New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Npcap: packet capture interrupted when enumerating devices or opening another packet capture #401
Comments
Another report has shed more light on this issue. The network load is not a factor. The source of the problem is a discrepancy between how Windows and *nix define and implement "promiscuous mode." For the purposes of discussion, I'll be referring to the Linux implementation of libpcap which uses In libpcap (which is included in Npcap as wpcap.dll), promiscuous mode is a boolean flag within the On Windows, promiscuous mode is set by each driver (of which Npcap is one). It is one of several "packet filter" flags that can be set. If all flags are cleared, no packets are delivered. This means that we have to choose one of the other flags to be the "default" packet filter, and we (both in libpcap and in Npcap's Packet.dll) use Because the Npcap driver is responsible for setting promiscuous mode or "normal mode," starting a second packet capture in "normal mode" can turn off the promiscuous mode for all other running captures. We need to keep track of the mode of all running captures and use the most permissive set. The solution appears to be that we keep track of the packet filters (modes) set by all running captures and use bitwise operations to add or remove them from the final filter that we send downstream. I have not found any software that calls The odd part here is that a running capture would be affected when enumerating interfaces, as this shouldn't set the underlying packet filter. In the case of Wireshark, the capture interface list shows a sparkline graph of traffic for each interface; this may be a result of opening a packet capture, which would make sense as a cause for this problem. But if I understand correctly, the original reporter claims that this happens when simply calling |
This issue is fixed in Npcap 0.99-r6. |
User reports packet capture interruption under the following conditions:
We have been unable to reproduce under 300 Mbps load on Windows 10.
The text was updated successfully, but these errors were encountered: