Ask Your Question
0

"Can't set promiscuous mode" reported on Snapdragon X55 mobile phone modem on Windows

asked 2021-03-09 09:29:36 +0000

updated 2021-03-09 19:20:24 +0000

Guy Harris gravatar image

I'm using Wireshark/Tshark 3.4.3 on a Dell Latitude 9510 with a Snapdragon X55 5G WWAN controller. The OS is Win10 Pro version 20h2 build 19042.804. Nmap 1.10 is installed. When I try to capture from the mobile device I get errors that tshark can't set promiscuous/non-promiscous mode: PS C:> ipconfig ... Mobile Broadband adapter Cellular: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::112b:9985:4314:4c29%31 IPv4 Address. . . . . . . . . . . : 10.109.22.200 Subnet Mask . . . . . . . . . . . : 255.255.255.240

PS C:> tshark -npi 5 Capturing on 'Cellular' tshark: The capture session could not be initiated on interface '\Device\NPF_{CC3F3B57-6D66-4103-8AAF-828D090B1BA9}' (failed to set hardware filter to non-promiscuous mode). Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified. 0 packets captured PS C:> tshark -ni 5 Capturing on 'Cellular' tshark: The capture session could not be initiated on interface '\Device\NPF_{CC3F3B57-6D66-4103-8AAF-828D090B1BA9}' (failed to set hardware filter to promiscuous mode). Please turn off promiscuous mode for this device 0 packets captured

The error appears both for regular users and adninistrator.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-03-09 19:19:39 +0000

Guy Harris gravatar image

When I try to capture from the mobile device I get errors that tshark can't set promiscuous/non-promiscous mode

That''s probably because the mobile phone modem doesn't support promiscuous mode.

If you want to capture traffic to and from your machine, you don't need promiscuous mode.

If you want to capture traffic on the mobile phone network between other devices and the network, you will probably need a fairly exotic device that, as far as I know, is not available to ordinary users; I don't know how to get such a device. You may also have to somehow decrypt that traffic, which may be somewhere between "difficult" and "impossible".

If all you want is to capture traffic to and from your machine, then:

  • select Capture > Options;
  • make sure the "Enable promiscuous mode on all devices" checkbox is NOT checked;
  • un-check the check box in the "Promiscuous" column for the "\Device\NPF_{CC3F3B57-6D66-4103-8AAF-828D090B1BA9}'" or "Mobile Broadband adapter Cellular" device (the column title might be cut off, so it might just say "Promisc" or something such as that);
  • click the "Start" button to start the capture.

There are some changes that it might be possible to make to libpcap, and to Wireshark, so that it won't even offer a "promiscuous mode" checkbox for devices that don't offer promiscuous mode, at least on Windows (on UN*Xes, devices that don't support promiscuous mode tend to just ignore requests to enable it, rather than reporting an error), which would make this less of a nuisance. Those are significant API changs to libpcap, and significant code changes to Wireshark, however, so they won't happen soon.

edit flag offensive delete link more

Comments

Tried this but when clicking on Start the same error appears: The capture session could not be initiated on interface '\Device\NPF_{CC3F3B57-6D66-4103-8AAF-828D090B1BA9}' (failed to set hardware filter to non-promiscuous mode).

azzurrow gravatar imageazzurrow ( 2021-03-10 09:41:31 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-03-09 09:29:36 +0000

Seen: 61 times

Last updated: Mar 09