New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Npcap's pcap_sendqueue_transmit Causes Windows10 Blue Screen #374
Comments
Thanks for the report! We'll look into it. Does this happen every time you use |
I'm doing some initial testing, and while I am running into problems getting it to work, I have not seen any blue screen errors. Can you get a minidump crash dump and DiagReport output so we can diagnose the problem? https://nmap.org/npcap/guide/npcap-users-guide.html#npcap-issues |
@WangChengZhang Would you mind sharing a bit of your sample code that uses |
Okay Daniel... Some explanations: 1.For this sender,I use 1 circular linked list with 3 pcap_send_queue to store data. And I use 2 threads filling and sending data. Within the main thread,I fill the queue by calling pcap_sendqueue_queue. Within the sending thread,I send the queue by calling pcap_sendqueue_transmit. 2.Each time before I calling pcap_sendqueue_transmit I will call pcap_sendpacket first. Because I need reopen the adapter in the case of an error. Unfortunately,pcap_sendqueue_transmit won't return false in some cases(like computer wakes up from sleep and restarts the adapter). So I need to call pcap_sendpacket judging the state of adapter. |
Thanks for the update. I'll see what I can figure out. I wonder if there's a better way to determine if the adapter handle is still valid? |
Still investigating. I think that in the case where there is a power event that causes Npcap handles to be invalidated, We will work on improving the errors that are returned, but also look for a cause on the BSOD crash. |
Thanks, I'll try it. |
@dmiller-nmap , I have checked the code of npcap recently.
And I found that:
|
In the crash dumps @PiAil provided on #370, the backtrace comes directly from Pure speculation: Maybe Npcap is injecting NBLs allocated from a pageable pool, and when the NIC driver gets around to sending them, they've been paged out? |
I've tried to reproduce this crash and have not been able to. My testing was done on a Windows 10 VM in Hyper-V, with Npcap 0.99-r9 running with standard Driver Verifier settings. I captured a speed test on fast.com, resulting in a 13.8 MB pcap file with 27573 packets. Then I played that back on the network with @WangChengZhang are you able to submit a crash minidump file that we could inspect? @PiAil Does the crash happen on different hardware, especially a network card from a different manufacturer? |
I tried with two different network card ( With the first card, I got a BSoD, here a minidump: With the second one, a big freeze, a reboot, and a minidup: The file I'm trying to send is bigger than yours (~150 MB). I don't know the limit but it seems that with small file, the packets are sent without any problem. An exemple of my file: Note: It is an UDP flood with spoofed IP for learning purpose |
Thanks for the additional info! I'm still not able to trigger with your file example, but that may be because of mismatching MAC addresses. The first minidump has a short stack trace without Npcap in it, but the second one shows a crash in the NIC driver with Npcap functions in the stack trace. I do have a further question based on this stack trace, though: Are you sending the packets on the Npcap Loopback Adapter? The function in the stack trace is |
Nop, I'm not using the Npcap Loopback Adapter, but the one linked to my NIC (found with |
Ok, I've audited all the places the internal Please reinstall the latest Npcap, but install without loopback capture support. Then try to send your packet dump. If it crashes, we've narrowed it down to a different portion of the code (and maybe we will get a helpful crash dump). If it does not crash, then we've proven the problem is related to the loopback code, and we can investigate further there. |
Tried to install Npcap again without the loopback adapter and nothing changed. I couldn't access the machine which printed the error relative to the loopback adapter again, but here a mindump with the |
@PiAil Thanks for the dump. I agree, there's nothing specifically implicating Npcap in this one either, but it certainly does seem suspicious that entirely different drivers both crash with a page fault under these circumstances. Thanks for your patience while we try to sort this out. |
Ok, it looks like this will likely be fixed in the next release. The issue is that when Npcap sends packets, it has to create a |
Npcap 0.991 was just released and should fix this problem. We would be very grateful if @WangChengZhang or @PiAil can confirm that the problem is solved. |
Thanks for your work on the problem ! Unfortunately, I tried the new version, with fewer packets (10 * 1500 bytes) to begin, and it crashed with a new error message Note that it didn't crash previously with this little number of packets. I didn't try with bigger files, in order to save a bit my laptop ! Minidump: Edit: Tested with another NIC, same crash, same error message. |
I would like to also report the same problem with npcap-0.991. Minidump: |
From the Bugcheck Analysis of your
I'm not surprised. |
Thanks for the updates. We have this additional crash fixed and will release shortly. See 8ecd3d8 for the fix. |
This should be fixed in Npcap 0.992. Thanks! |
Problem still there for me ( |
@PiAil I'm sorry to hear it didn't work for you. For some reason, I'm not able to get sendqueue to work on any of my test systems right now, so I'm trying to debug that. I do get some crashes when trying to send on Loopback Adapter, which I'm investigating also, but if you have a crash dump for Npcap 0.992 on an ordinary network adapter, I'd be very grateful if you could send it to me. |
Here it is |
Ok, I think I have the fix in now. I have some more testing to do and some improvements to the returned error values for buffered writes, but this should be taken care of in the next release. Thanks again for responding so quickly. |
This ought to have been fixed in Npcap 0.993. We have included testing of |
The bug seems fixed for me, at least for the 0.9983 version, thanks for your great work ! |
I need to let the gigabit ethernet adapter work with the full speed(about 950Mbit/s). So I use the pcap_sendqueue_transmit function.
But:
The npcap causes bluescreen.
The wpcap works well but lose some packets probably.
The text was updated successfully, but these errors were encountered: