Wireshark mailing list archives

Problems with \Device\NPF_ prefix


From: Gisle Vanem <gisle.vanem () gmail com>
Date: Thu, 11 Jan 2018 23:34:17 +0100

In my recently built Tshark/Wireshark etc., I've discovered
this longer works:
  tshark.exe -i \Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

It says:
  Capturing on '\Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}'
  tshark: The capture session could not be initiated on interface '\Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}'
  (Error opening adapter: Operasjonen er utført. (0)).  << == NO_ERROR !!??

But this works:
  tshark.exe -i {3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

(no "\Device" prefix) How come?

I also tried with:
  tshark.exe -o console.log.level:252 -i \Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

which splits out at the end some mysterious stuff:
  ...
  (tshark.exe:10360): Capture-DEBUG: argv[5]: 10360
  (tshark.exe:10360): Capture-DEBUG: read 14 ok indicator: E len: 402 msg: E

The 'msg: E' does show up with w/o the prefix?
A dumpcap/pipe reading problem?

Win-10, WinPcap 4.1.0.2980.

--
--gv
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: