This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Cisco AnnyConnect Secure mobility client VPN

0

Hi,

Windows 8 64b, Wireshark 1.8.5

  • instalation OK

Cisco AnnyConnect Secure mobility client VPN - not visible adapter -> nothing captured in this VPN

Can you help me? Or can some new version of Wireshark, compatible with win8, help me?

Pavel

asked 04 Mar '13, 04:57

kailer's gravatar image

kailer
6●1●1●3
accept rate: 0%

2 Answers:

2

More a WinPCap issue than Wireshark. I haven't any experience with this VPN client but it's likely that WinPCap can't use this interface, especially as you say it doesn't show up.

Try Network Monitor (NM) from Microsoft, Wireshark can read captures made by NM.

answered 04 Mar '13, 05:27

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206
accept rate: 22%

Thank you very much. You are right.

The best solution is the new WinPCap 4.1.3 now. It is compatible with Windows 8 and work fine with Cisco client.

bye

(11 Mar '13, 03:14) kailer

1

The 'problem' with the AnyConnect virtual adapter is, that it is disabled until you established a vpn tunnel. I guess that WinPcap is unable to see the adapter as it was disabled when the WinPcap NPF service was started, at least some tests let me assume this. So here is what you can try:

  • establish a VPN tunnel
  • stop Wireshark
  • stop WinPcap NPF service: sc stop npf (in an elevated DOS box - run DOS box as Administrator!!)
  • start WinPcap NPF service: sc start npf
  • start Wireshark

If you don't see the AnyConnect adapter now, WinPcap does not support that type of virtual interfaces and you are out of luck. Please use Microsoft Network Monitor, as @grahamb suggested.

Regards
Kurt

answered 05 Mar '13, 11:31

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%