When i run WireShark, this one Popup. The capture session could not be initiated (failed to set hardware filter to promiscuous mode). Please check that "DeviceNPF_{62909DBD-56C7-48BB-B75B-EC68FF237032}" is the proper interface. Help can be found at: http://wiki.wireshark.org/WinPcap http://wiki.wireshark.org/CaptureSetup What should I do for it? asked 03 Mar '11, 06:46  taehunzzang edited 03 Mar '11, 23:21  Guy Harris ♦♦ |
2 Answers:
If (as Landi suggested) this is a wireless adapter, some of them don't support promiscuous mode on Windows. Try un-checking the "Promiscuous mode" checkbox in the "Capture options" dialog box. answered 03 Mar '11, 11:51 Guy Harris ♦♦ I use wireless card. I tried "un-checking the "Promiscuous mode" checkbox in the "Capture options" dialog box." It work. Thank you Guy Harris and PaulStewart. (03 Mar '11, 14:44) taehunzzang One of my laptops does that, but it doesn't produce the error. It simply doesn't capture anything. (03 Mar '11, 16:10) Paul Stewart Yes, that's driver-dependent - some drivers explicitly reject attempts to set promiscuous mode, others just go into a mode, or put the adapter into a mode, where nothing is captured. A question in the Wireshark FAQ and an item in the CaptureSetup/WLAN page in the Wireshark Wiki both mention this. (03 Mar '11, 23:20) Guy Harris ♦♦ I am having the same error. I have an IEEE 802.11n wireless card on my WinVista 64-bit system. I have downloaded the latest versions of Wireshark and WinPcap. Can you please explain how can i try disabling the promiscuous mode? Under Capture options i do not see that option. Capturing packets does work if I use the LAN connection but i would like this other option to work. Is this supported? (04 Mar '11, 21:10) elirqv76 I finally was able to disable the promiscuous mode and i can capture!Thank you. (04 Mar '11, 21:16) elirqv76 For me I do receive packet captures when I uncheck promiscuous mode, but I question if I am reaching full capabilities by running this way. (08 Sep '11, 21:36) wshrkmkn If you're not in promiscuous mode, you're only capturing traffic sent by or to your machine, and broadcast and multicast packets seen by your machine. If you want to capture traffic between other machines on your wireless network, you'd need to capture in monitor mode, which WinPcap currently doesn't support (and couldn't support on Windows XP or earlier). (09 Sep '11, 09:39) Guy Harris ♦♦ Thanks for the tip, the Capture option had "Capture packet in promiscuous mode", just uncheck and wireshark be ready to capture in wireless adapter. Great help!! (11 Oct '11, 10:09) Eliodoro I disabled the promiscuous mode in capture options, but still Im seeing this issue. Im trying with Atheros Card with latest wireshark 2.0 (17 Feb '16, 02:59) Deepak Dominic showing 5 of 9 show 4 more comments |
That is actually more likely an issue with winpcap/libpcap. Wireshark simply happens to use it. What type of interface is this? Does it work properly if you deselect promiscuous mode? answered 03 Mar '11, 10:01  Paul Stewart |
wireless card ?