WireShark just does not see my Wintun Userspace Tunnel vpn interface

asked 2020-09-07 16:13:07 +0000

I need to capture traffic in a vpn tunnel. When i activate the vpn tunnel connection and do a powershell command get-NetAdapter -IncludeHidden, a Wintun Userspace Tunnel Interface is shown with Status=Up. I believe that's the interface i should capture my traffic on. But WireShark does not give me the option to choose this interface. I tried the default settings. I tried the option in Wireshark to install Wireshark with npcap and WinpCap API compatibility, I tried to deinstall npcap and only use WinPcap. But nothing worked. My OS is Windows 10. Can you explain what I should do to capture the traffic within a VPN tunnel ?

answered 2020-09-07 16:48:02 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

updated 2020-09-07 16:48:40 +0000

WinPCap, which has been obsolete for a number of years, was never very good with VPN's.

npcap should be used in its "native mode", if that doesn't support your interface (use wireshark or tshark from the command line with -D to list the interfaces), then that should be reported as an npcap issue here.

A final option is to try to capture using the built in capture tools that produce an ETL file and then convert the file to pcapng using etl2pcapng. More info on the tools here and here.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

WireShark just does not see my Wintun Userspace Tunnel vpn interface

1 Answer

Your Answer

Question Tools

Stats

Related questions

WireShark just does not see my Wintun Userspace Tunnel vpn interface edit

1 Answer