hi eliramd,

when you say urlsnooper doesn't work -- can you be more specific?
are you saying that you see the adapter, and when you click to sniff and browse the web, you can see the packet count increasing in the url snooper status bar, but that it's just not returning results you expect?

if you click the "Sniff Network" button, and then open up your web browser and start sniffing around, do you see the bottom status bar start showing a count of how many packets received?

what this suggests to me is that maybe you haven't selected the right adapter.. are you sure it's the one you are actually using? and are you saying that wireshark does get information from using this same adapter?

the only other thing i can think of is that maybe you have the "only scan this computer" checkbox unchecked, and that the adapter is refusing to operate in promiscuous mode?

I speculate that installing WireShark somehow breaks UrlSnooper. UrlSnooper worked for me until I installed WireShark. Now, even after uninstalling WireShark, UrlSnooper cannot autodetect the adapter. Maybe you should look into it by installing WireShark on your own system? The list of adapters shows up fine, but none of them return any results when sniffing packets.

I have a similar problem, I guess - after installing Windows 7, adapters are found ("Network adaptor 'Microsoft' on local host" (x2, for some reason), and  "Network adaptor 'Marvell Yukon Ethernet Controller.' on local host"), but they don't work. I'm currently running on a wireless (Intel WiFi 5300), and if I recall correctly, this was the only one which worked under Vista, which is... missing now, haha. Windump only lists these 3, as well. I've uninstalled URL Snooper, Winpcap, reinstalled, run as admin, but nada.

Any help would be greatly appreciated!

More about what I suspect: WireShark does something to prevent UrlSnooper to work.
Not sure if I alters WinPcap (as I believe I reinstalled it at one point) or some other file.
mouse, do you know if there are any other files/programs that UrlSnooper depends on - such as some DLLs or something - that WireShark may be altering?

hi,
formated & reinstalled the computer without the wireshark, and the URLSnooper is working.
i didn't install all of the program i had on the old computer, but it's looking like that the wireshark is as guilty as hell.
hope i won't need it in the neer future

Win7 64bit ultimate and URL Snooper v2.26.01 here

URL Snooper doesn't detect my Atheros AR928X wireless card.. it shows the same list as

D:\>WinDump -D
1.\Device\NPF_{1DE7B2FF-BDA0-49C6-BD19-73582F3B0866} (Microsoft)
2.\Device\NPF_{2D645593-CA05-418B-833E-DFEC05BF020B} (Realtek RTL8168C(P)/8111C(P) Family PCI-E GBE NIC)
3.\Device\NPF_{F85F9D11-D155-447F-8954-727EBB6BAB80} (Microsoft)

=\

this is a followup on my post, I hope someone would help me. thanks

I'm having a similar problem.  I'm on Win7 x64 using Winpcap 4.1.2 and URLSnooper2 2.28.01.  It won't autodetect my adapter and it's not in the list.  I'm using a wireless adapter (onboard - Intel) and in URLSnooper it has listed Microsoft, Microsoft, TAP-Win32 Adapter V9, and Broadcom Netlink Gigabit Ethernet driver.  Autodetect fails every time.  When I run windump -d I get the following output:

windump: listening on \Device\NPF_{0C2B00A0-B520-4434-AFE1-6AD19B283BAE} (000) ret #96

I tried each of the listed adapters manually and sniffed around but it came back with nothing each time.

I tried running URLSnooper as an admin and in compatibility mode for Vista and XP SP2 with no change.  I'm wondering about the auto detect adapter string, which by default says "Privacy".   Where is this line of text supposed to be coming from?  Google's index page or where exactly?

Is there anything else I could try to manually add my adapter such as the registry keys for URLSnooper or any adjustments for the settings?

Thanks in advance,
pogue

Quote

I'm wondering about the auto detect adapter string, which by default says "Privacy".   Where is this line of text supposed to be coming from?  Google's index page or where exactly?

yes -- it's simply looking to see a specific string in the page it retrieves, in this case the string "Privacy" expected on the google page.  when found it means the page was seen.

first advice: completely forget about automatic network adapter detection -- just turn it off, it serves no value except to save you the trouble of selecting your adapter from the drop down list.

the real problem is your intel wireless adapter may not be supported by winpcap.

Well, I played around with it a bit more and logged into a VPN I use that uses OpenVPN and low and behold URLSnooper was able to sniff traffic through the TAP-Win32 Adapter V9 driver.

Strange that Winpcap wouldn't support my wireless driver, as it's the standard Intel onboard adapter that comes with many laptops.  It's the Intel Wifi Link 1000 BGN.  Here's a screen shot of my device drivers screen with the 2 Microsoft adapters, Intel wifi, ethernet, and TAP-Win32 drivers listed.  URLSnooper just doesn't see the Intel one.

http://img695.imageshack.us/img695/6199/networkadapters.jpg

I did upgrade from Winpcap 3.1.1 to 3.1.2 prior to making this post, but I haven't tried updating the wifi adapter's drivers from the vendor/Intel.  Does Winpcap publish a list of adapters they support?  Any other suggestions?

Thanks for the help mouser.

there are definitely winpcap problems with some wireless adapters -- i think especially intel.  it's unfortunate but i don't know much more.. the winpcap site used to have an archived discussion list somewhere but it's hard to find now and im not sure where it is.

I think I found it

http://www.winpcap.org/misc/faq.htm#Q-16

Windows NT4/2000/XP/2003/Vista/2008/Win7/2008R2: the packet driver works ok on Ethernet networks. As for dial-up adapters and VPN connections, read Q5 and Q6.  As in Win9x,  FDDI, ARCNET, ATM and Token Ring are supported, but not tested by us.
Wireless adapters: these adapters may present problems, because they are not properly supported by the Windows Kernel. Some of them are not detected, other don't support promiscuous mode. In the best case, WinPcap is able to see an Ethernet emulation and not the real transiting packets: this means that the 802.11 frames are transformed into fake Ethernet frames before being captured, and that control frames are not received.

mouser thank you . your Souloution Worked for me