Hi All, Problem is: No Interfaces... System: Windows Server 2008 R2 Installed: Wireshark Version 2.0.1, WinPcap Version 4.1.3 I already tried to start the NPF service as admin, but no effect. NPF service can not start Error 1275 Also to start Wireshark as Admin, has no effect. Usually I tried all comments which I found online but I got no solution. Please, I hope here is somebody who can help me. Thanks asked 06 Feb '16, 07:51  vecdatra |
3 Answers:
Without NPF you won't see interfaces, running Wireshark has no influence on that. Tend to the OS installation/registry, were the 1275 error seems to come from. answered 07 Feb '16, 05:33  Jaap ♦ edited 07 Feb '16, 08:31  grahamb ♦ |
Apparently error 1275 is "ERROR_DRIVER_BLOCKED". Not sure why you are getting this error. Try un-installing WinPcap, reboot, ensure there is no file %WINDIR%\System32\Drivers\npf.sys left over, and then install WinPcap again on its own from the WinPcap download page. answered 07 Feb '16, 08:38 grahamb ♦ |
Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and works on Vista and later OS. The latest version is Npcap 0.05 r10: answered 09 Feb '16, 08:48  Yang Luo Hi Luo, I uninstalled the WIinPcap and installed the programm Npcap. After installation, I did an reboot and I started wireshark but the same message as before. No interface. ;o( Which service should I check for Npcap? Thanks (11 Feb '16, 10:50) vecdatra Hi vecdatra, I have a few questions. Does Npcap install successfully on your machine? If yes, launch a command prompt with Administrator privilege and run "net start npf" to see what happens. BTW, you can launch ncpa.cpl to see whether you have disabled all your adapters? If an adapter is disbaled in ncpa.cpl, it will not show up in the list. (11 Feb '16, 21:16) Yang Luo Hi, cmd as admin and then "net start npf" shows the same error message as before. Error code 1275, driver could not be loaded. Installation itself (of Npcap) was succesful without any error. ncpa.cpl shows only one adapter and this adapter is enabled. If this would be disabled, the connection to my server is not possible anymore. (13 Feb '16, 03:54) vecdatra Can you show me the C:\Program Files\Npcap\npf.sys file's Properties -> Details -> File description? It should be the right version: For 32-bit Windows should be "npf.sys (NT6 x86) Kernel Filter Driver" For 64-bit Windows should be "npf.sys (NT6 AMD64) Kernel Filter Driver" For your case (Windows Server 2008 R2), it should be "AMD64" instead of "x86" Also run these two commands to see what happens: NPFInstall.exe -iw NPFInstall.exe -i (13 Feb '16, 08:06) Yang Luo |
Hi Grahamb, They is no change. I unistalled the WinPcad and did an reboot. After reboot, I installed the WinP again and checked the npf service but it doesn´t work. Also no effect to try the service start as admin. Same error message. I´m realy not sure what I can do to run wireshark on the server.
If somebody has any other idea, please let me know. thanks
Are there any errors in the Event Log relating to the driver. Try starting the service again as admin and check the Event Log for entries.