This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Recently updated wireshark to 2.2.5 version and during installation also installed USBPcap too. Now during launch of wireshark application I can only see USBPcap1 2 and 3 options for capture interfaces.

Hence I am unable to see options to capture Ethernet or WLAN interfaces

Screenshot (Issue 1) attached alt text

My question is how do I get it back to alt text

asked 05 Mar '17, 05:06

moldyoregan's gravatar image

moldyoregan
6112
accept rate: 0%

Did you install WinPcap during Wireshark installation process? That's the library used to capture Ethernet interfaces.

Please paste the content of Help -> About Wireshark window

PS: note that the first capture is the newer Qt based interface on Windows while the second is the old GTK based interface on macOS.

(05 Mar '17, 06:16) Pascal Quantin

Having the same issue here. Now having issues your forum here, when I pasted my Help->About Wireshark like Pascal Quentin asked, I get this immediate response:

"Akismet believes your answer is spam. We're sorry, but Akismet believes your answer is spam. If you believe this is an error, please contact the forum administrator."

(06 Jul '17, 09:24) iggirex

Try to post it as a Comment to the Question rather as an Answer to it (which it definitely isn't anyway).

(06 Jul '17, 09:27) sindy

Found this on StackOverflow and immediately solved my issue:

In Windows, with Wireshark 2.0.4, running as Administrator did not solve this for me. What did was restarting the NetGroup Packet Filter Driver (npf) service:

Open a Command Prompt with administrative privileges.

Execute the command "sc query npf" and verify if the service is running.

Execute the command "sc stop npf" followed by the command "sc start npf".

Open WireShark and press F5 (or "refresh interfaces")

Source: http://dynamic-datacenter.be/?p=1279

permanent link

answered 06 Jul '17, 10:11

iggirex's gravatar image

iggirex
62
accept rate: 0%

Nice. So the installer doesn't (re)start the npf after (re)installing it, as it normally should, I guess it is worth filing a bug, providing the circumstances (whether you have replaced an old version of WinPcap, or re-installed the same version once again, or was it a clean install?)

(06 Jul '17, 10:26) sindy

@sindy, it would be the WinPCap installer that is responsible for starting npf. As this doesn't seem to have generally been an issue, I suspect it's isolated to "odd" setups or where folks have been fiddling.

If this issue can be demonstrated repeatably then filing a bug is worthwhile.

(06 Jul '17, 14:09) grahamb ♦

For the record - I have fallen to the same rabbit hole after rolling back to Windows "point of recovery" (I don't know the proper English name), now the only way to see other than extcap (which includes USBPcap) interfaces is to run Wireshark as administrator, which is a bad idea. Tried to reinstall WinPcap, assuming that the access control setting is damaged, but wasn't allowed to remove it. Will provide more information after next reboot.

(20 Jul '17, 03:30) sindy

@sindy,

There have been reported issues with npcap about similar issues after the creators update. Did you have npcap installed?

On my 3 machines that have received the Creators Update I have had no issues, although at least 2 of them did NOT have npcap for certain.

(20 Jul '17, 04:12) grahamb ♦

I gave a try to npcap mostly for its wireless monitoring capabilities a few months ago, but I've got WinPcap installed back since at least three months. The thread you've pointed me to mentions rather issues when replacing WinPcap by NPcap.

After reboot, I've uninstalled WinPcap (4.1.3) and re-installed it (alone, not along with Wireshark) and Wireshark started working as it always did.

Ordered by time: I've first noticed the issue after the Windows rollback, still with Wireshark 2.2.7, then have upgraded to 2.4.0 without replacing WinPcap and the issue was still there. This installation asked for a reboot so I've done it but it hasn't solved the issue. Next was the unsuccessful attempt to reinstall WinPcap, and last was another reboot followed by successful reinstall of WinPcap which has solved the issue.

(20 Jul '17, 13:37) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×20

question asked: 05 Mar '17, 05:06

question was seen: 10,986 times

last updated: 20 Jul '17, 13:37

p​o​w​e​r​e​d by O​S​Q​A