Ask Your Question
0

Cannot access Ethernet interfaces with Wireshark Portable unless I install full WinPCap?

asked 2018-02-22 14:42:20 +0000

When I run Wireshark Portable as is, I only get 3 interfaces, and none of them are the ethernet ports. I have to install the full WinPCap 4.1.3, and only then are the Ethernet interfaces visible in Wireshark Portable. Is there and workaround to this? The application isn't really portable if it is dependant on you installing a second piece of software, particularly one that prompts you to reboot when you uninstall it.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-02-22 14:53:33 +0000

grahamb gravatar image

updated 2018-02-22 14:54:57 +0000

The application still runs and opens capture files, dissecting them as expected without WinPcap being installed.

If you want to capture on the host, then you'll need to install WinPcap or npcap, and as they are both drivers they need admin privs and the reboot.

Another option would be to use the built-in netsh capture system, and then either use NetMon (obsolete) or Message Analyzer (MA) to open the file. NetMon and MA can save the file in a format that Wireshark (portable or otherwise) can open.

edit flag offensive delete link more

Comments

And for completeness, 4 different capture methods; NetMon, Wireshark, netsh, MA.

grahamb gravatar imagegrahamb ( 2018-02-22 15:00:25 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-02-22 14:42:20 +0000

Seen: 784 times

Last updated: Feb 22