Ask Your Question
0

Wireshark not running in windows 10

asked 2022-03-08 12:10:30 +0000

heye gravatar image

updated 2022-03-08 12:13:55 +0000

Jaap gravatar image

i am not able to run wireshark win64 362 in my windows 10 ver20h2 19042.188, nothing happen after executing winshark.exe

edit retag flag offensive close merge delete

Comments

Run it from a command shell and report the console output shown, if any. Also try running tshark in the command shell, and see what happens.

Jaap gravatar imageJaap ( 2022-03-08 12:15:59 +0000 )edit

running in the command line : nothing happen , pls see attached picture!, sorry i am not allowed to attached the picture

c:\program files \Wireshark\wireshark.exe

response

c:\program files\wireshark> "nothing happen"

heye gravatar imageheye ( 2022-03-09 04:38:23 +0000 )edit

when running tshark in command line response :

capturing on 'local area connection * 11'
(tshark:13948) 13:14:09.128541 [Main MESSAGE] -- Capture started.
(tshark :13948) 13:14:09.131515 [Main MESSAGE] -- File "c:\Users\heye\AppData\Local|Temp\wireshark_Local Area connection - 11FR0MT1.pcapng"

...nothing happen.....hang!

heye gravatar imageheye ( 2022-03-09 05:24:31 +0000 )edit

Okay, that is very little to go on.

One observation though, how come it says File "c:\Users\heye\AppData\Local|Temp\wireshark_Loc... Where's that pipe symbol between Local and Temp coming from?

PS: I'm not a Windows user, so can only state the obvious here.

Jaap gravatar imageJaap ( 2022-03-09 12:43:44 +0000 )edit
  • sorry. there is no pipe symbol ,it is a typo error. it should be Local\Temp\wireshark_Local....
heye gravatar imageheye ( 2022-03-10 07:57:52 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2022-03-11 09:12:32 +0000

heye gravatar image

updated 2022-03-11 11:02:02 +0000

Jaap gravatar image
C:\Program Files\Wireshark>tshark -v
TShark (Wireshark) 3.6.2 (v3.6.2-0-g626020d9b3c3)
i)
C:\Program Files\Wireshark>tshark -D
1. \Device\NPF_{1D7EE94E-FEF2-4C41-B99A-A667EA4B9E1D} (Local Area Connection* 11)
2. \Device\NPF_{04139B68-62C6-4DB1-BFBF-A760ED12A89F} (Local Area Connection* 10)
3. \Device\NPF_{DF9D2BE3-E6D5-4A21-AC03-1843EF8D20AF} (Local Area Connection* 9)
4. \Device\NPF_{18C1F50D-AB34-4264-A46C-F07B12DC8374} (Bluetooth Network Connection)
5. \Device\NPF_{6E16E41D-19BE-4A19-BEAE-D3C97C1B132E} (Wi-Fi)
6. \Device\NPF_{673D9231-1802-400C-9A52-E9961C4100E8} (Local Area Connection* 12)
7. \Device\NPF_{6D8E8D22-C3A8-4970-8C9C-220C72864FEC} (Local Area Connection* 3)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)

ii)
C:\Program Files\Wireshark>tshark -i \Device\NPF_{1D7EE94E-FEF2-4C41-B99A-A667EA4B9E1D}
Capturing on 'Local Area Connection* 11'
 ** (tshark:11600) 16:57:18.532137 [Main MESSAGE] -- Capture started.
 ** (tshark:11600) 16:57:18.534207 [Main MESSAGE] -- File: "C:\Users\heye\AppData\Local\Temp\wireshark_Local Area Connection- 11TDSJI1.pcapng"
0 packets captured

iii)
I try the wifi interface as follow, it seams capturing something , but no window display. only in the command line ie: no window display as a normal Windows program does.


pls see be low

C:\Program Files\Wireshark>tshark -i  \Device\NPF_{6E16E41D-19BE-4A19-BEAE-D3C97C1B132E}
Capturing on 'Wi-Fi'
 ** (tshark:2756) 16:59:54.232843 [Main MESSAGE] -- Capture started.
 ** (tshark:2756) 16:59:54.235762 [Main MESSAGE] -- File: "C:\Users\heye\AppData\Local\Temp\wireshark_Wi-FiCEFRI1.pcapng"
    1   0.000000 192.168.10.129 → 192.168.10.255 UDP 82 57797 → 1947 Len=40
    2   1.099626 IntelCor_fe:6b:04 → BelkinIn_40:b5:f2 ARP 42 Who has 192.168.10.1? Tell 192.168.10.129
    3   1.100264 BelkinIn_40:b5:f2 → IntelCor_fe:6b:04 ARP 42 192.168.10.1 is at 30:23:03:40:b5:f2
    4   5.813399      0.0.0.0 → 224.0.0.1    IGMPv2 46 Membership Query, general
    5   5.813399      0.0.0.0 → 224.0.0.1    IGMPv2 46 Membership Query, general
    6   5.813399      0.0.0.0 → 224.0.0.1    IGMPv2 46 Membership Query, general
    7   5.813399      0.0.0.0 → 224.0.0.1    IGMPv2 46 Membership Query, general
    8   6.107851 192.168.10.129 → 224.0.0.251  IGMPv2 46 Membership Report group 224.0.0.251
    9   7.879010 104.17.108.108 → 192.168.10.129 TLSv1.2 568 Application Data
   10   7.879163 192.168.10.129 → 104.17.108.108 TLSv1.2 404 Application Data
   11   7.883352 104.17.108.108 → 192.168.10.129 TCP 54 443 → 49817 [ACK] Seq=515 Ack=351 Win=122 Len=0
   12  10.610794 192.168.10.129 → 224.0.0.252  IGMPv2 46 Membership Report group 224.0.0.252
   13  10.795325 103.124.106.123 → 192.168.10.129 TLSv1.2 452 Application Data
   14  10.850098 192.168.10.129 → 103.124.106.123 TCP 54 49956 → 443 [ACK] Seq=1 Ack=399 Win=511 Len=0
   15  11.053569 192.168.10.129 → 199.232.46.114 TCP 55 [TCP segment of a reassembled PDU]
   16  11.056589 199.232.46.114 → 192.168.10.129 TCP 66 443 → 50355 [ACK] Seq=1 Ack ...
(more)
edit flag offensive delete link more

Comments

Output from version info

C:\Program Files\Wireshark>

Wireshark 3.6.2 (v3.6.2-0-g626020d9b3c3)

Copyright 1998-2022 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Microsoft Visual Studio 2019 (VC++ 14.29, build 30139),
with Qt 5.15.2, with libpcap, with GLib 2.66.4, with zlib 1.2.11, with Lua
5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.44.0, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.10, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0 ...
(more)
heye gravatar imageheye ( 2022-03-12 02:56:58 +0000 )edit

The title says Windows 10 but the wireshark -v says Running on 64-bit Windows 8, ...

Chuckc gravatar imageChuckc ( 2022-03-12 03:24:19 +0000 )edit

when i install wireshark, i selected running in window 8 compatible mode, there is not windows 10 option

heye gravatar imageheye ( 2022-03-12 06:41:42 +0000 )edit

Windows 'compatible modes' are intended for old software -- for those that are not (fully) compatible with, in this case, Windows 10. Do not use any compatible mode when installing or using Wireshark 3.x.

André gravatar imageAndré ( 2022-03-13 17:13:11 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-03-08 12:10:30 +0000

Seen: 878 times

Last updated: Mar 14 '22