Neither capture methods working properly

[mythofechelon]

My environment:

• OS: Windows 10 21H2
• Wireshark: v3.6.8 (latest as of writing) 64-bit
• Npcap: v1.60 (latest as of writing)
• USBPcap: Not installed
• Winshark: v1.1.0 (latest as of writing)

My install process:

1. Install Wireshark.
2. Install Winshark.
3. Open Wireshark (as administrator) and select Edit → Preferences... → Protocols → DLT_USER → Edit... → + and, for User 0 (DLT=147), set the payload protocol to winshark (other instructions say to use etw, but Wireshark says dissector not found).

Following the instructions, what I do and see for capture method 1:

1. Open PowerShell as administrator and run command pktmon start -c -m real-time (real-mode is stated in the Winshark documentation, but this is not a valid argument).
   
2. Open Wireshark as administrator and start a capture on the interface Pktmon. No network-level data is displayed, only Microsoft-Windows-PktMon:
   
   
3. Switch to the PowerShell window and, to stop the capture, press CTRL + C.

Following the instructions, what I do and see for capture method 2:

1. Open PowerShell as administrator and run commands netsh.exe trace start capture=yes report=no correlation=no and then logman start Winshark-PacketCapture -p "Microsoft-Windows-NDIS-PacketCapture" -rt -ets.
   
2. Open Wireshark as administrator and start a capture on the interface Winshark-PacketCapture. Only layer 2 network-level data is displayed.
   
   
   
3. Switch to the PowerShell window and, to stop the captures, run commands netsh.exe trace stop (this one can take a little while and a lot of CPU for the data collection to complete) and then logman stop Winshark-PacketCapture -ets. (I'd like to see this included in the documentation for others.)
   

[mgp25]

Facing exactly the same as @mythofechelon