high.

grahamb ( 2019-10-25 15:35:04 +0000 )edit

Installing in this suggested order worked for me after trying many other things. Of note, when I installed npcap I unchecked compatibility mode.

schester ( 2020-01-28 16:36:44 +0000 )edit

The procedure noted by @schester worked for me too. Previously, trying to start the npcap service had given the error "[SC] StartService FAILED 577: Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source."

rupert ( 2021-01-27 14:10:20 +0000 )edit

The ncpap binaries are signed by the nmap signing certificate (Insecure.com LLC), so the reported error is odd unless somehow the binaries installed have been modified. Wireshark bundles a locally cached copy of the ncap installer into its installer and doesn't modify it in any way.

You should consider reporting your issue (especially the signature failure) to the npcap folks who are in a position to investigate.

grahamb ( 2021-01-27 15:20:16 +0000 )edit

add a comment

answered 2019-10-14 14:22:28 +0000

grahamb

23835 ●4 ●976 ●227 https://www.wireshark.org

One thing I did note from your abbreviated output is that the npcap driver isn't running:

*************************************************
Service Info:
*************************************************

Status      : Stopped
Name        : npcap
DisplayName : Npcap Packet Driver (NPCAP)

I don't know how this has come about, but you can try starting the service from an elevated cmd prompt with net start npcap. You might also need to start the Base Filtering engine (bfe) with net start bfe.

The npcap installation directory also provides a helper batch file FixInstall.bat that attempts to fix up the services state along with a few other things. This should also be run from an elevated cmd prompt.

edit flag offensive delete link

Comments

Kind of running in circles at this point...

C:\Windows\system32>net start npcap System error 2 has occurred.

The system cannot find the file specified.

MacCrivens ( 2019-10-14 19:42:34 +0000 )edit

add a comment