windump/wireshark capture on MC7304 on Windows 7

Hi,
In our system, we have migrated from MC8704 to MC7304 , we take data measurements over LTE , we use the tool: windump / WinPcap and Wireshark.
The problem we have encountered with MC7304 is that we can’t capture with WireShark or windump on the active interface .
The first thing you see is that the Build4277 driver in Windows 7, three lan interfaces are detected with MC7304 , and reviewing the Windows registry obtain the identifiers of the 3 interfaces :

Sierra Wireless Mobile Broadband Network Adapter #10:
o [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0032]
o “DeviceInstanceID”=“USB\VID_1199&PID_68C0&MI_0B\7&337AA8A&0&000B”
o “NetCfgInstanceId”="{589AE189-77C5-40E5-A995-B3B4E48B10C7}"
Sierra Wireless Mobile Broadband Network Adapter #9:
o [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0028]
o “DeviceInstanceID”=“USB\VID_1199&PID_68C0&MI_0A\7&337AA8A&0&000A”
o “NetCfgInstanceId”="{DCE1AE80-129F-4961-9E42-E99575FFD561}"
Sierra Wireless Mobile Broadband Network Adapter #8:
o [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0026]
o “DeviceInstanceID”=“USB\VID_1199&PID_68C0&MI_08\7&337AA8A&0&0008”
o “NetCfgInstanceId”="{85F5E246-A22F-4927-8087-D939A0FB9EB8}"

And running windump -D we get the list of interfaces available for capture ( the same as we see in Wireshark ) :
1.\Device\NPF_{CC12EFAC-1229-48CB-BAAB-C27863A3E350} (VMware Virtual Ethernet Adapter)
2.\Device\NPF_{DEEF31EA-2900-41FC-825B-C4AB93E3FC8B} (Intel® 82579LM Gigabit Network Connection)
3.\Device\NPF_{D74DD874-3D44-48A8-905F-A819A649BB55} (Microsoft)
4.\Device\NPF_{121A3BCC-7280-4A70-897B-A4EAFC72751D} (Microsoft)
5.\Device\NPF_{D142B86F-7AD3-4E42-9BD1-625CE5A9CA9D} (VMware Virtual Ethernet Adapter)
6.\Device\NPF_{589AE189-77C5-40E5-A995-B3B4E48B10C7} (QUALCOMM INC WWAN)
7.\Device\NPF_{919C8E60-C1E8-4879-8770-B17F23187DEF} (Juniper Network Connect Virtual Adapter)

As we see it is the only index 6 is detected and is associated with the adapter: Sierra Wireless Mobile Broadband Network Adapter #10.
The problem is that when we activate a context through AT commands: AT!SCACT=1,1,
The active interface with IP is: Sierra Wireless Mobile Broadband Network Adapter #8¸ making it impossible to capture with Windump / Wireshark.

Is it a problem of driver? Settings?

The FW of MC7304 is: SWI9X15C_06.03.32.02 r26426 CNSHZ-AR-BUILD 2015/01/16 01:32:41
And the USB configuration is:
AT!UDUSBCOMP=?
1 - DM AT
23 - DM NMEA MODEM RMNET1 RMNET2 RMNET3 AUDIO
24 - DM NMEA MODEM RMNET1 RMNET2 RMNET3
25 - DM NMEA MODEM AT AUDIO
OK

AT!UDUSBCOMP?
!UDUSBCOMP: 23
OK

We have also done a debug mode with windump , and this is the information generated by the winpcap_debug.txt windump -D file :

[00002BAC] 2015-10-30 09:53:37 Trying to open adapter \Device\NPF_{589AE189-77C5-40E5-A995-B3B4E48B10C7}
[00002BAC] 2015-10-30 09:53:37 NPF registry key present, driver is installed.
[00002BAC] 2015-10-30 09:53:37 Trying to see if the NPF service is running…
[00002BAC] 2015-10-30 09:53:37 --> PacketSetReadEvt
[00002BAC] 2015-10-30 09:53:37 <-- PacketSetReadEvt
[00002BAC] 2015-10-30 09:53:37 Successfully opened adapter
….
[00002BAC] 2015-10-30 09:53:38 Trying to open adapter \Device\NPF_{DCE1AE80-129F-4961-9E42-E99575FFD561}
[00002BAC] 2015-10-30 09:53:38 NPF registry key present, driver is installed.
[00002BAC] 2015-10-30 09:53:38 Trying to see if the NPF service is running…
[00002BAC] 2015-10-30 09:53:38 PacketOpenAdapterNPF: CreateFile failed, LastError= 00000019
[00002BAC] 2015-10-30 09:53:38 <-- PacketOpenAdapterNPF
[00002BAC] 2015-10-30 09:53:38 NPF Adapter not available, do not add it to the global list
….
[00002BAC] 2015-10-30 09:53:38 Trying to open adapter \Device\NPF_{85F5E246-A22F-4927-8087-D939A0FB9EB8}
[00002BAC] 2015-10-30 09:53:38 NPF registry key present, driver is installed.
[00002BAC] 2015-10-30 09:53:38 Trying to see if the NPF service is running…
[00002BAC] 2015-10-30 09:53:38 PacketOpenAdapterNPF: CreateFile failed, LastError= 00000019
[00002BAC] 2015-10-30 09:53:38 <-- PacketOpenAdapterNPF
[00002BAC] 2015-10-30 09:53:38 NPF Adapter not available, do not add it to the global list
……

Thanks for help!

what about the modem port? are you able to capture using that?

-Alex

There is no GenericDialupAdapter interface detected by Wireshark, even after manually activating a PPP connection on the modem.
But the operating mode is activating the PDP context by AT commands (AT!SCACT=1,1) and capture on the RMNET interface.

  • Jaime