This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to capture incoming TCP traffic on Win 10

0

Hi. I'm using a very simple C# console program to send TCP data to a Win 10 tablet that has a cellular connection (using TcpClient). The data is going to a specific IP of that tablet and port 8080. Using another C# console program on the tablet (which uses TcpListener), I'm able to see the packet, but with WireShark, I don't see anything. How do I set up WireShark (latest version) to capture the incoming cellular traffic on port 8080 on Windows 10 x64?

Update 1: If I plug in my Ethernet cable, I see traffic in WireShark. But if I'm on the cellular connection of the tablet, no traffic. Nothing. What am I doing wrong?

Update 2: List of interfaces when WireShark comes up:

  • Intel Ethernet Connection
  • Microsoft Local Area Connection 2
  • Microsoft Wi-Fi
  • Microsoft Bluetooth
  • Microsoft Local Area Connection 12

None of the above have any activity displayed (see image below); only when I plug in the cable do I see activity on the Intel Ethernet Connection.

alt text

Update 3: Here's the list of interfaces after installing npcap. Also note the activity on connection 12 (which previously showed no activity):

alt text

asked 07 Nov '16, 08:03

wireShark95's gravatar image

wireShark95
0124
accept rate: 0%

edited 08 Nov '16, 10:14

Can you confirm the ports being used?

You state that "the data is going to a specific IP of that tablet and port 8080", but then you want to "capture incoming traffic on port 8080" on the PC.

Can you draw a simple diagram of the setup?

(07 Nov '16, 08:51) grahamb ♦

Thanks, @grahamb, for your reply. I might have been inartful in my description: The tablet PC is receiving TCP data on port 8080 and I need to see that incoming information via WireShark. In fact, if it's possible to see any incoming traffic via WireShark, that would be good. Right now I'm seeing nothing -- not even outgoing data.

(07 Nov '16, 09:35) wireShark95
1

So where are you running Wireshark, on the tablet?

If so, what interfaces are listed on the tablet when you start Wireshark?

(07 Nov '16, 10:04) grahamb ♦

@grahamb, yes, running WS on tablet. Please see update to the question above for list of interfaces.

(07 Nov '16, 11:01) wireShark95

One Answer:

1

Is this an interface which cannot be seen by WinPcap? Maybe npcap is able to. You may want to try that, being aware it's still under development.

answered 07 Nov '16, 13:56

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks, @Jaap. That was it! I installed npcap and Wireshark started seeing the cellular data. Do you mind throwing that into an answer below and I'll accept it?

(08 Nov '16, 05:42) wireShark95

Out of interest, does the list of interfaces differ when using npcap?

(08 Nov '16, 06:02) grahamb ♦

@grahamb, please see Update 3 to the question above for the new list of interfaces.

(08 Nov '16, 10:15) wireShark95