This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi. I experienced problem when I tried to launch applications in company network after I had established full vpn network access from home => I have obtained IP address(eg. 10.1.1.1) in company network. This 10.1.1.1 was assigned to my PPP Adaptor (shown in ipconfig) and not wireless nic interface.

I am using f5 VPN and windows7.

I turned on wireshark and realised the Capture Interface does not include the PPP Interface assigned with 10.1.1.1.

I googled and saw suggestions that the latest Winpcap 4.1.3 may not support capture over VPN,and I should downgrade to Winpcap 3.1. So I tried to install Winpcap 3.1 on Windows7 but I got error "installation not supported on this OS"

Btw, if this capture over vpn from 10.1.1.1 can work, am I right to assume that wireshark can capture the ip and tcp info for corresponding access over the VPN for analysis and only data is encrypted?

I seek advice from experts like u : )

asked 28 Mar '14, 20:29

walnut23's gravatar image

walnut23
11223
accept rate: 0%


The F5 VPN client should install a virtual network adapter, but I assume you are using the clientless version which does not. The WinPcap FAQ says that it's not possible to capture PPP/VPN connections on Win 7 and some third party VPN implementation are not detected because of their unclean NDIS intermediate driver structure. See http://www.winpcap.org/misc/faq.htm#Q-5

If you can, install the F5 VPN client or use MS Network Monitor instead of Wireshark to capture the traffic.

In general the traffic will be in clear text (if it was not encrypted by an application) on the VPN interface and encrypted on your physical interface.

permanent link

answered 29 Mar '14, 17:19

Roland's gravatar image

Roland
7642415
accept rate: 13%

Thanks for responding.

I have installed the F5 VPN client prior to Wireshark capture with no success(cannot detect PPP adaptor assigned with assigned ip address from VPN gateway)

I have also tried installing MS Network Monitor to capture the traffic with no success(cannot detect PPP adaptor assigned with assigned ip address from VPN gateway)

:(

(02 Apr '14, 01:38) walnut23

Are you using Firepass or APM?

(03 Apr '14, 00:37) Roland
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×103
×72
×45
×4

question asked: 28 Mar '14, 20:29

question was seen: 5,994 times

last updated: 03 Apr '14, 00:37

p​o​w​e​r​e​d by O​S​Q​A