# windump/wireshark capture on MC7304 on Windows 7

**URL:** <https://forum.sierrawireless.com/t/windump-wireshark-capture-on-mc7304-on-windows-7/8269>\
**Category:** MC/EM Series\
**Created:** [November 4, 2015, 4:44pm UTC](https://forum.sierrawireless.com/t/windump-wireshark-capture-on-mc7304-on-windows-7/8269 "2015-11-04T16:44:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaboullosa](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@jaboullosa](https://forum.sierrawireless.com/u/jaboullosa)\
**Post date:** [November 4, 2015, 4:44pm UTC](https://forum.sierrawireless.com/t/windump-wireshark-capture-on-mc7304-on-windows-7/8269/1 "2015-11-04T16:44:29Z")

</div>

Hi,  
In our system, we have migrated from MC8704 to MC7304 , we take data measurements over LTE , we use the tool: windump / WinPcap and Wireshark.  
The problem we have encountered with MC7304 is that we can’t capture with WireShark or windump on the active interface .  
The first thing you see is that the Build4277 driver in Windows 7, three lan interfaces are detected with MC7304 , and reviewing the Windows registry obtain the identifiers of the 3 interfaces :

• Sierra Wireless Mobile Broadband Network Adapter #10:  
o [HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0032]  
o “DeviceInstanceID”=“USB\VID\_1199&PID\_68C0&MI\_0B\7&337AA8A&0&000B”  
o “NetCfgInstanceId”="{589AE189-77C5-40E5-A995-B3B4E48B10C7}"  
• Sierra Wireless Mobile Broadband Network Adapter #9:   
o [HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0028]  
o “DeviceInstanceID”=“USB\VID\_1199&PID\_68C0&MI\_0A\7&337AA8A&0&000A”  
o “NetCfgInstanceId”="{DCE1AE80-129F-4961-9E42-E99575FFD561}"  
• Sierra Wireless Mobile Broadband Network Adapter #8:   
o [HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1-08002BE10318}\0026]  
o “DeviceInstanceID”=“USB\VID\_1199&PID\_68C0&MI\_08\7&337AA8A&0&0008”  
o “NetCfgInstanceId”="{85F5E246-A22F-4927-8087-D939A0FB9EB8}"

And running windump -D we get the list of interfaces available for capture ( the same as we see in Wireshark ) :  
1.\Device\NPF\_{CC12EFAC-1229-48CB-BAAB-C27863A3E350} (VMware Virtual Ethernet Adapter)  
2.\Device\NPF\_{DEEF31EA-2900-41FC-825B-C4AB93E3FC8B} (Intel® 82579LM Gigabit Network Connection)  
3.\Device\NPF\_{D74DD874-3D44-48A8-905F-A819A649BB55} (Microsoft)  
4.\Device\NPF\_{121A3BCC-7280-4A70-897B-A4EAFC72751D} (Microsoft)  
5.\Device\NPF\_{D142B86F-7AD3-4E42-9BD1-625CE5A9CA9D} (VMware Virtual Ethernet Adapter)  
6.\Device\NPF\_{589AE189-77C5-40E5-A995-B3B4E48B10C7} (QUALCOMM INC WWAN)  
7.\Device\NPF\_{919C8E60-C1E8-4879-8770-B17F23187DEF} (Juniper Network Connect Virtual Adapter)

As we see it is the only index 6 is detected and is associated with the adapter: Sierra Wireless Mobile Broadband Network Adapter #10.  
The problem is that when we activate a context through AT commands: AT!SCACT=1,1,  
The active interface with IP is: Sierra Wireless Mobile Broadband Network Adapter #8¸ making it impossible to capture with Windump / Wireshark.

Is it a problem of driver? Settings?

The FW of MC7304 is: SWI9X15C\_06.03.32.02 r26426 CNSHZ-AR-BUILD 2015/01/16 01:32:41  
And the USB configuration is:  
AT!UDUSBCOMP=?  
1 - DM AT  
23 - DM NMEA MODEM RMNET1 RMNET2 RMNET3 AUDIO  
24 - DM NMEA MODEM RMNET1 RMNET2 RMNET3  
25 - DM NMEA MODEM AT AUDIO  
OK

AT!UDUSBCOMP?  
!UDUSBCOMP: 23  
OK

We have also done a debug mode with windump , and this is the information generated by the winpcap\_debug.txt windump -D file :

[00002BAC] 2015-10-30 09:53:37 Trying to open adapter \Device\NPF\_{589AE189-77C5-40E5-A995-B3B4E48B10C7}  
[00002BAC] 2015-10-30 09:53:37 NPF registry key present, driver is installed.  
[00002BAC] 2015-10-30 09:53:37 Trying to see if the NPF service is running…  
[00002BAC] 2015-10-30 09:53:37 --\> PacketSetReadEvt  
[00002BAC] 2015-10-30 09:53:37 \<-- PacketSetReadEvt  
[00002BAC] 2015-10-30 09:53:37 Successfully opened adapter  
….  
[00002BAC] 2015-10-30 09:53:38 Trying to open adapter \Device\NPF\_{DCE1AE80-129F-4961-9E42-E99575FFD561}  
[00002BAC] 2015-10-30 09:53:38 NPF registry key present, driver is installed.  
[00002BAC] 2015-10-30 09:53:38 Trying to see if the NPF service is running…  
[00002BAC] 2015-10-30 09:53:38 PacketOpenAdapterNPF: CreateFile failed, LastError= 00000019  
[00002BAC] 2015-10-30 09:53:38 \<-- PacketOpenAdapterNPF  
[00002BAC] 2015-10-30 09:53:38 NPF Adapter not available, do not add it to the global list  
….  
[00002BAC] 2015-10-30 09:53:38 Trying to open adapter \Device\NPF\_{85F5E246-A22F-4927-8087-D939A0FB9EB8}  
[00002BAC] 2015-10-30 09:53:38 NPF registry key present, driver is installed.  
[00002BAC] 2015-10-30 09:53:38 Trying to see if the NPF service is running…  
[00002BAC] 2015-10-30 09:53:38 PacketOpenAdapterNPF: CreateFile failed, LastError= 00000019  
[00002BAC] 2015-10-30 09:53:38 \<-- PacketOpenAdapterNPF  
[00002BAC] 2015-10-30 09:53:38 NPF Adapter not available, do not add it to the global list  
……

Thanks for help!

---

<div class="post-metadata">

**Author:** ![Rex\_alex](https://avatars.discourse-cdn.com/v4/letter/r/73ab20/32.png) [@Rex\_alex](https://forum.sierrawireless.com/u/Rex_alex)\
**Post date:** [November 18, 2015, 6:57am UTC](https://forum.sierrawireless.com/t/windump-wireshark-capture-on-mc7304-on-windows-7/8269/2 "2015-11-18T06:57:01Z")

</div>

what about the modem port? are you able to capture using that?

-Alex

---

<div class="post-metadata">

**Author:** ![jaboullosa](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@jaboullosa](https://forum.sierrawireless.com/u/jaboullosa)\
**Post date:** [November 18, 2015, 9:20am UTC](https://forum.sierrawireless.com/t/windump-wireshark-capture-on-mc7304-on-windows-7/8269/3 "2015-11-18T09:20:42Z")

</div>

There is no GenericDialupAdapter interface detected by Wireshark, even after manually activating a PPP connection on the modem.  
But the operating mode is activating the PDP context by AT commands (AT!SCACT=1,1) and capture on the RMNET interface.

- Jaime