0

I am trying to set up remote packet capture amongst 2 machines within my network. I have installed Wireshark and WinPcap on the server and I have installed WinPcap on the target. I have both turned on Remote Packet Capture Protocol v.0 (experimental) and ensured rpcapd is running in services. I have turned off Windows firewall on both machines. Now when I go to wireshark and look up remote interfaces, i type in the IP address of the target and the port (2002 by default) but it says it cannot find any interfaces. Am I missing something here? Any advice would be much appreciated.

Thanks

Improve this question

1 Answer 1

Reset to default
0

Depending upon your version of Windows, Windows may have turned on firewalling automatically. Have you opened a port to allow inbound connections?

Improve this answer
2
  • The rules have been explicitly applied to both inbound and outbound on both of the PCs firewalls. Still not recognising any interfaces.
    – CrazyHorse019
    Nov 2, 2016 at 10:23
  • Use the netstat command from the command line to determine that services are listening. Use wireshark itself on each machine to monitor packet arrival and delivery. And sometimes brute force and ignorance is necessary to test a theory: turn off the firewall to prove that it isn't interfering. Has happened to me.
    – Raymond Burkholder
    Nov 6, 2016 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .