[Gisle Vanem <gisle.vanem@xxxxxxxxx>]

In my recently built Tshark/Wireshark etc., I've discovered
this longer works:
  tshark.exe -i \Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

It says:
  Capturing on '\Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}'
  tshark: The capture session could not be initiated on interface '\Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}'
  (Error opening adapter: Operasjonen er utført. (0)).  << == NO_ERROR !!??

But this works:
  tshark.exe -i {3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

(no "\Device" prefix) How come?

I also tried with:
  tshark.exe -o console.log.level:252 -i \Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D}

which splits out at the end some mysterious stuff:
  ...
  (tshark.exe:10360): Capture-DEBUG: argv[5]: 10360
  (tshark.exe:10360): Capture-DEBUG: read 14 ok indicator: E len: 402 msg: E

The 'msg: E' does show up with w/o the prefix?
A dumpcap/pipe reading problem?

Win-10, WinPcap 4.1.0.2980.

--
--gv