Wireshark · Ethereal-users: Re: [Ethereal-users] I captured nothing, help.

["Martin Regner" <martin.regner@xxxxxxxxx>]

Gang Peng wrote:

<I checked the user's guide, downloaded and installed the WinPcap 3.0 alpha 4 and ethereal-setup-0.9.8.exe

<at http://www.ethereal.com/distribution/win32/ and http://winpcap.mirror.ethereal.com/install/default.htm; then whe I run it,

< I didn't capture anything and top packet list pane shows nothing. Anybody help to explain why this? Thank.

 

You don't tell what interface (Ethernet, PPP, ..) and what OS you are using, but capturing on PPP WAN (dialup modem) interfaces is normally not working on Windows NT/2000/XP/.NET.
http://www.ethereal.com/faq.html#q5.12

Q 5.12: I'm running Ethereal on Windows NT/2000/XP/.NET Server; my machine has a PPP (dial-up POTS, ISDN, etc.) interface, and it shows up in the "Interface" item in the "Capture Options" dialog box. Why can no packets be sent on or received from that network while I'm trying to capture traffic on that interface?

A: WinPcap doesn't support PPP WAN interfaces on Windows NT/2000/XP/.NET Server; one symptom that may be seen is that attempts to capture in promiscuous mode on the interface cause the interface to be incapable of sending or receiving packets. You can disable promiscuous mode using the -p command-line flag or the item in the "Capture Preferences" dialog box, but this may mean that outgoing packets, or incoming packets, won't be seen in the capture.

However there may be a work-round, it worked for me on Windows 2000.
http://www.ethereal.com/lists/ethereal-users/200211/msg00156.html

http://winpcap.polito.it/misc/dialup.htm 

 

There could of course be a lot of other reasons why you don't get any packets.

Have you checked the FAQ?

 

http://www.ethereal.com/faq.html#q5.1

 

http://www.ethereal.com/faq.html#q5.2