Why doesn't wireshark detect my interface?

Question

I just installed Wireshark, but when I click capture > interfaces, the dialog box appears, but it does not contain my network interface.

When click on capture > interfaces it appears as in the screenshot below. What can cause this?

no interfaces listed

Have you libpcap installed and running? – Cyclonecode Nov 24 '11 at 10:37 — Cyclonecode, Nov 24 '11 at 10:37
I used this with sudo, Then it worked fine. – Ananda Subasinghe Dec 28 '11 at 08:22 — Ananda Subasinghe, Dec 28 '11 at 08:22

score 45 · Accepted Answer · edited Jan 15 '20 at 06:48

45

This is usually caused by incorrectly setting up permissions related to running Wireshark correctly. While you can avoid this issue by running Wireshark with elevated privileges (e.g. with sudo), it should generally be avoided (see here, specifically here). This sometimes results from an incomplete or partially successful installation of Wireshark. Since you are running Ubuntu, this can be resolved by following the instructions given in this answer on the Wireshark Q&A site. In summary, after installing Wireshark, execute the following commands:

sudo dpkg-reconfigure wireshark-common 
sudo usermod -a -G wireshark $USER

Then log out and log back in (or reboot), and Wireshark should work correctly without needing additional privileges. Finally, if the problem is still not resolved, it may be that dumpcap was not correctly configured, or there is something else preventing it from operating correctly. In this case, you can set the setuid bit for dumpcap so that it always runs as root.

sudo chmod 4711 `which dumpcap`

One some distros you might get the following error when you execute the command above:

chmod: missing operand after ‘4711’

Try 'chmod --help' for more information.

In this case try running

sudo chmod 4711 `sudo which dumpcap`

edited Jan 15 '20 at 06:48

rbaleksandar

8,713
7
76
161

answered Jan 13 '12 at 19:18

multipleinterfaces

8,913
4
30
34

+1 for using `which dumpcap`. I was convinced that I had done everything right, but Wireshark was trying to use /usr/local/bin/dumpcap when I had set up the permissions for /usr/bin/dumpcap. – wumbo Nov 05 '15 at 23:31
2

"Running as administrator" in windows – Leo Lee Aug 26 '16 at 05:05
1

Thank you so much. That part with the chmod 4711 was missing on fedora, too. Though you need to run the which command as sudo, too: sudo chmod 4711 `sudo which dumpcap` – planetmaker Jul 16 '17 at 16:07
@planetmaker The `sudo which dumpcap` solved the problem. – rbaleksandar Jan 15 '20 at 06:46
This works. I have to ask how come that for years now Wireshark has this configuration step that comes during the installation, where it asks you whether non-root users should be able to capture data on interfaces yet it hasn't worked a single time for me. I always need to go through the `dpkg-reconfiguration` step and so on. – rbaleksandar Jul 28 '23 at 13:39

score 33 · Answer 2 · answered Jul 22 '16 at 23:57

33

In Windows, with Wireshark 2.0.4, running as Administrator did not solve this for me. What did was restarting the NetGroup Packet Filter Driver (npf) service:

Open a Command Prompt with administrative privileges.
Execute the command sc query npf and verify if the service is running.
Execute the command sc stop npf followed by the command sc start npf.
Open WireShark and press F5.

Source: http://dynamic-datacenter.be/?p=1279

answered Jul 22 '16 at 23:57

Mark Berry

17,843
4
58
88

1

I had to close all running copies of Wireshark before the `sc stop npf` command would finish. Thanks though - this worked for me on Win7! – culix Jul 24 '16 at 14:45
Thanks - had to do this myself. The service wouldn't stop though until i exited Wireshark. After that, it all worked fine. – Flare Star Nov 07 '17 at 16:36
5

In case anyone else is as dumb as me...I had this issue, and running the commands above resulted in: `The specified service does not exist as an installed service`. Turns out it was just that I had unchecked the "Install WinPacp" checkbox during the WireShark install, thinking it was an unnecessary addition without reviewing any of the information. Most importantly the note: "WinPcap is required to capture live network data". – Ocelot20 Nov 17 '17 at 17:10
1

Or, as was my case, you're running Wireshark Portable, which **does not install WinPcap** by default :-| You either install it, or manually save/convert captures to a file and then feed them to Wireshark, see [here](https://ask.wireshark.org/question/1779/cannot-access-ethernet-interfaces-with-wireshark-portable-unless-i-install-full-winpcap/). – Paul Jul 25 '19 at 19:57

score 4 · Answer 3 · answered Mar 12 '16 at 07:35

4

As described in other answer, it's usually caused by incorrectly setting up permissions related to running Wireshark correctly.

Windows machines:

Run Wireshark as administrator.

answered Mar 12 '16 at 07:35

Keshava GN

4,195
2
36
47

4

[No you should not do that, and it’s not necessary.](https://wiki.wireshark.org/Security#Administrator.2Froot_account_not_required.21) – Kissaki Aug 28 '16 at 08:23
@kissaki Does this generally go for windows programs? Or maybe a more specific question: What aspects of a program makes it vulnerable if it is run with admin rights? – thz Apr 01 '17 at 13:46
1

@RnBandCrunk Running a program as administrator gives the program access to do whatever it wants to do across all users and groups, including the administrator. It effectively gives the program root privilege. If the program was written poorly or maliciously or used a library written as such, it could do some less than pleasant things to your computer. Why even give it the chance, unless absolutely necessary? – MtWoRw Mar 08 '19 at 01:51

z atef · Answer 4 · 2019-01-03T03:35:01.897

4

For *nix OSes, run wireshark with sudo privileges. You need to be superuser in order to be able to view interfaces. Just like running tcpdump -D vs sudo tcpdump -D, the first one won't show any of the interfaces, won't compalain/prompt for sudo privileges either.

So, from terminal, run:

$ sudo wireshark

edited Jan 03 '19 at 03:35

answered Aug 19 '18 at 03:18

z atef

7,138
3
55
50

score 2 · Answer 5 · answered Apr 20 '18 at 09:05

2

By Restarting NPF, I can see the interfaces with wireshark 1.6.5

Open a Command Prompt with administrative privileges.

Execute the command "sc stop npf".
Then start npf by command "sc start npf".
Open WireShark.

That's it.

answered Apr 20 '18 at 09:05

Upendra Patel

21
1

score 0 · Answer 6 · edited Mar 28 '19 at 10:50

0

On Fedora 29 with Wireshark 3.0.0 only adding a user to the wireshark group is required:

sudo usermod -a -G wireshark $USER

Then log out and log back in (or reboot), and Wireshark should work correctly.

edited Mar 28 '19 at 10:50

baduker

19,152
9
33
56

answered Mar 28 '19 at 09:40

Zaman

130
2
8

score 0 · Answer 7 · answered Dec 26 '19 at 07:33

I hit the same problem on my laptop(win 10) with Wireshark(version 3.2.0), and I tried all the above solutions but unfortunately don't help.

So,

I uninstall the Wireshark bluntly and reinstall it.

After that, this problem solved.

Putting the solution here, and wish it may help someone......

score 0 · Answer 8 · answered Apr 22 '20 at 03:03

0

Just uninstall NPCAP and install wpcap. This will fix the issue.

answered Apr 22 '20 at 03:03

Vishnu Kv

1

Why doesn't wireshark detect my interface?

8 Answers8