windows wireshark start capture on disconnected interface

asked 2018-10-09 14:39:24 +0000

pr0n
3 ●1 ●3

updated 2018-10-09 14:45:42 +0000

On MacOS I can start a capture on a disconnected wireless interface so that the moment it connects I can see all traffic and I don't miss out on things like DHCP etc. Is it possible to do this in windows or to perhaps start a capture immediately and automatically upon connecting?

When I try this currently the capture will start with a disconnected wireless interface but will stop the moment I connect to an SSID and has to be restarted meaning I've missed all the initial traffic. The error it displays when it stops is "The network adapter on which the capture was being done is no longer running; the capture has stopped."

answered 2018-10-09 17:32:55 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

updated 2018-10-09 18:20:45 +0000

Can you provide more details about your Windows Wireshark capture setup? In particular, are you using WinPcap or npcap? I haven't tried it myself, but if you're using WinPcap, then you might want to try again with npcap to see if that works for you.

(Much like "Whos' Line Is It Anyway?", the points don't matter, but I converted my comment to an answer since it helped resolve the problem and if it's accepted, then it may help others to find an answer that works for them too.)

edit flag offensive delete link

Comments

Switching to npcap from winpcap resolved this for me. If you want points for an answer I'll mark it.

pr0n ( 2018-10-09 17:54:50 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

windows wireshark start capture on disconnected interface

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

windows wireshark start capture on disconnected interface edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

windows wireshark start capture on disconnected interface