Ask Your Question
0

No packets captured by Npcap on teamed network adapter

asked 2023-03-05 21:01:44 +0000

jvwired gravatar image

updated 2023-03-06 19:11:51 +0000

Guy Harris gravatar image

I am using Intel(R) Ethernet Server Adapter I350-T2 with two lines teamed. I get no network traffic capture. Error message unknown ndis medium value 12, defaulting to DLT_EN10MB

edit retag flag offensive close merge delete

Comments

Similar to npcap #173.

Can you update the question with the output of wireshark -v or Help->About Wireshark:Wireshark.

Chuckc gravatar imageChuckc ( 2023-03-06 00:41:39 +0000 )edit

Version 4.0.4 (v4.0.4-0-gea14d468d9ca).

message on start capture

Warning: unknown ndis medium value 12, defaulting to DLT_EN10MB

Properties of adapter

Connection-specific DNS Suffix: attlocal.net
Description: TEAM: Team i350T2
Physical Address: ‎A0-36-9F-52-E6-2E
DHCP Enabled: Yes
IPv4 Address: 192.168.1.112
IPv4 Subnet Mask: 255.255.255.0
Lease Obtained: Thursday, February 23, 2023 1:07:37 PM
Lease Expires: Monday, March 06, 2023 1:07:37 PM
IPv4 Default Gateway: 192.168.1.254
IPv4 DHCP Server: 192.168.1.254
IPv4 DNS Server: 192.168.1.254
IPv4 WINS Server: 
NetBIOS over Tcpip Enabled: Yes

Opening screen Wireshark

Local Area Connection* 4
Local Area Connection* 3
Local Area Connection*
Local Area Connection* 10
Local Area Connection* 5
VirtualBox Host-Only Network
Local Area Connection 4
Adapter for loopback traffic capture
Local Area Connection* 2

start, no activity stop, message "No packets captured. As no data was ...(more)

jvwired gravatar imagejvwired ( 2023-03-06 03:34:19 +0000 )edit

The output of wireshark -v also includes information on npcap (if loaded) and the operating system.
Can you add the full output?

Chuckc gravatar imageChuckc ( 2023-03-06 19:18:15 +0000 )edit

OUTPUT OF WIRESHARK -V

Wireshark 4.0.4 (v4.0.4-0-gea14d468d9ca).

Copyright 1998-2023 Gerald Combs <[email protected]> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).

This is free software; see the file named COPYING in the distribution. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.32, build 31332), with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap ...
(more)
jvwired gravatar imagejvwired ( 2023-03-06 23:08:54 +0000 )edit

"Npcap Packet Driver (NPCAP)" is visible in the local network properties and checkmarked to be active

jvwired gravatar imagejvwired ( 2023-03-06 23:26:47 +0000 )edit
see more comments

1 Answer

Sort by » oldest newest most voted
0

answered 2023-03-06 19:26:54 +0000

Guy Harris gravatar image

The lack of captured packets is either an Npcap issue or a Windows issue, and should be reported on the Npcap issues list.

The message in question is a warning. Please mention it in the issue you file and, if possible, copy and paste it rather than retyping it.

(The message in the libpcap and thus Npcap code begins with "Unknown NdisMedium value", capitalized in that fashion, so it was retyped here. 12 is an odd NdisMedium value for a teamed Ethernet device; it appears that it's NdisMediumCoWan, which makes no sense, as it "Specifies a wide area network in a connection-oriented environment.", and Ethernet isn't considered a WAN and isn't connection-oriented, so the value may have been different as well. Knowing the correct value might help determine what DLT_ value it should be mapped to.)

edit flag offensive delete link more

Comments

12? Sounds as if either Intel or Microsoft is doing something massively wrong, as it makes zero sense for NdisMediumCoWan to be the NdisMedium type.

What's the output of wireshark -D?

Guy Harris gravatar imageGuy Harris ( 2023-03-07 09:43:03 +0000 )edit

OUTPUT OF wireshark -D

1. \Device\NPF_{DF4A9D2C-8742-4EB1-8703-D395C4183F33} (Local Area Connection* 4)
2. \Device\NPF_{E43D242B-9EAB-4626-A952-46649FBB939A} (Local Area Connection* 3)
3. \Device\NPF_{71F897D7-EB7C-4D8D-89DB-AC80D9DD2270} (Local Area Connection*)
4. \Device\NPF_{78032B7E-4968-42D3-9F37-287EA86C0AAA} (Local Area Connection* 10)
5. \Device\NPF_{8E301A52-AFFA-4F49-B9CA-C79096A1A056} (Local Area Connection* 5)
6. \Device\NPF_{9374D46C-2355-4C45-AF76-3CB56C734852} (VirtualBox Host-Only Network)
7. \Device\NPF_{E4387D79-C7EF-4B91-8AF0-8701F536DFA6} (Local Area Connection 4)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. \Device\NPF_{29898C9D-B0A4-4FEF-BDB6-57A562022CEE} (Local Area Connection* 2)
jvwired gravatar imagejvwired ( 2023-03-12 07:09:18 +0000 )edit

The 1,2,3,4 at the end was 6,7,8,9 in my source OUTPUT OF wireshark -D

1. \Device\NPF_{DF4A9D2C-8742-4EB1-8703-D395C4183F33} (Local Area Connection* 4)
2. \Device\NPF_{E43D242B-9EAB-4626-A952-46649FBB939A} (Local Area Connection* 3)
3. \Device\NPF_{71F897D7-EB7C-4D8D-89DB-AC80D9DD2270} (Local Area Connection*)
4. \Device\NPF_{78032B7E-4968-42D3-9F37-287EA86C0AAA} (Local Area Connection* 10)
5. \Device\NPF_{8E301A52-AFFA-4F49-B9CA-C79096A1A056} (Local Area Connection* 5)
6. \Device\NPF_{9374D46C-2355-4C45-AF76-3CB56C734852} (VirtualBox Host-Only Network)
7. \Device\NPF_{E4387D79-C7EF-4B91-8AF0-8701F536DFA6} (Local Area Connection 4)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. \Device\NPF_{29898C9D-B0A4-4FEF-BDB6-57A562022CEE} (Local Area Connection* 2)
jvwired gravatar imagejvwired ( 2023-03-12 07:12:55 +0000 )edit

On which of those interfaces were you trying to capture?

Guy Harris gravatar imageGuy Harris ( 2023-04-28 00:41:01 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

subscribe to rss feed

Stats

Asked: 2023-03-05 21:01:44 +0000

Seen: 2,278 times

Last updated: Mar 06 '23