This wiki has been migrated to and is now deprecated. Please use that site instead.
Differences between revisions 20 and 21
Revision 20 as of 2016-03-30 17:40:50
Size: 2645
Editor: GuyHarris
Comment: Clean up description. (No need to give an example of what "outbound packets only" means. The version of Wireshark isn't the issue; it's an issue with interfering with WinPcap.)
Revision 21 as of 2018-06-15 15:27:16
Size: 2784
Editor: JaapKeuter
Comment: another on the list
Deletions are marked like this. Additions are marked like this.
Line 10: Line 10:
 * Citrix DNE Lightweight Driver: May hide outgoing packets - switching it off in the Network Connection properties may resolve the issue


Software that's working together with the network protocol stack at a low level can cause problems together with WinPcap.

Some known problematic software includes:

  • SonicWALL Global VPN Client, Version When installed together with WinPcap 3.1, the network interfaces are no longer available (ipconfig /all doesn't show them)

  • Cisco VPN client: duplicates packets, even if not running (installation is enough to cause problems) - Steve Masters

  • Cisco VPN client: may hide all packets, even if not connected - disable the firewall in the Cisco VPN client or stop the "Cisco Systems, Inc. VPN Service" -- Matthias Andree

  • Citrix DNE Lightweight Driver: May hide outgoing packets - switching it off in the Network Connection properties may resolve the issue
  • F-Secure Anti-Virus Client Security - disable the firewall part of the suite and it works again. Kim Tiedemann

  • Sunbelt Kerio Personal Firewall: Internet connection stops working while capturing, can't browse or anything. Disabling the firewall is not enough. No known workaround at this time.
  • Check Point VPN1 SecureClient (NGX R60 HFA1 Build 019): Tools>Disable Security Policy

  • Symantec Endpoint Protection: Refer to this question on ask for details.

  • Microsoft Forefront TMG 2010's filter when running on an external network card appears to prevent outbound packets from being captured. and

  • McAfee VPN client version McAfee-VPN-Client- prevents outbound packet from being captured. The older version, Stonesoft-IPsec-VPN-Client- (before Stonesoft was purchased by McAfee) also interferes with Wireshark.

  • <please append other known problems here>

If you have any such problems, you may contact the WinPcap team directly as the Wireshark developers can't do anything against it.


Is this a Win32 only problem, or are other OS/software combinations also problematic?

I have had this issue on Win64 --Matthew

I had this happen to me using Windows XP Professional, Version 2002, SP2 and SonicWALL Global VPN Clinet, Version This happens with both the 0.10.13 and 0.10.14 downloads of Wireshark. I would be willing to help debug a solution ( ).

We (the Wireshark developers) have outsourced Windows NDIS expertise to the WinPcap developers; you should contact them to see if they can work with you on this. --Guy Harris

CaptureSetup/InterferingSoftware (last edited 2018-06-15 15:27:16 by JaapKeuter)