Why Wireshark capture stops when one of the NIC is unplugged even though capture was started on all NICs including the Teaming NIC?

asked 2019-04-16 12:25:27 +0000

pranky16 gravatar image

Hi we have a server having two NICs - LAN1 and LAN2. Customer has configured Teaming NIC (Team1) comprising of these LAN1 and LAN2.

We wanted to do NIC testing activity where we started capture after selecting all 3 NICs: Team1, LAN1 and LAN2.

We unplugged cable from LAN1 and we got pop-up from Wireshark: "The network adapter on which the capture was being done is no longer running; the capture has stopped".

My question:- Shouldn't Wireshark keep running since LAN2 is still up and all three interfaces were selected for capture?

edit retag flag offensive close merge delete

Comments

Can you add the contents of the Wireshark -> Help -> About Wireshark -> Wireshark dialog box (you can copy and paste the text) to your question so we can see wireshark and environment versions etc?

grahamb gravatar imagegrahamb ( 2019-04-16 13:15:27 +0000 )edit

Here you go--

Version 2.4.0 (v2.4.0-0-g9be0fa500d)

Copyright 1998-2017 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.9.1, with WinPcap (4_1_3), with GLib 2.42.0, with
zlib 1.2.8, with SMI 0.4.8, with c-ares 1.12.0, with Lua 5.2.4, with GnuTLS
3.4.11, with Gcrypt 1.7.6, with MIT Kerberos, with GeoIP, with nghttp2 1.14.0,
with LZ4, with Snappy, with libxml2 2.9.4, with QtMultimedia, with AirPcap, with
SBC, with SpanDSP.

Running on 64-bit Windows Server 2012 R2, build 9600, with Intel(R) Xeon(R) CPU
E5-2623 v3 @ 3 ...
(more)
pranky16 gravatar imagepranky16 ( 2019-04-16 15:25:28 +0000 )edit
1

So you're using a very old version of Wireshark (2.4.0) with the old capture library (WinPcap).

I have no idea if it will fix it, but you could try the latest Wireshark 3.0.1 with the new capture library (npcap). If it still causes issues at least it can be reported to the npcap devs.

grahamb gravatar imagegrahamb ( 2019-04-16 16:04:22 +0000 )edit
add a comment