Recently, when using Wireshark to capture packets and troubleshoot errors, an error message is prompted after selecting the network card, which has never occurred before. The content of the error report is as follows:
- The content of the prompt is The capture session could not be initiated on capture device , and the capture session could not be initiated on the capture device
- The required operation is Please turn off promiscuous mode for this device , and the promiscuous mode of the network card needs to be turned off in the capture option
- But in network troubleshooting, you need to turn on the promiscuous mode of the network card to capture the data you want for analysis
The difference between non-promiscuous mode and promiscuous mode
Non-promiscuous mode: only sniff packets related to the selected NIC, such as those sent to it, sent from it, or routed through it, will be captured by the sniffer. That is, the data of the non-local network card will be discarded, and the mirrored traffic will not be captured when the mirrored packet is captured in the network device.
Promiscuous mode: Sniff all data packets on the transmission line of the network card, and in a non-switched network, sniff the data packets in the entire network, whether useful or useless packets will be captured, and capture all data packets of the network card ; In network troubleshooting for mirror capture, the network card used for Wireshark packet capture needs to be enabled in promiscuous mode in order to capture the data packets you want for analysis.
Troubleshooting errors:
- When I choose another network card, it is normal to turn on promiscuous mode
- I wonder if there is a problem with `npcap`, after uninstalling to the official website to download the latest version and reinstalling, it still reports the same error
- My laptop uses an external network card. I tested it on my computer with a colleague’s external network card and found it to be normal.
- Open the network adapter to check, the manufacturer of the external network card is Realtek (Realtek), and the colleague is ASUS (ASUS), the initial suspicion is related to the network card
problem solved:
- I found a piece of useful information on GitHub by querying, which probably means that the network card driver of Windows 10 needs to be installed instead of the network card driver of Windows 11.
- Indeed, after I upgraded from Windows 10 to Windows 11, I have never used an external network card to capture packets. I suspect that after upgrading to Windows 11, the external network card driver is automatically upgraded to the corresponding Windows 11 network card driver.
- Use geek.exe to uninstall the Realtek network card on the computer, according to the prompt link, enter Realtek (雷昱) to download the Windows 10 network card driver, and it returns to normal
In most cases, the onboard motherboard should be a PCIE driver. Link it: Realtek PCIe FE / GBE / 2.5G / Gaming Ethernet Family Controller Software
