This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi All, Problem is: No Interfaces... System: Windows Server 2008 R2 Installed: Wireshark Version 2.0.1, WinPcap Version 4.1.3 I already tried to start the NPF service as admin, but no effect. NPF service can not start Error 1275 Also to start Wireshark as Admin, has no effect. Usually I tried all comments which I found online but I got no solution. Please, I hope here is somebody who can help me.

Thanks

asked 06 Feb '16, 07:51

vecdatra's gravatar image

vecdatra
6112
accept rate: 0%


Without NPF you won't see interfaces, running Wireshark has no influence on that. Tend to the OS installation/registry, were the 1275 error seems to come from.

permanent link

answered 07 Feb '16, 05:33

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

edited 07 Feb '16, 08:31

grahamb's gravatar image

grahamb ♦
19.8k330205

Apparently error 1275 is "ERROR_DRIVER_BLOCKED". Not sure why you are getting this error.

Try un-installing WinPcap, reboot, ensure there is no file %WINDIR%\System32\Drivers\npf.sys left over, and then install WinPcap again on its own from the WinPcap download page.

permanent link

answered 07 Feb '16, 08:38

grahamb's gravatar image

grahamb ♦
19.8k330205
accept rate: 22%

Hi Grahamb, They is no change. I unistalled the WinPcad and did an reboot. After reboot, I installed the WinP again and checked the npf service but it doesn´t work. Also no effect to try the service start as admin. Same error message. I´m realy not sure what I can do to run wireshark on the server.

If somebody has any other idea, please let me know. thanks

(07 Feb '16, 13:40) vecdatra

Are there any errors in the Event Log relating to the driver. Try starting the service again as admin and check the Event Log for entries.

(11 Feb '16, 14:15) grahamb ♦

Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and works on Vista and later OS.

The latest version is Npcap 0.05 r10:

https://github.com/nmap/npcap/releases

permanent link

answered 09 Feb '16, 08:48

Yang%20Luo's gravatar image

Yang Luo
9117
accept rate: 4%

Hi Luo, I uninstalled the WIinPcap and installed the programm Npcap. After installation, I did an reboot and I started wireshark but the same message as before. No interface. ;o(

Which service should I check for Npcap?

Thanks

(11 Feb '16, 10:50) vecdatra

Hi vecdatra, I have a few questions.

Does Npcap install successfully on your machine? If yes, launch a command prompt with Administrator privilege and run "net start npf" to see what happens.

BTW, you can launch ncpa.cpl to see whether you have disabled all your adapters? If an adapter is disbaled in ncpa.cpl, it will not show up in the list.

(11 Feb '16, 21:16) Yang Luo

Hi, cmd as admin and then "net start npf" shows the same error message as before. Error code 1275, driver could not be loaded. Installation itself (of Npcap) was succesful without any error. ncpa.cpl shows only one adapter and this adapter is enabled. If this would be disabled, the connection to my server is not possible anymore.

(13 Feb '16, 03:54) vecdatra

Can you show me the C:\Program Files\Npcap\npf.sys file's Properties -> Details -> File description? It should be the right version:

For 32-bit Windows should be "npf.sys (NT6 x86) Kernel Filter Driver"

For 64-bit Windows should be "npf.sys (NT6 AMD64) Kernel Filter Driver"

For your case (Windows Server 2008 R2), it should be "AMD64" instead of "x86"

Also run these two commands to see what happens:

NPFInstall.exe -iw

NPFInstall.exe -i

(13 Feb '16, 08:06) Yang Luo
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×254
×72
×52
×7

question asked: 06 Feb '16, 07:51

question was seen: 2,118 times

last updated: 13 Feb '16, 08:08

p​o​w​e​r​e​d by O​S​Q​A