Has anyone seen this issue and can offer help? This is the second time I have encountered this issue, with a complete OS wipe and reinstall and a change in the additional NIC between the two times. OS is Windows 7 Ultimate x64, onboard NIC is a Realtek connected to my LAN. Everything works perfectly until...
I'm setting up a dedicated monitor port to connect to my Cisco lab, using an additional NIC on the PC and installing Wireshark/winpcap. That in itself works, but I start to get a lot of network problems:
. Pages in my browser (Firefox and IE) often fail to load compeltely, or I get a page of code, a page that never stops loading or just a blank page. . Images in web pages often look garbled or truncated. . Sometimes I get browser errors such as SSL failures or page encoding errors. . FTP transfers (in any client) give corrupt or truncated files, without giving any error messages. . Problems browing fileshares on the LAN and using RDP.
The above happen so often that it's completely obvious there's a problem, and when it started. I've just done a system restore to before installing Wireshark/winpcap, and everything is back to normal.
I didn't change anything in wireshark's configuration and the only thing I did to the NIC was to disable all the services in network properties. I don't know if that's the right thing to do, but it seems to work for a quiet monitor port and I cannot see how it should cause my problems. Besides, even after reinstating all the network protocols I still had the problems, until I did the roll-back.
Any hints as to what to look for here? I'm about to start single-stepping through setting this up again, to see if I can isolate the cause. Not that there are many steps...
asked 20 Sep '15, 15:21
I see two possible problems:
P1: If the problems only occurs while you capture traffic, it could be related to IP forwarding being enabled on the Monitoring PC, which will then inject the monitored packets into the network again.
P2: The monitoring port on your switch could be an access port. Some switches don't disable access functionality on monitor ports. So, your PC would get a second IP address from the same subnet via DHCP with a second default route, which could cause problems (depends on the metric of the default routes). You'll see that with ipconfig /all.
In both cases, please disable the IPV4 and IPV6 bindings on the NIC you are using to capture traffic to prevent those problems.
answered 21 Sep '15, 10:12
Kurt Knochner ♦