How can I configure Wireshark to list my dial up connection as a possible capture interface?

Question

I am trying to monitor traffic coming into to my machine via an incoming dialup connection.

I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the reason that my dialup connection wasn't listed in the capture menu ).

The problem is that Wireshark does not list my dial up connection on the capture menu. It lists all other interfaces but not the dial up interface.

Is there a way I can get Wireshark to see it?

Answer 1

With the WinPcap 3.1 support for capturing on PPP links, if you try to start the capture before the PPP link has been set up (for example, before the machine has dialed up, for dial-up or ISDN connections), the only PPP interface offered for capture will be called "GenericDialupAdapter". This interface doesn't have any IP address assigned to it; the IP address for a PPP link is typically assigned only when the link is set up. Capturing on that interface will allow you to start the capture before the link has been set up.

Once the link has been set up, both the "GenericDialupAdapter" and an interface referring to the link that was set up, called "WAN (PPP/SLIP) Interface", will be available for capture; the interface referring to the link that was set up will have an IP address assigned to it.

http://wiki.wireshark.org/CaptureSetup/PPP

Answer 2

You would need to install Network Monitor Driver under Networking tab of your dia-up icon properties in order to have Wireshark recognize generic dial-up/VPN port.

Answer 3

It is not possible to use winpcap to capture PPP/VPN packets in windows 7. See this FAQ entry for details.

raj