This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Interface list is incomplete

I am using windows server 2003 SR2, there are two HP NC373i Multifunction Gigabit Network adapters. One is disabled and #2 is enabled.

When I bring up the Wireshark I only see "Adapter for generic dialup and VPN capture".

This was showing the network adapter last week and I was able to capture. Choosing the "Adapter for generic dialup and VPN capture" doesn't capture any packets (as you would expect).

I have since upgraded wireshark to version 1.4.6 and WinPCap to version 4.1.2 but this doesn't help at all.

The installs and the login were done with administrator privileges.

Tony

interface winpcap adapter npf missing

This question is marked "community wiki".

asked 11 May '11, 10:28

Tony
16●1●1●2
accept rate: 0%

edited 11 May '11, 13:06

cmaynard ♦♦
9.4k●10●38●142

What do you get if you run "tshark.exe -D"? How about if you run "WinDump.exe -D"? You can download WinDump from http://www.winpcap.org/windump/install/default.htm.

(11 May '11, 12:12) cmaynard ♦♦

Thanks for the reply

I tried your suggestions. Both tshark.exe -D and WinDump.exe -D come back with DeviceNPF_GenericDialupAdapter ...

(11 May '11, 12:30) Tony

3 Answers:

See http://www.winpcap.org/misc/faq.htm#Q-4. Since WinDump -D doesn't show the interfaces, this isn't a Wireshark problem, but likely a WinPcap problem.

You might check to see if the npf driver is running. See http://www.winpcap.org/misc/faq.htm#Q-3.

See also this related question here at ask: http://ask.wireshark.org/questions/1281/npf-driver-problem-in-windows-7

answered 11 May '11, 13:05

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Another place to look at it is on the Wireshark wiki: http://wiki.wireshark.org/CaptureSetup/CapturePrivileges

(11 May '11, 13:07) cmaynard ♦♦

NPF is running and I have checked, it is running as administrator.

(11 May '11, 13:28) Tony

Your problem is solved already, but anyway...
Here is another way to check the status or to start the NPF driver:
Go to Start -> Computer -> right-click -> Manage
Select Device Manager
or
Go to Run -> compmgmt.msc

Next you select View -> Show Hidden Devices
Double-click Non-Plug and Play Drivers in the list of devices
Right-click on NetGroup Packet Filter Driver and select Properties.
On the Driver tab you can change the start settings to "Automatic" or "System".

(13 May '11, 15:07) joke

Are you using the 64bit version of Win2K3? If so, are you using the 64bit version of Wireshark? I have heard some people say the 32bit version does not see interfaces on Win7-64 bit.

You state that one of the NICs is disabled. Did you try enabling that NIC to see if both NICs then become visible? As you say the 1st NIC is disabled, I wonder whether that is blocking WinPcap from accessing the second NIC (with the same driver). But this is just a hunch :-)

answered 11 May '11, 13:52

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

I am useing windows 32 bit version. I thought I was but I wanted to check some more. It is MS Windows Server 2003, Standard Edition, 5.2.3790 Service Pack 2. This is 32 bit. The 64 bit version specifically says 64 bit.

I did try to enable the first driver but that didn't help. I also rebooted the server after I did that and the driver came back disabled.

(12 May '11, 12:47) Tony

1	I am not sure that this is the complete answer to this issue. The issue was solved up upgrading to the latest HP NIC driver. answered 13 May '11, 13:28 Tony 16●1●1●2 accept rate: 0%