My setup consists of win7, wireshark 2.6.2, npcap 0.99 and 13 network interfaces thanks to various vpn solutions.
Now when I start up Wireshark even if I just want to open a pcap capture file I get the uac elevation dialog for all network interfaces with a short wait inbetween.
Ist there a way to disable the inerface discovery step wireshark does, or at least limit it to a known set of interface identifiers?
For more current versions of Wireshark there is a preference to disable loading interfaces:
prefs: add the option not to load interfaces on startup.
C:\>wireshark -o capture.no_interface_load:TRUE
To just disable external capture (extcap) interfaces:
extcap: add preference to prevent interfaces loading.
C:\>wireshark -o capture.no_extcap:TRUE
If we know we're being used to open a capture file (e.g., if a capture file name was provided on the command line), we should probably disable both of those.
To disable interface discovery in Wireshark and avoid the UAC elevation dialog on startup, you can launch Wireshark with the -S option, which skips the initial interface list:
Create a Shortcut: Right-click on the Wireshark shortcut, select Properties, and add -S to the Target field (e.g., "C:\Program Files\Wireshark\Wireshark.exe" -S).
Limit Interfaces: Alternatively, you can configure Wireshark to limit the interfaces it scans by editing the init.lua file. Add the following line to skip specific interfaces:
lua Copy code disable_lua = false dofile(DATA_DIR.."console.lua") These steps help bypass or limit the interface discovery process, reducing the UAC prompts.
A workaround:
c:\wireshark\wireshark.exe c:\wireshark\empty.capNow use that shortcut to launch Wireshark instead of default launcher.
It works for me. No UAC nag. I'm actually using the portable version.
Of course you won't be able to capture from physical interfaces, i'm not administrator, but you can open PCAP files easy.
Asked: 2018-08-03 08:47:32 +0000
Seen: 3,095 times
Last updated: May 18
I'm not aware of such an option. Enumerating the interfaces is run through the capture library, in your case npcap, can you rule out an npcap issue by uninstalling it and installing WinPcap?
npcap itself is working fine, and the enumeration also works as expected my question is about not doing it at all, ie. when opening an existing package capture file
I don't think a UAC elevation is normal, I've never seen that before, that's what I thought your issue wa
Currently, the only way to stop Wireshark asking the capture library to enumerate all the interfaces (so Wireshark can display them along with the traffic sparklines) is to not have a capture library.
To change this behaviour would require the addition of a command line switch or preference, so an enhancement request should be raised on the Wireshark Bugzilla.