No Interfaces - Windows

Question

I have recently installed WireShark and WinPCap. During the install, everything seemed to be fine. During my first launch, I got an error somewhere along the lines of "Child dumpcap closed sync pipe prematurely." I read and read and read to finding no solution. I unistalled everything, re-downloaded the 1.7.1 Developer version of WireShark and downloaded WinPCap version 4.1.2 directly from winpcap.org.

After installing both, I now get no errors, but also have no interfaces like before. When clicking Capture -> Interfaces... I receive the following message, "There are no interfaces on which a capture can be done." I have tried as much as I could to try to get my NICs to appear, but to no avail again.

I tried using WinDump -D and it showed both of my adapters so I'm wondering where the issue lies.

I'm running Windows 7 Ultimate on a NetBook. I believe I have all of the latest updates for drivers and Windows.

Thank you for any information.

Answer 1

As WinDump uses exactly the same capture mechanism as wireshark (and tshark etc.), that is WinPCap, it seems odd that WinDump can display interfaces but Wireshark can't.

There should be no difference between the version of WinPCap installed via the Wireshark installer and that directly from winpcap.org.

Have you tried tshark -D? Have you tried the Windows "standard repair" of rebooting the machine?

Answer 2

0

please download the latest version of wireshark which is 2.2.1 and winpcap 4.1.3.

if npf driver is not starting then also interfaces will not be started

To start npf driver :

run cmd in administrator mode

enter code: net start npf. The service will be started and interfaces will be seen.

if not through this start wireshark also in administrator mode

This answer is marked "community wiki".

answered 01 Nov '16, 10:23

karan9537
11●2●2●5
accept rate: 0%

Thank you for the answer, but the OP is probably long gone in the 4 years since the question was asked.

Please also do not recommend that anyone run Wireshark with Administrator privileges, it's not necessary and can actually be dangerous for the host system.

(01 Nov '16, 10:33) grahamb ♦

I started having the exact same issue this morning on my Win10Pro PC. I uninstalled WinPCAP, and NPCAP, reinstalled Wireshark with WinPCAP 4.1.3 and still Wireshark shows no interfaces that can be captured on.

I see the NPF service running.

SERVICE_NAME: npf
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

TSHARK -D yields...

"tshark: There are no interfaces on which a capture can be done"

DUMPCAP -D yields....

c:\Program Files\Wireshark>dumpcap -D
1. \Device\NPF_{1B4ACF91-D052-45F8-A690-C3019D84C27C} (Wireless Network Connection)
2. \Device\NPF_{8CE18B19-0F74-4CB1-87C7-C9A413898079} (Local Area Connection)
3. \Device\NPF_{913FCDC3-03F2-4C84-A390-44185F2A83A8} (Local Area Connection* 2)

(29 Nov '16, 06:58) Rooster_50

Did you install any extcap utilities when re-installing Wireshark? If so, try uninstalling, rebooting and reinstalling without the extcap utilities. You might also consider uninstall usbpcap if that's installed.

(29 Nov '16, 07:12) grahamb ♦

I haven't, but will try that. In the meantime, I installed NPCAP 0.78, stopped the NPF driver, and now see all of the interfaces including the NPAP created loopback interface.

(29 Nov '16, 07:20) Rooster_50

Same results. Uninstalled Wireshark, WinPCAP, USBPCAP, NPCAP. Rebooted. Installed Wireshark, no extcap utilities, no USBPCAP. Queried NPF driver and running. Launch Wireshark, no capture interfaces found. Installed NPCAP, interfaces discovered.

Very frustrating, but will continue with NPCAP going forward.

(29 Nov '16, 07:59) Rooster_50