This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello all, I'm running the latest version of Wireshark as part of the Cisco curriculum. All of our machines are on Windows 7 Enterprise with all the latest updates and service packs and Windows Server 2008 R2. When the students try to change the interface card, there is nothing listed in the box. I logged in with my ID to the domain figuring it was a rights issue, but I can't see it either and I have administrator rights to the machine if not the domain,but my account gets the same error. The only machine in the lab that is working is the instructor machine, which is connected to a test domain setup to a Cisco demo server. I'm pretty positive it a setting in Active Directory, but which one? Any ideas?

asked 10 Oct '12, 04:51

John%20Swendsen's gravatar image

John Swendsen
1112
accept rate: 0%

What are you trying to change? This doesn't sound like a Wireshark question, more a Windows one.

(10 Oct '12, 04:56) grahamb ♦

When the students try to change the interface card, there is nothing listed in the box.

what does that mean? Where do you change the interface card?
Which "box" do you mean?

Can you post a screenshot? That would make troubleshooting a lot easier...

(10 Oct '12, 05:03) Kurt Knochner ♦

I open up Wireshark, go to Capture, Interfaces, and instead of seeing a list of the adapters, I get this error. "There are no interfaces on which a capture can be done."

alt text

(10 Oct '12, 06:48) John Swendsen

Logged in with my account and generated the same error, applied your command and it changed the configuration, so I rebooted and logged in as one of the students and it seems to work. I notified the class instructor and I'm going to have him check and make sure it does what it needs him to do, but looks like you solved it. Thanks.

(11 Oct '12, 05:07) John Swendsen

Good! If you think it is the correct answer, you can mark is as such (check mark).

(11 Oct '12, 05:18) Kurt Knochner ♦

I open up Wireshark, go to Capture, Interfaces, and instead of seeing a list of the adapters, I get this error. "There are no interfaces on which a capture can be done."

O.K. sounds like a priviledge problem while accessing the NPF driver. Did you select the option 'start winpcap service "NPF" at startup' while you installed Winpcap?

If no: please re-install WinPcap and select that option.
If yes: check if the NPF service is running. In a DOS box: sc qc npf

Regards
Kurt

permanent link

answered 10 Oct '12, 07:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Ran the command and got this. All the machines should have the same settings as they were ghosted from the same master image, but I can't tell if one of the instructors changed the settings on the machine not on the AD Domain.

alt text

(10 Oct '12, 10:44) John Swendsen

If you change the START_TYPE from DEMAND_START to AUTO_START your problem should be gone.

sc config npf start= auto

(10 Oct '12, 11:30) Kurt Knochner ♦

Thanks, spoke with the CISCO instructor and says it's working fine now. AD seems to block the on demand start for the students.

(12 Oct '12, 06:09) John Swendsen

good. If you like, you can accept may answer by clicking on the check mark next to the answer.

http://ask.wireshark.org/faq/

(13 Oct '12, 01:39) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×10
×5

question asked: 10 Oct '12, 04:51

question was seen: 1,877 times

last updated: 13 Oct '12, 01:39

p​o​w​e​r​e​d by O​S​Q​A