Skip to content

WireShark - can only capture once from specific Device #143

@DSanchen

Description

@DSanchen

I'm using USBPcap 1.5.4.0 with WireShark 4.6.0.

It seems to me, as if USBPcap can only be used once to capture data from a specific device. When trying to restart the capturing, nothing happens.

In WireShark I use the Interface Options Dialog, to specify which Device I am interested in:

Image

When staring, WireShark starts two processes:

"C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --capture --extcap-interface \.\USBPcap2 --fifo \.\pipe\wireshark_extcap_\.\USBPcap2_20251023104844 --inject-descriptors --bufferlen 2097152 --snaplen 1048576 --devices 4

"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -F pcapng -i wireshark_extcap2012 --ifname \.\USBPcap2 --ifdescr USBPcap2 -y USBPCAP --signal-pipe 15164 -Z 1712

Both processes are terminated, once I stop capturing.

When I now try to start capturing again with the same settings (I did not change anything in my devices - no unplug, new device or so...) both processes start but USBPcapCMD.exe terminates immediately without any data being produced. dumpcap.exe stays alive:

"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 19516.dummy -Z 1848

I'm not sure if this is a USBPcap or WireShark issue, but it would be great when capturing from the same device would work. The only workaround seems to be to restart WireShark...

Edit: Another workaround seems to be to start WireShark with administrative privileges...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions