First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

windows wireshark start capture on disconnected interface

On MacOS I can start a capture on a disconnected wireless interface so that the moment it connects I can see all traffic and I don't miss out on things like DHCP etc. Is it possible to do this in windows or to perhaps start a capture immediately and automatically upon connecting?

When I try this currently the capture will start with a disconnected wireless interface but will stop the moment I connect to an SSID and has to be restarted meaning I've missed all the initial traffic. The error it displays when it stops is "The network adapter on which the capture was being done is no longer running; the capture has stopped."

pr0n's avatar
3
pr0n
asked 2018-10-09 14:39:24 +0000, updated 2018-10-09 14:45:42 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

Can you provide more details about your Windows Wireshark capture setup? In particular, are you using WinPcap or npcap? I haven't tried it myself, but if you're using WinPcap, then you might want to try again with npcap to see if that works for you.

(Much like "Whos' Line Is It Anyway?", the points don't matter, but I converted my comment to an answer since it helped resolve the problem and if it's accepted, then it may help others to find an answer that works for them too.)

cmaynard's avatar
11.1k
cmaynard
answered 2018-10-09 17:32:55 +0000, updated 2018-10-09 18:20:45 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Switching to npcap from winpcap resolved this for me. If you want points for an answer I'll mark it.

pr0n's avatar pr0n (2018-10-09 17:54:50 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer