Ask Your Question

windows wireshark start capture on disconnected interface

asked 2018-10-09 14:39:24 +0000

pr0n gravatar image

updated 2018-10-09 14:45:42 +0000

On MacOS I can start a capture on a disconnected wireless interface so that the moment it connects I can see all traffic and I don't miss out on things like DHCP etc. Is it possible to do this in windows or to perhaps start a capture immediately and automatically upon connecting?

When I try this currently the capture will start with a disconnected wireless interface but will stop the moment I connect to an SSID and has to be restarted meaning I've missed all the initial traffic. The error it displays when it stops is "The network adapter on which the capture was being done is no longer running; the capture has stopped."

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-10-09 17:32:55 +0000

cmaynard gravatar image

updated 2018-10-09 18:20:45 +0000

Can you provide more details about your Windows Wireshark capture setup? In particular, are you using WinPcap or npcap? I haven't tried it myself, but if you're using WinPcap, then you might want to try again with npcap to see if that works for you.

(Much like "Whos' Line Is It Anyway?", the points don't matter, but I converted my comment to an answer since it helped resolve the problem and if it's accepted, then it may help others to find an answer that works for them too.)

edit flag offensive delete link more


Switching to npcap from winpcap resolved this for me. If you want points for an answer I'll mark it.

pr0n gravatar imagepr0n ( 2018-10-09 17:54:50 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-10-09 14:39:24 +0000

Seen: 851 times

Last updated: Oct 09 '18