This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

capture on vpn tunnel nic

0

hi all,

In my company we have some sort of pre-configured labs that can be deployed within minutes for learning / testing purposes. I'm in the need to simulate a scenario where a client will connect to corporate network via VPN. I've deployed the lab consisting of two domains each running Exchange. I've selected on of the machines and installed openvpn and coofiguered it. each of this machines has an internal IP from 192.x.x.x range and an "external" ip 10.x.x.x. on my laptop istalled vmware workstation with an Windows OS and configured openvpn accordingly. the server running openvpn is getting an ip of 10.8.0.1 and the client (inside vmware workstation) 10.8.0.6 i can ping both ip i can access the admin share on both hosts. What i don't uderstand why i cannot select the nic on the client that is created as part of openvpn i can only see my LAN NIC and when i did a trace it establishes the connectio from it;s ip to th;e servers external ip . . . how would i be able to join the domain when they only talk over 10.8.x.x but i cannot ping the "internal" ip of the server ?

probably this does make sense but let's try :/

asked 15 Dec '15, 12:32

adasko's gravatar image

adasko
86343842
accept rate: 0%

edited 16 Dec '15, 05:35

grahamb's gravatar image

grahamb ♦
19.8k330206

Sorry, this isn't a Wireshark question.

(16 Dec '15, 03:58) grahamb ♦

@grahamb, I think it is a Wireshark question, as the actual question hidden in the noise is "why I cannot capture at TUN (or TAP) virtual interface because Wireshark doesn't even show it in the interface list". If you say "not a Wireshark question" because it is actually a WinPcap question, you're definitely right formally, but for most users Wireshark on Windows includes WinPcap.

I was hesitant to answer "it is because the TUN/TAP driver does not provide an API to which WinPcap could hook" because I am not sure it is true, but nevertheless I think it is not an off-topic question.

(16 Dec '15, 05:02) sindy

@sindy,

Poor reading on my part. I've reopened it.

(16 Dec '15, 05:34) grahamb ♦

One Answer:

0

As per the comment from @sindy, it's likely because WinPCap doesn't see the TAP adaptor created by OpenVPN.

Can you see the adaptor listed in the output of tshark -D?

answered 16 Dec '15, 05:51

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

hi guys,

i can see only my LAN NIC alt text

alt text

BR

Adam

(17 Dec '15, 02:21) adasko

Ok, so your version of WinPCap doesn't see that adaptor. On Win 8.1, I have the same tap adaptor for an SSL VPN in the exact same state as your adaptor, and WinPCap can see it.

What's your OS, and WinPCap version? The WinPCap version can be seen in the Help -> About dialog of Wireshark (in the running on ... bit).

(17 Dec '15, 03:08) grahamb ♦

OS is W2K8 R2 Enterprise SP1 WinPcap version 4.1.3 (packet .dll Version 4.1.0.2980)

But I'm able to see the the adaptor when running same Wiershark version on Windows 7 Enterprise SP1 host ...

alt text

(17 Dec '15, 04:10) adasko

Unfortunately I'm out of ideas why WinPcap on your Server 2K8 can't see the NIC, whereas the two client OS's discussed can.

(17 Dec '15, 04:19) grahamb ♦