Ask Your Question
0

Why am I not seeing any interfaces other than USBPcap1 on Windows?

asked 2019-04-20 20:49:54 +0000

Pez gravatar image

updated 2019-04-20 23:22:21 +0000

Guy Harris gravatar image

Hello all.

I am new to downloading, installing, and using WireShark. I would like to use it to monitor network traffic on my home wireless router and the devices that are connected to it.

I looked at a tutorial, and there are some videos on YouTube on "How To".

Well, right off the bat, one of the videos I saw on YouTube? The user interface does not resemble mine when launched. I believe I have the latest version of WireShark v 3.0.1 I used the feature "Help", "Check For Updates", and it came back as "You're Up To Date!".

Granted, this video I saw on YouTube goes back quite a few years (it's dated Sept. 4, 2015), so maybe the interface has changed in the intervening years.

Here's a link to the video I'm referring to: link text

After the video starts (around the 6 second mark), you see the left-hand side? Underneath "Interface List"? Down below you see a list of the Wi-Fi's; you could click on one then select Start.

Well, when I launch my WireShark, here's what it looks like: link text

So....did I do something wrong during the install? How do I get it to display properly so that I can select my home wireless network and then monitor its traffic, etc.?

Thanks for any info & help; Pez

edit retag flag offensive close merge delete

Comments

Wireshark has evolved quite considerably since 2015, so any such "guides" from 2015 are likely to be out of date as far as how the UI looks. Indeed our own User Guide requires some updates.

One possible cause for lack of interfaces is that you haven't installed a capture library, Wireshark 3.x (on Windows) comes with npcap and when running the installer you can opt to not install it. Can you copy and paste (into your question or a comment) the contents of the Help -> About Wireshark -> Wireshark dialog as that shows the Wireshark environment including any capture library?

grahamb gravatar imagegrahamb ( 2019-04-21 09:56:36 +0000 )edit

Hi grahamb; thanks for your reply.

OK, I navigated to where you said: Help -> About Wireshark ->

You also put "Wireshark dialog", but I didn't actually see anything spelled out as "Wireshark dialog", so when I go to "Help -> About Wireshark ->", I just Copied the contents of what was there. Here it is:

Version 3.0.1 (v3.0.1-0-gea351cd8) 

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 

Compiled (64-bit) with Qt 5.12.1, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua ...
(more)
Pez gravatar imagePez ( 2019-04-21 18:18:45 +0000 )edit

The content you posted shows that you have npcap installed and that Wireshark has found it, Running on ... libpcap version 1.9.0 (packet.dll version 0.992).

So the issue is why npcap isn't reporting the interfaces you have. Can you run the following command in a cmd prompt and post the output:

sc query npcap
grahamb gravatar imagegrahamb ( 2019-04-21 20:07:24 +0000 )edit

Hi; thanks for getting back to me.

I ran the command line text in a CMD prompt; here's what came back:

C:\WINDOWS\system32>sc query npcap

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

So, I see the word "STOPPED"; why would that be....and how can I Start it? ;-) Pez

Pez gravatar imagePez ( 2019-04-21 23:33:52 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-04-23 10:29:05 +0000

grahamb gravatar image

Unsurprisingly having the npcap driver in state stopped will prevent the locating of capture interfaces. We'll need to check if the service is configured to start, if not make it so and then start it.

Check the service config:

sc qc npcap

On my system I get:

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 1   SYSTEM_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\npcap.sys
        LOAD_ORDER_GROUP   : NDIS
        TAG                : 24
        DISPLAY_NAME       : Npcap Packet Driver (NPCAP)
        DEPENDENCIES       :
        SERVICE_START_NAME :

If the START_TYPE isn't SYSTEM_START, then make it so. This will need an Administrative (elevated) CMD prompt (note the odd spacing is required):

sc config npcap start= system

and now start the service, again an elevated CMD prompt is required:

sc start npcap

As to how you got into this state, there is an npcap installer option to NOT start npcap at system startup, which you may have chosen. Another possible way to fix this is to reinstall Wireshark and\or npcap and make sure it's permitted to start at system startup.

edit flag offensive delete link more

Comments

Yup, that did it! :)

I used the command sc qc npcap, and my service was not running.

I then used the command sc config npcap start= system, and then sc start npcap. And then this time when I ran WireShark, I can see networks listed ;-)

And I think you're right: When I initially installed WireShark, I believe I chose the option to NOT have npcap start at system startup. I thought that launching WireShark would then just have npcap start with it; I guess not :(

So yes, I guess I could always re-install WireShark and choose the option of letting npcap start with system startup.

Say, while I'm here, let me ask this:

Now that I can see the interface properly, yes, I see my network listed, and it's just listed as "Ethernet". I have a DSL combo of modem/ wireless router. I've customized the SSID ...(more)

Pez gravatar imagePez ( 2019-04-25 18:48:06 +0000 )edit

Say, while I'm here, let me ask this:

Please ask that as a separate question. This is a Q&A site; think of it as a "crowdsourced FAQ" rather than as a forum. The goal is to allow users who have a question to search the site, so that if their question has already been asked, and somebody has already answered it, they get an immediate answer to their question without having to ask it and wait for an answer. To make that work well, each question should be asked separately.

Guy Harris gravatar imageGuy Harris ( 2019-04-25 19:03:41 +0000 )edit

The interface is named by your computer, not by the Access Point SSID that it's connected to.

You can set the names of interfaces to anything you like, use "win" key + "r", type ncpa.cpl and hit enter, then right-click any interface and select "Rename".

grahamb gravatar imagegrahamb ( 2019-04-25 19:07:32 +0000 )edit

And to help others who may have the same question, please accept the answer that solved your issue by clicking the checkmark to the left of it.

grahamb gravatar imagegrahamb ( 2019-04-25 19:15:22 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2019-04-20 20:49:54 +0000

Seen: 1,555 times

Last updated: Apr 25 '19

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
about | faq | help | privacy policy | terms of service
Powered by Askbot version 0.10.2