Ask Your Question
0

Wireshark 2.6 doesn't find the interfaces and exits the program.

asked 2018-05-16 18:42:34 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

After several reinstalls I'm looking for help. Why can't Wireshark find my interfaces? I have reinstalled multiple times WinPcaP and Wireshark 2.6. Wireshark 2.4.6 worked without any problem. (Microsoft Windows 10 PRO (10.0.17134))

edit retag flag offensive close merge delete

Comments

Can you paste the contents of the Help | About Wireshark | Wireshark dialog box?

grahamb gravatar imagegrahamb ( 2018-05-17 09:17:16 +0000 )edit

In fact, I can't. Wireshark closes itself after less than 5 seconds. Can I add somewhere a screenshot?

Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 10:51:23 +0000 )edit

Maybe use tshark from a command prompt then:

"path\to\tshark.exe" -v

Where path\to is the appropriate path to your install of Wireshark, likely to be "C:\Program Files\Wireshark", or "C:\Program Files (x86)\Wireshark", and if it includes spaces will have to be quoted as in the example.

grahamb gravatar imagegrahamb ( 2018-05-17 11:35:18 +0000 )edit

tshark output:

C:\Program Files\Wireshark>tshark.exe -v
TShark (Wireshark) 2.6.0 (v2.6.0-0-gc7239f02)

Copyright 1998-2018 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with WinPcap (4_1_3), with GLib 2.42.0, with zlib 1.2.11, with
SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.4.11, with Gcrypt
1.7.6, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.14.0, with
LZ4, with Snappy, with libxml2 2.9.4.

Running on 64-bit Windows 10, build 17134, with Intel(R) Core(TM) i7-5600U CPU @
2.60GHz (with SSE4.2), with 16275 MB of ...
(more)
Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 13:14:29 +0000 )edit

OK, that shows that npcap has been found and is being used. Something is up with the interfaces on your machine that prevents the initial scan of interfaces succeeding.

Can you open a PowerShell prompt and show the output of Get-NetAdaptor?

grahamb gravatar imagegrahamb ( 2018-05-17 13:21:07 +0000 )edit

output:

PS C:\Users\Tom> Get-NetAdapter

Name                      InterfaceDescription                    ifIndex Status       MacAddress             LinkSpeed
----                      --------------------                    ------- ------       ----------             ---------
Wi-Fi                     Intel(R) Dual Band Wireless-AC 7265          23 Up           10-02-B5-2E-74-80     173.3 Mbps
VirtualBox Host-Only N... VirtualBox Host-Only Ethernet Adapter        19 Up           0A-00-27-00-00-13         1 Gbps
Mobiel 2                  Dell Wireless 5809e Gobi™ 4G LTE Mob...      13 Disconnected 90-93-80-52-53-4A          0 bps
Ethernet                  Intel(R) Ethernet Connection (3) I21...      12 Disconnected F8-CA-B8-45-5B-92          0 bps
Npcap Loopback Adapter    Npcap Loopback Adapter                        6 Up           02-00-4C-4F-4F-50       1.2 Gbps
Bluetooth-netwerkverbi... Bluetooth Device (Personal Area Netw...       5 Disconnected 10-02-B5-2E-74-84         3 Mbps
Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 13:24:12 +0000 )edit

FYI

C:\Program Files\Wireshark>tshark.exe -D
1. \Device\NPF_{4F85C07A-63A5-4AE5-87FF-6D4E929FD5AE} (LAN-verbinding* 11)
2. \Device\NPF_{9D7312CD-AE4C-48B8-9436-3B8558F477CF} (LAN-verbinding* 5)
3. \Device\NPF_{3A0BCE39-91E2-4111-A179-3E573E66370C} (Bluetooth-netwerkverbinding)
4. \Device\NPF_{FBD7D021-B7D1-4F9B-9064-851B283605DD} (Wi-Fi)
5. \Device\NPF_{CD853BB4-2C17-4076-BB16-D044F823E9DF} (VirtualBox Host-Only Network)
6. \Device\NPF_{54999DCB-50FD-4058-BF37-EAC4CF949DF1} (Ethernet)
7. \Device\NPF_{6A5F1E01-9696-47F0-868E-58768B6A0A11} (Mobiel 2)
8. \Device\NPF_{53ADB2E7-0520-4438-A388-E4A69E5A5B46} (LAN-verbinding* 10)
9. \Device\NPF_{3D15719B-51D4-4D60-B0B1-DDC021D5BA48} (Npcap Loopback Adapter)
10. \Device\NPF_{401DE622-CB5E-46C5-999E-AFC2CF06C767} (LAN-verbinding* 2)
11. \Device\NPF_{C430DB3A-3DEB-47C5-9F9F-DF10D4EB9825} (LAN-verbinding* 12)

Strange, no?

Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 13:43:31 +0000 )edit

The one that is (somewhat) out of the ordinary is:

Mobiel 2  Dell Wireless 5809e Gobi™ 4G LTE Mob...   13 Disconnected 90-93-80-52-53-4A 0 bps

Is there any way you can remove or "delete" that so Windows can't see it?

grahamb gravatar imagegrahamb ( 2018-05-17 13:46:14 +0000 )edit

tshark just lists the interfaces configured, Wireshark actually tries to open them to discover more info, such as the link type and this is where bad things are happening.

grahamb gravatar imagegrahamb ( 2018-05-17 13:47:52 +0000 )edit

I disabled Mobiel2. Unfortunately same result!

Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 14:24:34 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2018-05-16 21:20:42 +0000

Jaap gravatar image

Install npcap with Wireshark instead.

edit flag offensive delete link more

Comments

Used method: 1) I removed the WinPcaP driver and Wireshark. 2) I installed Npcap 0.99-r5 3) I installed Wireshark 2.6

Unfortunately same result!

Tom Cordemans gravatar imageTom Cordemans ( 2018-05-17 06:01:39 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2018-05-16 18:42:34 +0000

Seen: 816 times

Last updated: May 16 '18