Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wireshark lost traffic capture to loopback after upgraded npcap 0.99-r5 #384

Closed
timeregained opened this issue May 11, 2018 · 10 comments
Closed

Comments

@timeregained
Copy link

Recently I have upgraded npcap to 0.99-r5, however , wireshark cannot capture the loopback traffic anymore, I have downgraded npcap to the version 0.99-r2 which is distributed with nmap 7.70 and it works.

Log of DiagReport and NPFInstall have been uploaded as following:

DiagReport-20180511-091823.txt
NPFInstall.log

@PavelSann
Copy link

Same problem.
Windows 10 1803.
At 0.99-r5, the loopback capture worked.

@sspring
Copy link

sspring commented Jun 25, 2018

Same problem.
0.99-r3 and later version doesn't work on the loopback traffic.
I suggest change the title to wireshark lost traffic capture to loopback since npcap 0.99-r3

@dmiller-nmap
Copy link
Contributor

Thanks for the bug report. The usual cause of this problem is installing Npcap in WinPcap API-compatible mode, which makes Wireshark unable to capture loopback traffic. However, @timeregained's DiagReport output does not seem to show that configuration. We will investigate further.

@timeregained Does the problem happen if you follow this procedure to completely remove all Npcap Loopback Adapters on your system? https://github.com/nmap/nmap/issues/923#issuecomment-402258775

@timeregained
Copy link
Author

@dmiller-nmap Yes, the problem is still there after completely removing all Npcap Loopback Adapters on my system. By the way, the npcap is installed in WinPcap API-compatible mode and I still need this mode because some apps still depend on WinPcap.

@dmiller-nmap
Copy link
Contributor

@timeregained Thanks for the reply. I would usually close this at this point, since it's a known issue that Wireshark does not use Npcap properly when WinPcap API-compatible mode is installed, but since you say that 0.99-r2 did work, I'll spend a bit more time investigating.

@dmiller-nmap
Copy link
Contributor

Ok, this issue is due to an incomplete fix for nmap/nmap#1165. We made sure that when NPFInstall.exe knew that WinPcap mode was installed, it would also record the Loopback Adapter ID in the "npf" service registry key. But the installer for 0.99-r3 through 0.99-r6 runs NPFInstall.exe -il before the WinPcapCompatible registry key was written, so it couldn't actually do this. We will reorder these operations in the next release, but for now you can fix it by running NPFInstall.exe -ul followed by NPFInstall.exe -il, or by running the new FixInstall.bat script as administrator.

@PavelSann
Copy link

FixInstall.bat does not help.

C:\Program Files\Npcap>FixInstall.bat
find: 'Dot11Support': No such file or directory
Dot11Support =
find: 'LoopbackSupport': No such file or directory
LoopbackSupport =
find: 'WinPcapCompatible': No such file or directory
WinPcapCompatible =
find: '(Default)': No such file or directory
find: '(Default)': No such file or directory
"Unable to find or fix your installation"

@dmiller-nmap
Copy link
Contributor

@ExIngus Can you provide output from DiagReport.bat and reg query "HKLM\SYSTEM\CurrentControlSet\Services\npcap\Parameters" /v "LoopbackSupport"?

@PavelSann
Copy link

LoopbackSupport REG_DWORD 0x1

DiagReport-20180706-185611.txt

@dmiller-nmap
Copy link
Contributor

@ExIngus I still can't tell what's going wrong there. Delete the @echo off from the top of FixInstall.bat and re-run it, copying the output of the script, thanks.

@fyodor fyodor transferred this issue from nmap/nmap May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants