12

I want to capture traffic on Ethernet 4 but you can see that Ethernet 4 is not present in Wireshark network interface though Ethernet 4 is present in Networking and sharing center.

Screenshot of interface list:

enter image description here

Screenshot of network&sharing center:

enter image description here

I use windows 10 and latest version of wireshark- 2.0.4

5
  • Your device may not be capable of running in promiscuous mode.
    – D34DM347
    Jul 14 '16 at 15:40
  • winpcap driver enabled on that nic ?
    – yagmoth555
    Jul 14 '16 at 15:41
  • Yes. winpcap is installed and run. winpcap driver comes with the installation of wireshark.
    – defalt
    Jul 14 '16 at 15:44
  • I capture packets in promiscuous mode most of the time but this time the targeted interface is missing on which I want to run capture. Even if I disable promiscuous mode the interface will still not be there so promiscuous mode is not a problem.
    – defalt
    Jul 14 '16 at 15:46
  • 2
    winpcap will only see interfaces that are present in Windows when winpcap starts. If winpcap is loaded at startup and the interface has been added later (or is slow to register with Windows?) then Wireshark won't see it. You can stop and start winpcap with "net stop npf" and "net start npf" to see whether this is the case.
    – marctxk
    Jul 14 '16 at 15:57
11

I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.

2
  • Saved my day, thanks.
    – kR105
    Aug 2 '19 at 9:25
  • 2
    In case someone comes across this like I did, this answer did not work for me on Windows 10, but installing Npcap (suggested here) did.
    – b_c
    Jan 9 '20 at 15:24
6

I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it shows all interfaces as opposed to just a couple (or sometimes none).

2
  • Yet again, maybe it is better to follow this before actually running WireShark as Administrator:wiki.wireshark.org/… Jan 8 '19 at 15:57
  • 1
    That article implies that some users think it's required. I never said that. I said I have problems with it if I don't; problems which are eerily similar to the OP's problem.
    – Jesse P.
    Jan 8 '19 at 16:02
1

For Windows 10, it was not showing ethernet and wifi interfaces, I installed wireshark 2.6.11 after installation it asked to update, so i updated instead of winpcap, I selected npcap then it upgraded to 3.2.1, finally i can see interfaces.

1

On Windows 10, running Wireshark as administrator by right-clicking the start menu shortcut fixes this problem for me.

0

Had the same problem just now after uninstalling VMWare workstation, it basically shredded all NIC information from Wireshark/TShark and all i had were some ghost NICs and a loopback device.

Solution was to Uninstall Wireshark and then NPcap from the system, reboot then reinstall again. TShark -D and all NICs were listed again. Sheesh.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.