No Ethernet Capture Option

asked 2019-10-25 16:12:59 +0000

Travis gravatar image

updated 2019-10-27 09:38:48 +0000

grahamb gravatar image

Hello,

I recently purchased a new laptop and it dosen't have an ethernet port. But I have an ethernet adapter.

When I launch wireshark I do not see an ethernet option for capturing just Adapter for loopback traffic capture and USPpcap1.

What's also interesting is I just disconnected the ethernet to see what would show up if I connect wirelessly and I still only see the two options I mentioned above, no wireless capture option.

I'm on version 3.0.6.

Any suggestions to what I can do to get the ethernet and wireless options to appear?

Thank you.

edit retag flag offensive close merge delete

Comments

Can you post the contents of the Wireshark Help -> About Wireshark dialog. You can highlight the text with the mouse, Ctrl + C to copy it and then paste it into a comment here.

grahamb gravatar imagegrahamb ( 2019-10-25 17:31:33 +0000 )edit

Info: 

Version 3.0.6 (v3.0.6-0-g908c8e357d0f) 

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 

Compiled (64-bit) with Qt 5.12.5, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with LZ4, with Snappy, with libxml2 2.9.9, with QtMultimedia, with AirPcap, with SBC, with SpanDSP, with bcg729. 

Running on 64-bit Windows 10 (1903), build 18362 ...
(more)
Travis gravatar imageTravis ( 2019-10-25 17:36:39 +0000 )edit

So you're running on Windows using npcap 0.9983.

You've likely hit an npcap issue where the service hasn't started. From a command prompt can you type the following and then paste the output back here:

sc queryex npcap
grahamb gravatar imagegrahamb ( 2019-10-25 17:42:24 +0000 )edit

Output:

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :
Travis gravatar imageTravis ( 2019-10-25 17:46:18 +0000 )edit

I recently purchased a new laptop and it dosen't have an ethernet port. But I have an ethernet adapter.

So that's an Ethernet adapter that plugs into the laptop, for example a USB Ethernet adapter?

Guy Harris gravatar imageGuy Harris ( 2019-10-26 02:27:46 +0000 )edit

As can be clearly seen in the service status output, the npcap driver has stopped with an error. From MSDN on the error code:

ERROR_SERVICE_NEVER_STARTED 1077 (0x435) No attempts to start the service have been made since the last boot.

Can you try starting the driver. From an elevated command prompt, enter sc start npcap? Please post back the output.

grahamb gravatar imagegrahamb ( 2019-10-26 11:02:12 +0000 )edit

That worked. I don't have the ethernet connection with me to test but all my other interfaces are showing up now so I think it worked. Thank you.

Do you have any ideas why it may not have started when it should have?

Travis gravatar imageTravis ( 2019-10-26 21:17:17 +0000 )edit

It seems to be an ongoing issue with npcap. Can you check that the service does start automatically after a reboot as some have had issues with that?

Could you also please raise the issue over at the nmap Github site so that they have more visibility of the issue. There may be an existing issue open for this.

grahamb gravatar imagegrahamb ( 2019-10-27 09:22:31 +0000 )edit

I am having a similar problem. I cannot see any network adapters, only "Adapter for loopback traffic capture" and USBpcap1, USBPcap2 and USBPcap3.

I am using the same version of Wireshark as above and Npcap 0.9983 is installed. Windows version is:

OS Name:                   Microsoft Windows 10 Home
OS Version:                10.0.18362 N/A Build 18362

Two points:

1) sc queryx npcap does not work for me. sc query npcap does and it displays as shown in the earlier comment, i.e. STOPPED:

C:\WINDOWS\system32>sc query npcap

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 2  (0x2)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

2) I tried sc start npcap but it returns with an error:

C:\WINDOWS\system32>sc start npcap
[SC] StartService FAILED 2:

The system cannot find the file specified.

Question: When installing Npcap, I presume it is OK to leave the four checkboxes unchecked?

robertc808 gravatar imagerobertc808 ( 2019-10-30 14:25:27 +0000 )edit

My laptop BSOD'ed and I have rebooted and strangely enough now it seems to be working. This is despite numerous reboots before. I didn't change anything either. Most strange.

C:\WINDOWS\system32>sc query npcap

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
robertc808 gravatar imagerobertc808 ( 2019-10-30 16:07:25 +0000 )edit
see more comments