15

I want to capture traffic on Ethernet 4 but you can see that Ethernet 4 is not present in Wireshark network interface though Ethernet 4 is present in Networking and sharing center.

Screenshot of interface list:

enter image description here

Screenshot of network&sharing center:

enter image description here

I use windows 10 and latest version of wireshark- 2.0.4

chicks
  • 3,639
  • 10
  • 26
  • 36
defalt
  • 249
  • 1
  • 2
  • 5
  • Your device may not be capable of running in promiscuous mode. – D34DM347 Jul 14 '16 at 15:40
  • winpcap driver enabled on that nic ? – yagmoth555 Jul 14 '16 at 15:41
  • Yes. winpcap is installed and run. winpcap driver comes with the installation of wireshark. – defalt Jul 14 '16 at 15:44
  • I capture packets in promiscuous mode most of the time but this time the targeted interface is missing on which I want to run capture. Even if I disable promiscuous mode the interface will still not be there so promiscuous mode is not a problem. – defalt Jul 14 '16 at 15:46
  • 2
    winpcap will only see interfaces that are present in Windows when winpcap starts. If winpcap is loaded at startup and the interface has been added later (or is slow to register with Windows?) then Wireshark won't see it. You can stop and start winpcap with "net stop npf" and "net start npf" to see whether this is the case. – marctxk Jul 14 '16 at 15:57

5 Answers5

12

I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.

473183469
  • 1,350
  • 1
  • 12
  • 23
user395287
  • 121
  • 1
  • 3
  • Saved my day, thanks. – kR105 Aug 02 '19 at 09:25
  • 2
    In case someone comes across this like I did, this answer _did not_ work for me on Windows 10, but installing [Npcap](https://nmap.org/npcap/#download) (suggested [here](https://ask.wireshark.org/question/10104/why-does-wireshark-not-show-interfaces-in-windows-10/)) did. – b_c Jan 09 '20 at 15:24
6

I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it shows all interfaces as opposed to just a couple (or sometimes none).

Jesse P.
  • 201
  • 2
  • 6
  • Yet again, maybe it is better to follow this before actually running `WireShark` as Administrator:https://wiki.wireshark.org/Security#Administrator.2Froot_account_not_required.21 – Guy Avraham Jan 08 '19 at 15:57
  • 1
    That article implies that some users think it's required. I never said that. I said I have problems with it if I don't; problems which are eerily similar to the OP's problem. – Jesse P. Jan 08 '19 at 16:02
2

On Windows 10, running Wireshark as administrator by right-clicking the start menu shortcut fixes this problem for me.

no_one
  • 21
  • 2
1

For Windows 10, it was not showing ethernet and wifi interfaces, I installed wireshark 2.6.11 after installation it asked to update, so i updated instead of winpcap, I selected npcap then it upgraded to 3.2.1, finally i can see interfaces.

mohammed ishaq
  • 11
  • 1
0

Had the same problem just now after uninstalling VMWare workstation, it basically shredded all NIC information from Wireshark/TShark and all i had were some ghost NICs and a loopback device.

Solution was to Uninstall Wireshark and then NPcap from the system, reboot then reinstall again. TShark -D and all NICs were listed again. Sheesh.

A guest too lazy to register
  • 1