Win10Pcap and Panda USB PAU06

asked 2019-10-12 03:41:37 +0000

So I had to reinstall Windows 10 on my laptop, and proceeded to break a working wifi monitoring setup. It's a Lenovo laptop running Win 10 1809. I've reinstalled the latest drivers from Panda for the wifi adapter. I also uninstalled VMWare as it added several virtual network adapters and a bridge that I thought may be causing problems. Anyhow, I tried various versions and combinations of usbpcap, npcap, and win10pcap. I now have USBPcap 1.5.3.0 and Win10Pcap 10.2.5002 installed, and nmap 7.80 seems to be working just fine. However, when I open Wireshark, only my BT and Ethernet connections are showing. No wifi.

My guess here is that monitor mode must be working on the usb wifi adapter since I can see open ports and IPs in nmap/Zenmap, but for some reason it's not being seen by Wireshark (3.0.5 if it matters). I've tried some ideas that a Google search provided, opening a web page to pass traffic, then refreshing interfaces, etc but still no joy. Any ideas on what to look at next? I'd be happy to provide any logs or config file information if needed. If there is anything I can send to the devs, please let me know the address and what to send.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-10-15 09:30:06 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

The interesting part of the report is:

*************************************************
Service Info:
*************************************************

Status      : Stopped
Name        : npcap
DisplayName : Npcap Packet Driver (NPCAP)

This shows the npcap service is installed but not running.

From an elevated prompt you can run FixInstall.bat from the npcap directory that attempts to fix the install.

edit flag offensive delete link

Comments

Thanks for the help. Not sure what the issue was with that service, but I updated Windows and rebooted a few times, started the service manually, and Wireshark is seeing all my interfaces now. :)

jgraves16387 ( 2019-10-15 15:16:21 +0000 )edit

add a comment

answered 2019-10-12 07:41:04 +0000

Guy Harris
19890 ●3 ●659 ●207

From a look at the code, Win10Pcap doesn't appear to support monitor mode at all.

Try Npcap instead. That's what the Wireshark 3.0.x installers do on Windows. Remove Win10Pcap first.

edit flag offensive delete link

Comments

Also note that Win10Pcap has never been recommended for use with Wireshark and is essentially abandonware having not had any updates at all for over 4 years.

grahamb ( 2019-10-12 09:29:05 +0000 )edit

Still no luck. I uninstalled Win10Pcap, have reinstalled Wireshark and Npcap 0.9983. I also disconnected my usb wifi adapter, and with only onboard wifi, no interfaces besides 'Adapter for loopback traffic' are shown. Any other ideas? Thanks in advance for the the help.

jgraves16387 ( 2019-10-13 22:09:35 +0000 )edit

Have you rebooted?

npcap can produce a diagnostic report. From an elevated prompt run the report (usually C:\Program Files\npcap\DiagReport.bat) and then post the report output to a public file share, e.g. Google Drive, DropBox etc., and then post a link to the report back here.

grahamb ( 2019-10-14 09:37:57 +0000 )edit

I have rebooted, and ran the Diag Report. You can check it out here ..

https://drive.google.com/open?id=1Et4...

The only things I can see that stand out are some registry items that failed to be set I think.

jgraves16387 ( 2019-10-14 23:47:32 +0000 )edit

add a comment