First time here? Check out the FAQ!

Ask Your Question
0

windows wireshark start capture on disconnected interface

asked Oct 9 '18

pr0n gravatar image

updated Oct 9 '18

On MacOS I can start a capture on a disconnected wireless interface so that the moment it connects I can see all traffic and I don't miss out on things like DHCP etc. Is it possible to do this in windows or to perhaps start a capture immediately and automatically upon connecting?

When I try this currently the capture will start with a disconnected wireless interface but will stop the moment I connect to an SSID and has to be restarted meaning I've missed all the initial traffic. The error it displays when it stops is "The network adapter on which the capture was being done is no longer running; the capture has stopped."

Preview: (hide)

1 Answer

Sort by » oldest newest most voted
1

answered Oct 9 '18

cmaynard gravatar image

updated Oct 9 '18

Can you provide more details about your Windows Wireshark capture setup? In particular, are you using WinPcap or npcap? I haven't tried it myself, but if you're using WinPcap, then you might want to try again with npcap to see if that works for you.

(Much like "Whos' Line Is It Anyway?", the points don't matter, but I converted my comment to an answer since it helped resolve the problem and if it's accepted, then it may help others to find an answer that works for them too.)

Preview: (hide)
link

Comments

Switching to npcap from winpcap resolved this for me. If you want points for an answer I'll mark it.

pr0n gravatar imagepr0n ( Oct 9 '18 )

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Oct 9 '18

Seen: 1,127 times

Last updated: Oct 09 '18