This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark on pppoe

0

Hi everyone, I have just one network card in my PC (windows 7)and Wireshark displays the address 10.0.0.1 as its only address. I was asked to run the following(thanks Kurt for that) dumpcap -D -M ipconfig /all Following are the results... Can someone explain why don't I get a routable address in Wireshark display(though it captures the packets and displys them fine). Regards I. Lesher

the respond for dumpcap -D -M

 1. \Device\NPF_{7A460928-A487-4219-BEC1-32E09C8B2CEA}  Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)    10.0.0.1    network

Here is the respond for ipconfig /all Actually I cut the answer since it continues with a list of Tunnel adapters which I believe don't contribute here. Regards I. Lesher

Windows IP Configuration

Host Name . . . . . . . . . . . . : kobi-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No

PPP adapter ‡‰…˜ ”‘ ˜‡:

Connection-specific DNS Suffix . : Description . . . . . . . . . . . : ‡‰…˜ ”‘ ˜‡ Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 85.250.119.39(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 DNS Servers . . . . . . . . . . . : 194.90.1.5 212.143.212.143 NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) Physical Address. . . . . . . . . : E0-CB-4E-D3-5C-F1 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::550c:2c41:4fe3:ec1c%11(Preferred) IPv4 Address. . . . . . . . . . . : 10.0.0.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : ‰…™‰™‰ 20 ‰…Œ‰ 2012 18:47:09 Lease Expires . . . . . . . . . . : ‰…‡Ž‰™‰ 26 ‰…Œ‰ 2012 11:47:19 Default Gateway . . . . . . . . . : 10.0.0.138 DHCP Server . . . . . . . . . . . : 10.0.0.138 DHCPv6 IAID . . . . . . . . . . . : 249613134 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-D4-C3-6A-E0-CB-4E-D3-5C-F1 DNS Servers . . . . . . . . . . . : 10.0.0.138 10.0.0.138 NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 23:

Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft 6to4 Adapter #16 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2002:55fa:7727::55fa:7727(Preferred) Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301 DNS Servers . . . . . . . . . . . : 194.90.1.5 212.143.212.143

asked 31 Jul ‘12, 01:43

triplebit's gravatar image

triplebit
1777
accept rate: 0%

edited 31 Jul ‘12, 02:08

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

0

see my latest comment in this question. It's about ppp adapters and WinPcap. You cannot capture on the "virtual" ppp adapter. However, you can capture on the NIC that is connected to the DSL modem.

I believe, WinPcap does not show ppp adapters, as you cannot capture on them anyway...

Regards
Kurt

answered 31 Jul '12, 01:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 31 Jul '12, 03:13

You can use Network Monitor from Microsoft to capture on PPP adaptors, and then load the captures in Wireshark.

(31 Jul '12, 04:48) grahamb ♦

Thanks again Kurt, That explains completely my question. WinPcap has the ability to send packets, by injecting them to the network. Do you think that this feature is also available on the NIC that is connected to the DSL modem? Regrds I. Lesher

(31 Jul '12, 21:53) triplebit

That should work if you do it with the correct encapsulation.

Sample without PPPoE encapsulation!
http://badishi.com/injecting-packets-with-winpcap/

(31 Jul '12, 23:49) Kurt Knochner ♦