Frames are undecoded and have funny bytes in header
This is a WIN 10 installation. I'm getting frames from npcap with the capture filter "udp port 23456" when I send UPD messages to port 23456. I can also sniff the UDP packets with "packet sender"-app. But on the Wireshark GUI they are not decoded and the raw frame data shown seems to have the correct UDP data part but the Ip header has several additional bytes. I have completely uninstalled Wireshark and npcap and reinstalled it fresh with the newest version several times now. nothing changes. I'v tried several LAN and WLAN ports - all the same. I do not receive any decoded frames at all. Just these funny frames without decoding. I'm lost...
0000 ff ff ff ff ff ff 08 b6 1f 29 98 74 08 00 45 00 .........).t..E.
0010 00 26 00 22 00 00 ff 11 48 db c0 a8 b2 21 ff ff .&."....H....!..
0020 ff ff 30 39 5b a0 00 12 02 25 00 01 ff 00 00 00 ..09[....%......
0030 00 00 00 00 00 00 00 00 00 00 00 00 ............
UDP payload data is 10 bytes: 00 01 ff 00 00 00 00 00 00 00
In the GUI there is only data in columns "Time" and "length". No source, no destination, no protocol. The protocol s are active as per default after installation.
Comments
Importing this text shows a perfectly normal UDP packet to me, so it may be something you haven't tweaked yet. What happens if you select a different profile?
Jaap, that idea saved me. Thanks so much for posting it!!!
When switching from the default to the classic profile, I suddenly get my packet decoded. But this brings up three new questions:
Funny enough this result: I deleted the profile's directory to get back the correct default configuration. But when closing and restarting Wireshark I get the same result: the default profile does not show any decoding while the classic profile does ... (more)