This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When I run wireshark it stops at random times telling me: The network adapter on which the capture was being done is no longer running; the capture has stopped.

tshark just exists without any message.

Some more context:

  • I am running linux.
  • I am trying to capture wifi in monitor mode with a usb wifi dongle.
  • I have checked dmesg and syslog and kern.log but couldn't find anything except information that the device was entering and leaving promiscuous mode.

Does anybody have an idea what the problem might be or how to debug?

asked 02 Jul '17, 07:20

Monkeybusiness's gravatar image

Monkeybusiness
6224
accept rate: 0%

edited 03 Jul '17, 02:19

This usually happens when the network card loses its link. Can you check if that was the case? And if not, try to capture with dumpcap instead of tshark to check if it's related to packet decodings?

(02 Jul '17, 08:15) Jasper ♦♦

Ah, maybe I should have mentioned: I'm capping wifi!

(02 Jul '17, 09:43) Monkeybusiness

If you are not capturing in monitoring mode, it could well be that the network card loses association with the AP for a while, which has similar consequences like cable disconnection for wired interfaces, but it is just a wild guess.

(02 Jul '17, 09:54) sindy

I am capturing in monitor mode.

(02 Jul '17, 15:06) Monkeybusiness

Assuming your on Linux, use dmesg and other system logs. You can get the status of the interface with iw dev, iwconfig, and ifconfig.

With no logs, no OS noted, and no hardware description, it's very difficult to help you.

(02 Jul '17, 17:05) Bob Jones

@bobjones I added some more context

(03 Jul '17, 23:54) Monkeybusiness
showing 5 of 6 show 1 more comments

The extremely lame result of trying further is that I think some network manager or similar was interfering.

If you have the same problem:

  • The guide at https://wiki.wireshark.org/CaptureSetup/WLAN has a section on how to set the interface to manual mode which, I assume, means that the network manager will leave it alone.
  • Also note that airmon-ng will tell you which running processes might be problematic so at least for debugging you could try killing them all and see if that solves the problem.

Somebody also warned me that for USB devices it might be a power problem and it might help to try with an externally powered hub. Not relevant for me, but maybe for you.

permanent link

answered 05 Jul '17, 00:11

Monkeybusiness's gravatar image

Monkeybusiness
6224
accept rate: 0%

edited 05 Jul '17, 00:12

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×23

question asked: 02 Jul '17, 07:20

question was seen: 2,617 times

last updated: 05 Jul '17, 00:12

p​o​w​e​r​e​d by O​S​Q​A