0

I know this question has been asked on ServerFault and Stackoverflow but none of the discussions and solutions have worked for me. (Not linking to the question directly as I can only post 2 links at this point.)

I am using Wireshark 2.2.4 with WinPcap 4.1.3 on Windows 7 64-bit edition. Below are the various things I have tried with no success. Wireshark still says "No interfaces found"

  1. Run Wireshark as administrator.
  2. Ensured the NPF service was running using sc qc npf. Stopped and started it again with net stop npf and net start npf.NPF status
  3. I've tried setting the NPF service startup type alternatively as System or as Automatic and restarted the machine. Made no difference.
  4. Used Windump -D which is able to see the interfaces. Windump output
  5. Installed Win10Pcap instead of the WinPcap 4.1.3 that is bundled with Wireshark and it made no difference.
  6. Have tried switching to the 32-bit build of Wireshark and had the same behavior.

Any help or ideas will be appreciated.

EDIT: See my own answer below.

AGandhi
  • 21
  • 1
  • 1
  • 3

1 Answers1

1

This took me a day and a half to figure out so I wanted to share my results.

What I discovered was that even though WinPCap was installed correctly, the NPF driver was not actually bound to any network adapter. When I tried to bind it manually as shown in the screenshot here: Binding NFP to adapter I got the the error:

"Filters currently installed on the system have reached the limit."

Windows 7 has a default limit set to 8. You can manually increase this limit to 14. To do this, you have to adjust the MaxNumFilters value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\

  1. Click Start , click Run , type regedit , and then click OK .
  2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\
  3. In the right pane, right-click MaxNumFilters, and then click Modify.
  4. Change the value to “14”, and click to select the Decimal option, and then click OK.
  5. Close the Registry Editor.

If this value is already set to 14 you may need to uninstall some of the other network filter drivers.

Then perform the manual binding of the NPF driver again as shown in the screenshot and restart Wireshark. Now Wireshark should be able to see all the interfaces!

AGandhi
  • 21
  • 1
  • 1
  • 3