Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
Npcap: pcap_findalldevs is very slow #1551
Users are complaining about Wireshark taking a long time to populate the list of adapters, even going so far as to suggest turning off Npcap when using Wireshark for reading pcap files. This shouldn't take so long.
The most promising idea so far is: Don't try to open each adapter as it is found (PacketOpenAdapter) in order to determine if it is supported. Packet API docs (unpublished) indicate that PacketGetAdapterNames is supposed to only return supported adapters, but I don't know if anything relies on that. Need to check libpcap to see, since that's the primary consumer of that API.
There was a time when libpcap itself tried to open interfaces when enumerating them; this was done because, on Solaris, not all devices provided by the
I changed libpcap to make the "is this a usable device?" check platform-specific. It still has to do some of the open process platforms where not all devices supplied by the enumerate-interfaces mechanism support the platform's capture mechanism, but: