How to Fix Wireshark Not Working
Wireshark is one of the most trusted packet analyzers for network troubleshooting, but it can fail in ways that stop captures entirely or leave you with empty results.
This guide explains how to fix Wireshark not working by checking permissions, capture drivers, interfaces, and common system settings.
Most issues come down to a small set of causes: missing capture privileges, disabled interfaces, outdated adapters, or security software blocking traffic.
Once you know where to look, the problem is usually straightforward to isolate.
Why Wireshark stops working
Wireshark depends on the operating system, capture libraries, and network adapters to collect packets.
If any part of that chain breaks, you may see no interfaces, no packets, capture errors, or incomplete traffic.
- Permission problems: the user account cannot access packet capture drivers or raw sockets.
- Missing capture components: Npcap on Windows or libpcap on Unix-like systems may be absent or outdated.
- Interface issues: the adapter is disabled, virtualized, or not forwarding traffic.
- Security restrictions: antivirus, endpoint protection, or firewalls can block capture behavior.
- Filtering mistakes: capture filters may exclude all packets before they appear.
Check whether Wireshark can see any interfaces
If Wireshark opens but shows no capture interfaces, the problem is usually at the system level rather than in the app itself.
Start by confirming that the active network adapter is visible in the operating system’s network settings.
What to look for
- Ethernet or Wi-Fi adapters are enabled.
- Virtual adapters from VPNs or virtual machines are not the only devices listed.
- The interface has a valid link state and is not disconnected.
On Windows, open Network Connections and confirm the adapter is active.
On macOS, review System Settings for the interface status.
On Linux, use tools such as ip link or your desktop network manager to confirm the interface is up.
Install or repair the capture driver
On Windows, Wireshark relies on Npcap for packet capture.
If Npcap is missing, damaged, or blocked, Wireshark may launch but fail to collect packets.
Windows fix
- Close Wireshark.
- Open Apps and Features and check whether Npcap is installed.
- If it is missing, install the current Npcap release from the official site.
- If it is present but capture still fails, uninstall and reinstall it.
- During installation, allow WinPcap compatibility only if an older tool requires it.
After reinstalling, restart the computer and test a live capture on a known-active interface.
This resolves many cases of how to fix Wireshark not working on Windows.
Linux and macOS capture libraries
Linux usually depends on libpcap and packet capture permissions. macOS also uses capture frameworks that may require explicit security approval.
If Wireshark cannot capture, make sure the application is allowed in Privacy & Security settings and that the required libraries are installed through your package manager.
Run Wireshark with the right permissions
Insufficient privileges are a common reason for empty captures.
Wireshark needs elevated access to read packet data from network devices.
Windows
On modern Windows versions, Npcap and Wireshark should usually work without constantly running as administrator, but initial setup and certain adapter types may still require elevated permissions.
If you can only capture after launching as administrator, the user account or driver configuration needs attention.
Linux
On Linux, adding your user to the proper capture group is often the best fix.
Many distributions use a wireshark or dumpcap group for packet capture.
After updating group membership, log out and back in before testing again.
macOS
macOS may prompt for network capture access during installation or first use.
If you denied access earlier, open Security settings and review Wireshark’s permissions.
Verify that the correct network interface is selected
Wireshark can appear broken when it is simply listening on the wrong interface.
A laptop on Wi-Fi may not show traffic on Ethernet, and a VPN adapter may not reflect local LAN activity.
To avoid this:
- Select the interface that matches your active connection.
- For local traffic, try the primary Ethernet or Wi-Fi adapter.
- For VPN troubleshooting, select the VPN interface if the traffic is routed through it.
- For loopback testing, use the loopback adapter or the OS-specific local capture option.
If packet counts remain at zero, test another interface to compare behavior.
Review capture filters and display filters
Filters are powerful, but they can make Wireshark look nonfunctional when they are too restrictive.
A capture filter blocks packets before they are recorded, while a display filter only hides them from view after capture.
Common filter mistakes
- Using a capture filter that excludes all traffic.
- Typing an invalid filter expression.
- Confusing capture filters with display filters.
For troubleshooting, remove the capture filter entirely and start a new capture.
If packets appear, the filter was the problem.
You can then reintroduce a narrower filter gradually.
Disable or adjust security software
Endpoint protection platforms, firewalls, and some antivirus products can interfere with packet capture.
They may block driver loading, network access, or raw packet inspection.
If Wireshark stopped working after a security update, try the following:
- Temporarily disable third-party antivirus protection for testing.
- Check whether your endpoint security product blocks Npcap, dumpcap, or Wireshark.
- Add trusted-executable exceptions if your security policy allows it.
- Test on a different network profile to rule out firewall-based filtering.
Re-enable protection after testing, especially on production systems.
Update Wireshark and system components
Older versions of Wireshark may not handle newer OS builds, adapter drivers, or capture engines correctly.
Updating both Wireshark and the underlying network stack often resolves stability issues.
- Install the latest stable Wireshark release.
- Update Npcap on Windows.
- Apply operating system updates.
- Refresh network adapter drivers from the hardware vendor or system manufacturer.
Driver mismatches are especially common after major Windows updates or when using Wi-Fi adapters with vendor-specific software.
Check for virtual machine and VPN conflicts
VirtualBox, VMware, Hyper-V, Docker, and VPN clients can create additional adapters that confuse capture selection or change packet routing.
In some cases, they also attach filters that alter what Wireshark sees.
If you recently installed a VPN or virtualization tool, test with those services paused.
Then capture again on the primary physical adapter.
If Wireshark works only after disconnecting the VPN, the issue is likely adapter routing rather than Wireshark itself.
Reset network settings if captures remain empty
If nothing else works, a network stack reset can clear corrupted adapter settings or broken bindings.
This is not the first step, but it is useful when the OS itself seems misconfigured.
- Windows: use network reset options or reinstall the adapter driver.
- macOS: remove and re-add the network service in system settings.
- Linux: restart the network manager or reload the adapter module if needed.
After any reset, reboot and test capture again with no filters and the correct interface selected.
Quick checklist for how to fix Wireshark not working
- Confirm the network adapter is enabled and active.
- Install or repair Npcap on Windows.
- Make sure Wireshark has permission to capture packets.
- Select the correct physical or virtual interface.
- Remove capture filters during troubleshooting.
- Temporarily test without antivirus, VPN, or endpoint controls.
- Update Wireshark, adapter drivers, and the operating system.
- Test on a second interface to isolate the failure point.
When Wireshark is not working, the fastest path to a fix is to narrow the problem from the top of the stack downward: interface, driver, permissions, then filters.
That method usually reveals the exact point where packet capture is failing.