3

I am trying to monitor traffic coming into to my machine via an incoming dialup connection.

I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the reason that my dialup connection wasn't listed in the capture menu ).

The problem is that Wireshark does not list my dial up connection on the capture menu. It lists all other interfaces but not the dial up interface.

Is there a way I can get Wireshark to see it?

Improve this question
1
  • 4
    Have you actually connected first? Wireshark shouldn't show you the connection until its actually connected.
    – Josh Budde
    Oct 19, 2009 at 15:23

3 Answers 3

Reset to default
3

With the WinPcap 3.1 support for capturing on PPP links, if you try to start the capture before the PPP link has been set up (for example, before the machine has dialed up, for dial-up or ISDN connections), the only PPP interface offered for capture will be called "GenericDialupAdapter". This interface doesn't have any IP address assigned to it; the IP address for a PPP link is typically assigned only when the link is set up. Capturing on that interface will allow you to start the capture before the link has been set up.

Once the link has been set up, both the "GenericDialupAdapter" and an interface referring to the link that was set up, called "WAN (PPP/SLIP) Interface", will be available for capture; the interface referring to the link that was set up will have an IP address assigned to it.

http://wiki.wireshark.org/CaptureSetup/PPP

Improve this answer
1
  • I don't actually see any PPP interface offered for capture, both pre and post dialup. My problem is that I can't authenticate and can't connect - I was hoping to be able to use Wireshark to work out why. According to the link you've posted, its possible that I have some VPN software or some other software installed on here that prevents the capture of the PPP link. I may try another machine.
    – BeeBand
    Oct 22, 2009 at 15:38
2

It is not possible to use winpcap to capture PPP/VPN packets in windows 7. See this FAQ entry for details:

Q-5: Can I use WinPcap on a PPP connection?

A: Windows NT4. It's not possible to capture on PPP/VPN connections on this operating system.

Windows 2000/XP (x86)/2003 (x86). these systems have limitations in the NDIS binding process that prevent a protocol driver from working properly on WAN adapters. WinPcap 3.1 and newer offer limited support for capturing on dial-up adapters using a wrapper over the Microsoft NetMon driver. NOTES: it is possible to capture control packets (LCP and NCP) using the "Generic Dialup" or "Generic NdisWan" adapter (which is always listed even if no dialup connections are available). Control frames are captured as Ethernet encapsulated PPP frames. the PPP protocol is translated by the OS into a fake Ethernet. You'll see Ethernet frames and not PPP frames. transmission is not supported. filtering and statistics gathering is done at user level.

Windows XP (x64)/2003 (x64). It's not possible to capture on PPP/VPN connections on these operating systems.

Windows Vista and more recent. It's not possible to capture on PPP/VPN connections on these operating systems.

raj

Improve this answer
1

You would need to install Network Monitor Driver under Networking tab of your dia-up icon properties in order to have Wireshark recognize generic dial-up/VPN port.

Improve this answer
2
  • Solved the problem for me. Thankyou!!
    – Lightness Races in Orbit
    Mar 14, 2012 at 18:16
  • How do you install the Network Monitor Driver for the VPN tunnel ?
    – Leeeeeeelo
    Oct 3, 2016 at 8:59

You must log in to answer this question.