Ask Your Question
0

Wireshark (Win 10) No longer finds all interfaces (only USBPcap)

asked 2021-06-19 15:04:26 +0000

PCrossley gravatar image

updated 2021-07-25 16:21:49 +0000

I suspect this happened after an update - I am using Wireshark 3.4.6 on Windows 10 20H2 with all updates

I have both Winpcap and npcap installed

Interfaces ARE detected if I run as Administrator or if I uninstall npcap

I've tried manually removing npcap and re-running the wireshark installation so that npcap is re-installed: npcap was NOT installed with the option to restrict access to administrator.

==============

I had both winpcap and npcap installed because winpcap was installed by some other software and it has never been an issue in the past.

However given that there was clearly an issue I tried removing both, rebooting and reinstalling npcap - no change.

I have also tried updating to the latest npcap (1.5.0) with no change.

One of the other pcap based bits of software I use is Acryllic WiFi professional - it actually uses sharppcap I uninstalled this software - and npcap, rebooted and reinstalled npcap - still no change.

I do however note that some acrylic NDIS drivers still appear in the list of interfaces when I use administrator mode so I assume that their uninstall script is not perfect. I have therefore sent an email to acryllic to see whether they feel this could be the cause of my wireshark issue.

My only concern is that Wireshark will blame Acryllic and Acryllic will blame wireshark so Ill be stuck in the middle. Does anyone have any further suggestions?

Thanks for your help

edit retag flag offensive close merge delete

Comments

My only concern is that Wireshark will blame Acryllic and Acryllic will blame wireshark

The only reason to blame Wireshark would be that Wireshark installs Npcap; the only ways in which Wireshark affects the Windows networking stack is by installing and running Npcap. The Npcap developers are more familiar with the Windows networking stack and the ways in which various devices affect it than are most Wireshark developers, so you might want to ask the Npcap developers by filing an issue on the Npcap issue list.

Guy Harris gravatar imageGuy Harris ( 2021-07-25 20:30:55 +0000 )edit

Hi, I am able to capture WIFI packets with AcrylicWfi. I am running Windows 21H1, Wireshark 3.4.7, NPCAP 1.50 raw wireless support installed, Acrylic Wifi 1.2.7802.25416 Acrylic NDIS NOT installed and Realtek 8814AU WIFI.

I had to manually set the channel before I was able to capture anything.

BigFatCat gravatar imageBigFatCat ( 2021-07-26 07:33:06 +0000 )edit

@PCrossley has opened an issue with the npcap group:
Wireshark only finds interfaces as administrator #526

Chuckc gravatar imageChuckc ( 2021-07-26 15:45:42 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
0

answered 2021-06-19 16:33:19 +0000

grahamb gravatar image

There's no point in installing both WinPcap and npcap, Wireshark will use the latter if present.

You can try the following steps to get a working npcap installation:

  1. Uninstall both Winpcap and npcap
  2. Reboot.
  3. Install the latest npcap version from their site. Uncheck the options for WinPcap compatible mode, legacy loopback adaptor and administrative users only.
edit flag offensive delete link more

Comments

Im afraid this didnt work - Ive now updated the question to reflect this

PCrossley gravatar imagePCrossley ( 2021-07-25 16:22:27 +0000 )edit

If a cleanup and uninstall and then a reinstall of npcap doesn't fix things, then that should be taken up with the ncpap folks over at their GitHub issues page.

grahamb gravatar imagegrahamb ( 2021-07-25 17:58:00 +0000 )edit
0

answered 2022-02-02 12:07:24 +0000

PCrossley gravatar image

The guys at npcap tell me that SharpPcap used by acrylic uses npcap so it shouldn't cause compatibility problems.

I did eventually solve the problem myself

Acrylic installs the file C:\windows\system32\airpcap.dll prior to npcap this made acrylic's wifi drivers accessible to Wireshark; but only if wireshark was run as administrator.

I simply renamed this to C:\windows\system32\airpcap.dll.old

This solved all my problems and Acrylic still works too. I guess I can remove the dll now since nothing seems to require it.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2021-06-19 15:04:26 +0000

Seen: 2,413 times

Last updated: Feb 02 '22