Thursday, November 8, 2012

Windows 8 Pain Point #2 - Erased, Wireshark Functions!

I wanted to look at a packet capture today, and realized I hadn't installed one of my favorite tools:  Wireshark.  For the uninitiated, Wireshark is dependent on the WinPCAP driver and when installing Wireshark you have to install the WinPCAP driver at the same time.  Much to my dismay, the WinPCAP driver fails during installation due to "known compatibility issues" in Windows 8.  

Even after downloading the driver separately and switching the compatibility settings on both installers to "Windows 7," it still fails.  I know it's only a matter of time until the folks at Wireshark/Riverbed update their software, but I'm saddened all the same.

Since I use Wireshark pretty frequently, I'll post an update once I get a working version.

Update (12/6/2012): I got the WinPCAP driver to install!  Just download the current version of Wireshark and install it.  It will error out during the installation of WinPCAP, but that's fine, complete the installer anyway.  Once you finish, go to the directory in which you installed Wireshark and right-click on the WinPCAP.exe file.  Click on the "Compatibility" tab and set it to Windows 7 and check the run as administrator at the bottom.  Then, when you run it, you'll still get an error but at least you can click on "Run the Program" to get it installed.

What I notice also is that when taking a PCAP (which works fine), it no longer observes the activity with the named interface I was used to - now it's just under a "Microsoft" interface.  But hey, it works!

Update (01/31/2014): I realized that I forgot to update this post.  Wireshark now works seamlessly on Windows 8/8.1 with the most recent version.