This wiki has been migrated to https://gitlab.com/wireshark/wireshark/-/wikis/home and is now deprecated. Please use that site instead.
Differences between revisions 17 and 18
Revision 17 as of 2016-03-30 08:12:45
Size: 2844
Editor: Albert Reca
Comment: Wireshark version is 2.0.1 interfiers with Macafee vpn client.
Revision 18 as of 2016-03-30 08:14:40
Size: 2859
Editor: Albert Reca
Comment:
Deletions are marked like this. Additions are marked like this.
Line 16: Line 16:
 * McAfee-VPN-Client-5.9.1.2911.exe , outgoing traffic is not shown on wireshark, you can only see inboud traffic, for example on icmp you just see echo reply. Older version of StoneSoft vpn client Stonesoft-IPsec-VPN-Client-5.4.3.2428.exe also interfer with Wireshark. For Wireshark version 1.12.7 McAfee-VPN-Client or Stonesoft-IPsec-VPN-Client didn't interfer on traffic. But when Wireshark version is 2.0.1 McAfee-VPN-Client interfers.  * McAfee-VPN-Client-5.9.1.2911.exe , outgoing traffic is not shown on wireshark, you can only see inboud traffic, for example on icmp you just see echo reply. Older version of StoneSoft vpn client Stonesoft-IPsec-VPN-Client-5.4.3.2428.exe also interfer with Wireshark. For Wireshark version 1.12.7 McAfee-VPN-Client or Stonesoft-IPsec-VPN-Client didn't interfer on traffic it worked fine. But when Wireshark version is 2.0.1 McAfee-VPN-Client interfers.

CaptureSetup/InterferingSoftware

Software that's working together with the network protocol stack at a low level can cause problems together with WinPcap.

Some known problematic software includes:

  • SonicWALL Global VPN Client, Version 3.1.0.556: When installed together with WinPcap 3.1, the network interfaces are no longer available (ipconfig /all doesn't show them)

  • Cisco VPN client: duplicates packets, even if not running (installation is enough to cause problems) - Steve Masters

  • Cisco VPN client: may hide all packets, even if not connected - disable the firewall in the Cisco VPN client or stop the "Cisco Systems, Inc. VPN Service" -- Matthias Andree

  • F-Secure Anti-Virus Client Security - disable the firewall part of the suite and it works again. Kim Tiedemann

  • Sunbelt Kerio Personal Firewall: Internet connection stops working while capturing, can't browse or anything. Disabling the firewall is not enough. No known workaround at this time.
  • Check Point VPN1 SecureClient (NGX R60 HFA1 Build 019): Tools>Disable Security Policy

  • Symantec Endpoint Protection: Refer to this question on ask for details.

  • Microsoft Forefront TMG 2010's filter when running on an external network card appears to prevent Outbound packets from being captured. http://blogx.co.uk/Comments.asp?Entry=876 and http://ask.wireshark.org/questions/11714/only-inbound-traffic.

  • McAfee-VPN-Client-5.9.1.2911.exe , outgoing traffic is not shown on wireshark, you can only see inboud traffic, for example on icmp you just see echo reply. Older version of StoneSoft vpn client Stonesoft-IPsec-VPN-Client-5.4.3.2428.exe also interfer with Wireshark. For Wireshark version 1.12.7 McAfee-VPN-Client or Stonesoft-IPsec-VPN-Client didn't interfer on traffic it worked fine. But when Wireshark version is 2.0.1 McAfee-VPN-Client interfers.

  • <please append other known problems here>

If you have any such problems, you may contact the WinPcap team directly as the Wireshark developers can't do anything against it.

Discussion

Is this a Win32 only problem, or are other OS/software combinations also problematic?

I have had this issue on Win64 --Matthew

I had this happen to me using Windows XP Professional, Version 2002, SP2 and SonicWALL Global VPN Clinet, Version 3.1.0.556. This happens with both the 0.10.13 and 0.10.14 downloads of Wireshark. I would be willing to help debug a solution ( wvpowell@indesign-llc.com ).

We (the Wireshark developers) have outsourced Windows NDIS expertise to the WinPcap developers; you should contact them to see if they can work with you on this. --Guy Harris

CaptureSetup/InterferingSoftware (last edited 2018-06-15 15:27:16 by JaapKeuter)