How can I configure Wireshark to list my dial up connection as a possible capture interface?

Question

I am trying to monitor traffic coming into to my machine via an incoming dialup connection.

I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the reason that my dialup connection wasn't listed in the capture menu ).

The problem is that Wireshark does not list my dial up connection on the capture menu. It lists all other interfaces but not the dial up interface.

Is there a way I can get Wireshark to see it?

Solution 1

With the WinPcap 3.1 support for capturing on PPP links, if you try to start the capture before the PPP link has been set up (for example, before the machine has dialed up, for dial-up or ISDN connections), the only PPP interface offered for capture will be called "GenericDialupAdapter". This interface doesn't have any IP address assigned to it; the IP address for a PPP link is typically assigned only when the link is set up. Capturing on that interface will allow you to start the capture before the link has been set up.

Once the link has been set up, both the "GenericDialupAdapter" and an interface referring to the link that was set up, called "WAN (PPP/SLIP) Interface", will be available for capture; the interface referring to the link that was set up will have an IP address assigned to it.

http://wiki.wireshark.org/CaptureSetup/PPP

Solution 2

It is not possible to use winpcap to capture PPP/VPN packets in windows 7. See this FAQ entry for details:

Q-5: Can I use WinPcap on a PPP connection?

A: Windows NT4. It's not possible to capture on PPP/VPN connections on this operating system.

Windows 2000/XP (x86)/2003 (x86). these systems have limitations in the NDIS binding process that prevent a protocol driver from working properly on WAN adapters. WinPcap 3.1 and newer offer limited support for capturing on dial-up adapters using a wrapper over the Microsoft NetMon driver. NOTES: it is possible to capture control packets (LCP and NCP) using the "Generic Dialup" or "Generic NdisWan" adapter (which is always listed even if no dialup connections are available). Control frames are captured as Ethernet encapsulated PPP frames. the PPP protocol is translated by the OS into a fake Ethernet. You'll see Ethernet frames and not PPP frames. transmission is not supported. filtering and statistics gathering is done at user level.

Windows XP (x64)/2003 (x64). It's not possible to capture on PPP/VPN connections on these operating systems.

Windows Vista and more recent. It's not possible to capture on PPP/VPN connections on these operating systems.

raj

Comments

[Admin]

Have you actually connected first? Wireshark shouldn't show you the connection until its actually connected.

[wlawl]

I don't actually see any PPP interface offered for capture, both pre and post dialup. My problem is that I can't authenticate and can't connect - I was hoping to be able to use Wireshark to work out why. According to the link you've posted, its possible that I have some VPN software or some other software installed on here that prevents the capture of the PPP link. I may try another machine.

[Admin]

How do you install the Network Monitor Driver for the VPN tunnel ?