Revision history  [back]

No. Wireshark doesn't support that.

On Windows, it would require, at minimum, that Wireshark be notified of the appearance of new interfaces, and it currently has no code to do that atop whatever mechanism Windows or Npcap provide to do that.

Npcap currently doesn't provide such a mechanism, although it might be possible for it to do so if it gets notified that it has been bound to a new interface.

That alone, however, might not be sufficient, as Wireshark would then have to open the interface after it's notified that it has appeared, but that won't capture any traffic that arrived before the open completed.

So starting a capture on an interface the instant it appears is not supported, and it might be difficult for Npcap to support it.

@grahamb's suggestion to try capturing externally, if possible, is probably the best suggestion.

Also wireshark seems to terminate immediatly if the interface number doesn't exist

If you try to capture on an interface that doesn't exist, there's nothing for Wireshark to open, so it can't do anything other than say "that interface doesn't exist" and quit.

and newly connected interfaces don't appear on the back of

wireshark -D

but instead in the possition they would be in later.

libpcap/Npcap sort interfaces in order to try to put the interfaces most likely to be captured on first. (The implementation of that on Windows is not ideal, and needs work, but that still means that new interfaces will not be guaranteed to appear at the end of the list.)