Hi, I am having troubles with screen sharing via Miracast. From what I learned, Miracast is direct connection between two devices via wifi. I was thinking I could capture the handshake between my laptop and the TV via Wireshark. I tried to capture all the traffic going via wifi interface but it did not capture anything... Is there any option how to caputre Miracast traffic?
I've prooven my own guess. :)
Windows enables a new network connection for screen sharing, named by the default name scheme (e.g. LAN Connection #3). It is hidden by default. It is only visible in the network connection overview during the screen sharing session. In Wireshark you can see it all the time. You have to start the capture on this connection.
Bluetooth was not needed for me to establish a connection.
I think the most interesting part is the handshake between the computer and the display device. Any ideas how to capture the handshake from a hidden interface?
The adapter is not hidden in Wireshark. It is only hidden in the network connection overview of Windows when screen sharing is disabled.
To capture the handshake you need to identify the name of the virtual screen sharing adapter first. Open the network connection overview in Windows and start screen sharing. The virtual screen sharing adapter will immediatly appear in in the overview (device name is something with "Microsoft Virtual WiFi..."). Now stop screen sharing (adapter will disappear) and start the Wireshark capture on the adapter with the name you've just identified. When you start screen sharing again and connect to a Miracast device, you will see the handshake and every following packets in your capture.
Hi JasMan, Notifications about this thread ended in spam, so it took a while before I noticed the replies. Thank you for having look at it. You are right about the dynamic virtual adapter. On my laptop (W10) in "Network Connections" dialog it appears as Local area connection *2 with description like "Microsoft Wi-Fi Direct Virtual Adapter #2". I also have it visible in Wireshark all the time and in Network Connections dialog only when active. I can also confirm that bluetooth was not needed - I have even disabled it prior connection. At the end I was able to capture the traffic - connect, disconnect initialized from laptop.
I will investigate it for a while myself... The reason for ll this is that I am having problems with connecting from my laptop to my TV via Miracast. I would say every 5-10 attempt is successfull. After connection is established it works ...
Thank you, I have uploaded mine - 2 unsuccessful attempts, 1 successful. Not sure what all was anonymized from your capture, but on 1st look it seems to be quite different compared to mine.
Comments
Excellent question!
Windows requires that Bluetooth and WiFi, both interfaces have to be active to start a Miracast connection.
AFAIK, WiFi is used for data transfer (look out for a new WiFi interface while the device connection is established). Alas, I never found out what Bluetooth is used for (key exchange for WiFi maybe?)
When I use my Android phone to stream my display, a new virtual interface is showing up (p2p0). Maybe Windows do the same and you've to start your capture on that virtuell interface?
@Eddi Are you sure that BT is needed for Miracast? I never paid attention if BT is on or not when I start to share my screen. The articles I've read about Miracast haven't mentioned BT as well. Mabye only Windows uses it for certain situations (Windows-To-Windows)?!