Windows rpcapd

From VoIPmonitor.org
Jump to navigation Jump to search

Steps for enable live sniffer as a service on Windows

(tested on 8.1 64b, IP 192.168.88.247)

  • Instal windows wireshark including wincap driver
  • Locate winpcap file (c:\Program Files (x86)\WinPcap)
  • In winpcap folder we create config file for 'Remote Packet Capture' service (and set from which IP we will access this service)
rpcapd.exe -s rpcapd.ini -l 192.168.88.243
press CTRL+C and check existence of file rpcapd.ini
  • edit rpcapd.ini using any text editor and change value of option NullAuthPermit to YES and save a file
notepad rpcapd.ini
  • Start rpcapd service in services
Computer setting->services->remote packet capture->start
  • we should check that port 2002/tcp has been opened
  • now we determine windows device on which we want to capture packets
c:\Program Files (x86)\Wireshark>Tshark -D
1.\Device\NPF_{0FF92A37-6568-4767-A301-C0F75B0E3B5F} (VMware Virtual Ethernet Adapter)
2.\Device\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A} (Realtek PCIe FE Family Controller)
3.\Device\NPF_{6A56305C-21BB-4C9E-ADC2-1E52CAADDD1F} (Microsoft)
4.\Device\NPF_{EA754A1D-4BFE-422C-82F6-A65C28359CE0} (VMware Virtual Ethernet Adapter)
5.\Device\NPF_{62063D99-FD27-4E2E-8E27-5B154D2AE70C} (Microsoft)
  • copy device of your choice, we use later '\Device\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A}'



Steps for enable live capture using rpcap from remote PC

(tested on linux Wheezy, IP 192.168.88.243)

  1. compile libpcap from wireshark
    1. mkdir -p /usr/src/libpcap-1.0.0/
    2. cd /usr/src/
    3. wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_3.zip
    4. unzip WpcapSrc_4_1_3.zip
    5. cp -r /usr/src/winpcap_4_1_3/wpcap/libpcap/ /usr/src/libpcap-1.0.0/
    6. cd /usr/src/libpcap-1.0.0/
    7. chmod +x configure runlex.sh
    8. ./runlex.sh
    9. ./configure
    10. make; make install


  1. ahoj