Ask Your Question

WireShark just does not see my Wintun Userspace Tunnel vpn interface

asked 2020-09-07 16:13:07 +0000

I need to capture traffic in a vpn tunnel. When i activate the vpn tunnel connection and do a powershell command get-NetAdapter -IncludeHidden, a Wintun Userspace Tunnel Interface is shown with Status=Up. I believe that's the interface i should capture my traffic on. But WireShark does not give me the option to choose this interface. I tried the default settings. I tried the option in Wireshark to install Wireshark with npcap and WinpCap API compatibility, I tried to deinstall npcap and only use WinPcap. But nothing worked. My OS is Windows 10. Can you explain what I should do to capture the traffic within a VPN tunnel ?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-09-07 16:48:02 +0000

grahamb gravatar image

updated 2020-09-07 16:48:40 +0000

WinPCap, which has been obsolete for a number of years, was never very good with VPN's.

npcap should be used in its "native mode", if that doesn't support your interface (use wireshark or tshark from the command line with -D to list the interfaces), then that should be reported as an npcap issue here.

A final option is to try to capture using the built in capture tools that produce an ETL file and then convert the file to pcapng using etl2pcapng. More info on the tools here and here.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2020-09-07 16:13:07 +0000

Seen: 1,956 times

Last updated: Sep 07 '20