This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

win7 64bit wireshark 1.8.2 only can capture receive packets

0

I can get no http.request.method == GET packets at all~ I can't see my sent packets

asked 14 Sep '12, 00:44

qsLampard's gravatar image

qsLampard
1111
accept rate: 0%

edited 21 Sep '12, 08:36

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

Interesting enough, or not, I am experiencing the same issue as you. I am running an IDS via a tap between two routers and I only see outbound traffic, nothing inbound even though the host is able to connect with no issues. The packets are going through but I am not able to see them. I've tried multiple hosts as an IDS and they all are Win 7 x64.

Out of curiosity - do you only see echo requests and no replies when you ping something?

What happens when you use Microsoft Network Monitor?

(26 Sep '12, 15:18) DigitalSyn

I can see the echo replies but no requests~ By the way, I don't know how to use Microsoft Network Monitor

(26 Sep '12, 21:23) qsLampard

Interesting again, I am experiencing the same issue.

MS NETMON, took me a little bit to figure it out. Can't tell you what to do of course but I would download, install it and fire it up. I don't have it loaded on the host I am at (can't install - no amdin) but there is an option to start capture, and then another to begin. When I head home tonight I will do a quick tut.

(27 Sep '12, 07:10) DigitalSyn

Sorry partner for the late response. Actually I was rebuilding my IDS from the ground up for the past 4 days and I may have have a possible solution for you. Drop Win 7 x64; it is most likely how Microsoft handles the driver for the NIC cards and that is affecting how we see, or not see, full PCAP sessions. I didn't try a 32-bit version of Win 7; I went ahead and loaded Ubuntu 12.04 and I have been sipping on wine and eating cheese watching all of my PCAP on the screen.

Good luck ~

(01 Oct '12, 16:21) DigitalSyn

actually, i have tried 32-bit version of Win 7, and it worked~~

(01 Oct '12, 21:14) qsLampard

Were you using the x64 version of Wireshark on Win7 x64? I and many colleagues capture all the time on Win7 x64 using the 32 bit version of Wireshark without any issues at all.

(01 Oct '12, 23:46) grahamb ♦

From a previous post - it looks like Wireshark 32-bit should work as well. Give that a go, as well qsLampard, on your Win7 x64 rig.

(02 Oct '12, 12:02) DigitalSyn
showing 5 of 7 show 2 more comments

One Answer:

0

See only-inbound-traffic and search for other questions related to missing outbound traffic. Keywords inbound and outbound may help help.

See InterferingSoftware

In my case, installed VPN software prevented seeing outbound traffic and had to be uninstalled.

answered 08 Sep '16, 05:51

kbulgrien's gravatar image

kbulgrien
63
accept rate: 0%

edited 08 Sep '16, 05:53