No packets captured by Npcap on teamed network adapter

retag add tags

I am using Intel(R) Ethernet Server Adapter I350-T2 with two lines teamed. I get no network traffic capture. Error message unknown ndis medium value 12, defaulting to DLT_EN10MB

jvwired

asked 2023-03-05 21:01:44 +0000

19.9k

Guy Harris

updated 2023-03-06 19:11:51 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Similar to npcap #173.

Can you update the question with the output of wireshark -v or Help->About Wireshark:Wireshark.

Chuckc (2023-03-06 00:41:39 +0000) edit

Version 4.0.4 (v4.0.4-0-gea14d468d9ca).

message on start capture

Warning: unknown ndis medium value 12, defaulting to DLT_EN10MB

Properties of adapter

Connection-specific DNS Suffix: attlocal.net
Description: TEAM: Team i350T2
Physical Address: ‎A0-36-9F-52-E6-2E
DHCP Enabled: Yes
IPv4 Address: 192.168.1.112
IPv4 Subnet Mask: 255.255.255.0
Lease Obtained: Thursday, February 23, 2023 1:07:37 PM
Lease Expires: Monday, March 06, 2023 1:07:37 PM
IPv4 Default Gateway: 192.168.1.254
IPv4 DHCP Server: 192.168.1.254
IPv4 DNS Server: 192.168.1.254
IPv4 WINS Server: 
NetBIOS over Tcpip Enabled: Yes

Opening screen Wireshark

Local Area Connection* 4
Local Area Connection* 3
Local Area Connection*
Local Area Connection* 10
Local Area Connection* 5
VirtualBox Host-Only Network
Local Area Connection 4
Adapter for loopback traffic capture
Local Area Connection* 2

start, no activity stop, message "No packets captured. As no data was ... (more)

jvwired (2023-03-06 03:34:19 +0000) edit

The output of wireshark -v also includes information on npcap (if loaded) and the operating system.
Can you add the full output?

Chuckc (2023-03-06 19:18:15 +0000) edit

OUTPUT OF WIRESHARK -V

Wireshark 4.0.4 (v4.0.4-0-gea14d468d9ca).

Copyright 1998-2023 Gerald Combs <[email protected]> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).

This is free software; see the file named COPYING in the distribution. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.32, build 31332), with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap ...

(more)

jvwired (2023-03-06 23:08:54 +0000) edit

"Npcap Packet Driver (NPCAP)" is visible in the local network properties and checkmarked to be active

jvwired (2023-03-06 23:26:47 +0000) edit

add a comment see more comments

1 Answer

Sort by

oldest

newest

most voted

The lack of captured packets is either an Npcap issue or a Windows issue, and should be reported on the Npcap issues list.

The message in question is a warning. Please mention it in the issue you file and, if possible, copy and paste it rather than retyping it.

(The message in the libpcap and thus Npcap code begins with "Unknown NdisMedium value", capitalized in that fashion, so it was retyped here. 12 is an odd NdisMedium value for a teamed Ethernet device; it appears that it's NdisMediumCoWan, which makes no sense, as it "Specifies a wide area network in a connection-oriented environment.", and Ethernet isn't considered a WAN and isn't connection-oriented, so the value may have been different as well. Knowing the correct value might help determine what DLT_ value it should be mapped to.)

19.9k

Guy Harris

answered 2023-03-06 19:26:54 +0000

edit flag offensive 0 remove flag delete link

Comments

12? Sounds as if either Intel or Microsoft is doing something massively wrong, as it makes zero sense for NdisMediumCoWan to be the NdisMedium type.

What's the output of wireshark -D?

Guy Harris (2023-03-07 09:43:03 +0000) edit

OUTPUT OF wireshark -D

1. \Device\NPF_{DF4A9D2C-8742-4EB1-8703-D395C4183F33} (Local Area Connection* 4)
2. \Device\NPF_{E43D242B-9EAB-4626-A952-46649FBB939A} (Local Area Connection* 3)
3. \Device\NPF_{71F897D7-EB7C-4D8D-89DB-AC80D9DD2270} (Local Area Connection*)
4. \Device\NPF_{78032B7E-4968-42D3-9F37-287EA86C0AAA} (Local Area Connection* 10)
5. \Device\NPF_{8E301A52-AFFA-4F49-B9CA-C79096A1A056} (Local Area Connection* 5)
6. \Device\NPF_{9374D46C-2355-4C45-AF76-3CB56C734852} (VirtualBox Host-Only Network)
7. \Device\NPF_{E4387D79-C7EF-4B91-8AF0-8701F536DFA6} (Local Area Connection 4)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. \Device\NPF_{29898C9D-B0A4-4FEF-BDB6-57A562022CEE} (Local Area Connection* 2)

jvwired (2023-03-12 07:09:18 +0000) edit

The 1,2,3,4 at the end was 6,7,8,9 in my source OUTPUT OF wireshark -D

1. \Device\NPF_{DF4A9D2C-8742-4EB1-8703-D395C4183F33} (Local Area Connection* 4)
2. \Device\NPF_{E43D242B-9EAB-4626-A952-46649FBB939A} (Local Area Connection* 3)
3. \Device\NPF_{71F897D7-EB7C-4D8D-89DB-AC80D9DD2270} (Local Area Connection*)
4. \Device\NPF_{78032B7E-4968-42D3-9F37-287EA86C0AAA} (Local Area Connection* 10)
5. \Device\NPF_{8E301A52-AFFA-4F49-B9CA-C79096A1A056} (Local Area Connection* 5)
6. \Device\NPF_{9374D46C-2355-4C45-AF76-3CB56C734852} (VirtualBox Host-Only Network)
7. \Device\NPF_{E4387D79-C7EF-4B91-8AF0-8701F536DFA6} (Local Area Connection 4)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. \Device\NPF_{29898C9D-B0A4-4FEF-BDB6-57A562022CEE} (Local Area Connection* 2)

jvwired (2023-03-12 07:12:55 +0000) edit

On which of those interfaces were you trying to capture?

Guy Harris (2023-04-28 00:41:01 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

No packets captured by Npcap on teamed network adapter edit

Comments

1 Answer

Comments