OSQA is unmaintained. Help us figure out where to go from here.

Hello, everyone. My name is Nick.

I installed Wireshark 2.4.0 32bit USBPcap 1.2.0.1 WinPCAP 4.1.3

and npf works as below,

C:\Users\tech>sc query npf

SERVICE_NAME: npf TYPE : 1 KERNEL_DRIVER STATE : 4 RUNNING (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0

but I can't find my Ethernet Interface and Wireless interface on Wireshark I open as Administrator.

Does anyone know how to find them?

asked 31 Jul, 22:34

tekuteku8882's gravatar image

tekuteku8882
6112
accept rate: 0%

As you are not alone but on the other hand only few people experience this, can you please check the following points?

  • open C:\Program Files\Wireshark (or wherever else you have installed Wireshark) and open a folder named extcap there. In this folder, rename USBPcapCMD.exe to something like USBPcapCMD.exe.backup. Then run Wireshark and check whether the network interfaces are visible.

  • if the above doesn't help, uninstall 2.4.0 and install 2.2.8 without re-intstaling WinPcap and USBPcap. Run 2.2.8 and check the result.

  • if that doesn't help either, uninstall 2.2.8 an reinstall it including uninstallation and re-installation of WinPcap

(31 Jul, 23:56) sindy

Dear Sindy,

Thank you for your help.

open C:\Program Files\Wireshark (or wherever else you have installed >Wireshark) and open a folder named extcap there. In this folder, rename >USBPcapCMD.exe to something like USBPcapCMD.exe.backup. Then run >Wireshark and check whether the network interfaces are visible.

→Result: no interface with the error message "No Interfaces found"

if the above doesn't help, uninstall 2.4.0 and install 2.2.8 without >re-intstaling WinPcap and USBPcap. Run 2.2.8 and check the result.

→Result: No Ethernet Interface and Wireless interface. Only USBPcap 1 and 2 are visible.

if that doesn't help either, uninstall 2.2.8 an reinstall it including >uninstallation and re-installation of WinPcap

→Result: No Ethernet Interface and Wireless interface. Only USBPcap 1 and 2 are visible.

(01 Aug, 01:44) tekuteku8882

Am I right when I assume that you've installed a 32-bit version of Wireshark because your system is a 32-bit one and so the installer proposed by the Wireshark web was a 32-bit one? What is your exact OS?

(01 Aug, 01:50) sindy

Do you have any Non-Windows endpoint av or vpn software installed?

(01 Aug, 02:24) grahamb ♦

Can you open settings of the network interface in Windows and place here screenshots of the "properties" window where all the protocols (like IPv4, IPv6 etc.) and other properties are listed? You'll likely need several screenshots to show all items of the list as the window size is fixed.

(01 Aug, 02:49) sindy

Dear Sindy and Grahamb,

Thank you for your help.

My computer: Windows 7 professional 32bit

Ethernet interface: Intel(R) Ethernet Connection I218-LM

Wireless interface: Intel(R) Dual Band Wireless-N 7260

Wireshark:

(01 Aug, 17:51) tekuteku8882

I suppose there are no more properties in the lists (no scrollbar shown, right)?

So in Wireshark, go Capture -> Options and press the topmost button on the right - button (in English it is called Manage Interfaces...), are there any interfaces listed in the window which opens? If yes, are there checkmarks in the checkboxes?

(01 Aug, 22:54) sindy

Dear Sindy,

Thank you for your help.

There are only USBPcap interfaces:

(02 Aug, 01:43) tekuteku8882

Well, calling it help is an overstatement so far :-) I'm just trying to find out what the issue may be.

If you go to command line and run C:\Program Files\Wireshark\dumpcap -D, do you also get only these two interfaces?

Also, you haven't explicitly answered @grahamb's question regarding any network security software (antivirus, firewall, ...)

(02 Aug, 01:49) sindy

Dear Sindy and Grahamb,

Thank you for your help.

I installed Kaspersky Endpoint Security 10 for Windows but it is disabled now. About default Windows Firewall, it is disabled. alt text

alt text

dumpcap -D result:

alt text

(02 Aug, 22:34) tekuteku8882

Unfortunately when endpoint AV has previously been causing issues, it had to be removed entirely, not just disabled.

(03 Aug, 00:00) grahamb ♦
  • -D and -d parameters of dumpcap have a different meaning, but luckily -d didn't prevent dumpcap from checking for interfaces so no need to post the result with -D

  • many security applications use filters at network interfaces which
    a) hook in at the same place like the npf does and
    b) are not removed when the software is deactivated
    So please disconnect your machine from the internet, uninstall Kaspersky Endpoint Security, and try again. Then you can install it back and connect back to the internet.

(03 Aug, 00:02) sindy
showing 5 of 12 show 7 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,609

question asked: 31 Jul, 22:34

question was seen: 308 times

last updated: 03 Aug, 00:02

p​o​w​e​r​e​d by O​S​Q​A