Wireshark doesn't show interface when ndis miniport driver installed

Question

Wireshark doesn't show the Ethernet interface after the miniport driver is installed. Wireshark shows "No interfaces found". But Microsoft Message Analyzer and NetMon can locate the adapter interface and show the captured packets.

But if I restart the machine then Wireshark is able to find the interface. I suspect it's due to binding issues between WinPcap and my miniport driver. Please correct me if I'm wrong! Do I need to change the INF file or look at the OID requests part as the NPF filter (used by WinPcap) isn't able to get it's hands on the miniport driver ?

With regards, Jenson

Seems like it could be a WinPcap driver limitation. It cannot detect any new adapter installed unless the adapter was already present during bootup Link to reference. Would still like someone to confirm if this bug persists in Wireshark 2.2.1 with WinPcap (4_1_3) — Jenson Pais

Carsten Hansen Carsten Hansen · Accepted Answer · 2016-11-18T03:09:21

From what I recall, if network adapters are installed or removed the pcap service needs to be restarted to pick up the changes.

To stop the service, from a command line with Administrator rights:

net stop npf

To start it again:

net start npf

Wireshark doesn't show interface when ndis miniport driver installed

1 Answers