Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Npcap: Can it detect new interfaces without restarting the driver? #435

Closed
dmiller-nmap opened this issue Jan 23, 2017 · 6 comments
Closed

Npcap: Can it detect new interfaces without restarting the driver? #435

dmiller-nmap opened this issue Jan 23, 2017 · 6 comments

Comments

@dmiller-nmap
Copy link
Contributor

Thread on WinPcap-users mailing list: https://www.winpcap.org/pipermail/winpcap-users/2017-January/005025.html

The user notes that WinPcap cannot detect new plug-and-play interface until the computer is rebooted. Another user comments that simply restarting the npf driver service will accomplish the same thing.

I would like to know whether Npcap has the same behavior or if this is solved with the new filter driver design. If it has the same behavior, we should investigate what it might take to detect new interfaces without restarting the driver.
@Varunram
Copy link

Varunram commented Jan 24, 2017 •
edited

@dmiller-nmap Npcap seems to react in the same way as WinPcap and doesn't notice the network interface without a restart.

@capt2101akash
Copy link

@Varunram I agree with you.
@dmiller-nmap I tried using Winpcap and found that as the other user says it requires a driver restart to detect a new interface and as npcap and WinPcap works the same way, the problem persists in npcap too.
So I think we need to find out a way around to solve this problem.
Thanks.

@hsluoyz
Copy link
Member

hsluoyz commented Jan 28, 2017

@dmiller-nmap , the Npcap/WinPcap driver is never a plug-and-play driver. Technically, there are two difficulties:

  1. Microsoft doesn't provide such an interface for a filter driver to detect the new interface. Maybe there are some other types of drivers that can do it. But integrating such a mechanism into Npcap would need a significant amount of development.

  2. Even if Npcap can detect the new interface, NDIS 6 model doesn't allow a filter driver to bind this new interface in the halfway. All the binding work has to be done in the "main" function of the driver ("main" function gets called when you start the driver). Legacy NDIS 5 supports binding to an interface in the halfway. But unfortunately, NDIS 5 is already an antique in XP era, and totally not supported in Npcap.

IMHO, maybe having this feature would be fancy, but restarting the driver after installing a new interface just seems also good enough.

@hdm
Copy link

hdm commented Mar 5, 2019

It would be great to have a better solution to this going forward.

@gvanem
Copy link

gvanem commented Mar 6, 2019

@dmiller-nmap
Maybe this is related to how other CACE-tech products/drivers are designed?
E.g. I sometimes have problems with a hanging AirPcap driver (it's blocking at some IOCTL_x call).
A fix for me it to unplug the USB-dongle and put it back in. Always works.

@dmiller-nmap
Copy link
Contributor Author

Npcap 0.9983 fixes this issue: adapters can be detected and supported for capture and injection as soon as they are bound to the NDIS stack!

@fyodor fyodor transferred this issue from nmap/nmap May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@gvanem @hdm @hsluoyz @dmiller-nmap @capt2101akash @Varunram