Now that we've made some changes to the code and got a new codesigning certificate to replace the expired one, we should build a new installer to make sure everything is still working and allow people to test it more easily.

Of course Npcap is amazing, but it would be even better with a great logo! Like we have for Nmap, Nping, Ncat, Ncrack, etc. Dan suggests a nose version of the Nmap eye :)

Hello,

I have just loaded NPcap 0.10 r2, started (without rebooting first if that may matter) a Wireshark capture on Intel wireless interface in STA mode, and after a while I got the blue screen of death with explanation IRQL NOT LESS OR EQUAL.

Windows 10 Anniversary update 64 bit. What else can I do to help investigate the issue?

Npcap install never completes on Windows 10.

I downloaded the latest npcap-0.07-r10,exe and ran it on my Windows 10 test VM. This machine has been used some months ago to test prior npcap installation details. Before today's activities it did not have any npcap or WinPcap software installed on the system.

I started the installer and let it run with the single checked default option (This is what normal users do, right). I was a little surprised by the fact that starting the install activities a black window appeared and the quickly disappeared. Maybe this has nothing to do with the resulting hang.

I then clicked Next and the install started. It seemed to move along normally for a while. I received the prompt about installing the driver which I first unchecked the "Always Trust..." checkbox, but then clicked on the OK button. Things seemed to continue, but then it ultimately stopped moving forward. Task Manager shows very little or no CPU being used

In old version, pcap_open_live also accept name in pcap_findalldevs_ex style (rpcap://\Device\NPF_{AD3C70B4-453E-4D67-AC84-D7976DAD5503}).
But in new version, only pcap_findalldevs style like \Device\NPF_{AD3C70B4-453E-4D67-AC84-D7976DAD5503} is accepted.

I found this due to an issue of SharpPcap, an WinPcap wrapper for dotNet.

I know the doc says that pcap_findalldevs/pcap_open_live and pcap_findalldevs_ex/pcap_open should be used in pair. But is the new behavior by design or mistake?

Sorry for my poor English.

The idea here is to allow Npcap to load it's driver on an as-needed basis when an application which needs it loads the DLL. Presumably it could unload when not needed too. Riverbed used to sell a "WinPcap Pro" version with this feature (among others), though they've discontinued that product. This should prevent wasted resources from having the driver running all the time when unneeded.

On several different Windows 7 laptops, once I install Npcap, my Wi-Fi access fails, Windows displays that the Wi-Fi network has 'limited connectivity.'

I can reproduce the issue with both npcap-nmap-0.07 and npcap-nmap-0.06-r4. As far as I can tell, it doesn't matter which install time options I select, it happens regardless. Installing Npcap is the only step necessary to reproduce. It has happened on every machine I've tried. Has anybody else not seen this issue? Has anyone else seen this issue? The correct behavior I expect is that the Wi-Fi access does not fail with the 'limited connectivity' message. The correct behavior I also expect is that I'm able to disable the Npcap driver on a specific wireless interface. For an example of what I mean, see the link below. That is my workaround, but it doesn't work with the latest release.

I came up with a very weird workaround to restore Wi-Fi access without uninstalling Npcap, but it requires you to use npcap-nmap-0.06-r4. You can see my procedure here: superuser

I can produce logs if necessary, but I don't know what your looking for.

It may be a lame command, but it crashes nmap on Vista:

nmap -v -sn --unprivileged 192.168.128.0/24 -sL

Problem signature:
  Problem Event Name:   APPCRASH
  Application Name: nmap.exe
  Application Version:  7.0.12.0
  Application Timestamp:    56faa177
  Fault Module Name:    kernel32.dll
  Fault Module Version: 6.0.6002.23936
  Fault Module Timestamp:   56ec318c
  Exception Code:   c06d007e
  Exception Offset: 0003fc9e
  OS Version:   6.0.6002.2.2.0.768.2
  Locale ID:    1033
  Additional Information 1: 2315
  Additional Information 2: 7760935103aa7696e3476ac43b0c0097
  Additional Information 3: eda2
  Additional Information 4: bbf2193402e872d5755684cf7a43b483

Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

Right now Npcap is based on an old version of libpcap which was in WinPcap 4.1.3. And that is Libpcap 1.0.0 which was released in 2010. We should try to merge in all the libpcap changes since then into our branch, but it may be a large project.

For Windows 10 support, we need to sign Npcap with an EV cert instead of our current non-EV codesigning cert. So we need to obtain such a cert, and it will probably only be available on a secure token so only one of us can do it. And we then need to upload our EV-signed version to a Microsoft development site to get their signature. And only then do we have an installer which Windows 10 users can run without doing the special unsafe driver mode thing (which requires a reboot, warning screens, etc.)

Nping doesn't currently seem to have the code to work with (and prefer over WinPcap) our new Npcap packet capturing software's native mode. So we probably just need to apply the same winfix.cc change we made with Nmap's test version to Nping.

Right now, if the WinPcap (or Npcap) driver is running, any user on the system can sniff the network. We should consider what we can do to potentially restrict that to just administrator users. Just as how you need to be root on Unix in general to do this.

DiagReport-20161014-194307.txt

101416-14359-01.zip

By computer BSODs either when putting my adapter into monitor mode, or taking it out of it. I belive it is a driver issue, but thought I should report it. Attached are the diagnostic reports and the zipped DMP file.

Hi all,
there is commonly known bug, that pcap_snaplen doesn't work with winpcap, and there is commonly known workaround for this: set empty filter for sniffing after call to activate.

This setting-empty-filter trick stopped to work with npcap.
More detailed info:
since npcap 0.05 (r1) some packets are snapped, but not all of them;
this behavior continues to be observable up to npcap 0.06 (r1) (inclusive).

Since npcap 0.06 r2 behavior is better, way more packets is being snapped (but still not all).
This is being observable also for 0.06 r3 and r4. (observable caplens: 134, 276, 342, 1392, 1484, 1486, 1490, 1514).

Since npcap 0.06 r5 (also in r6, I could not test r7) problem is even worse - some packets are not snapped, resulting in ~1500bytes packets, but most of them are snapped at really short level (most commonly 16 (!) bytes).

Scenario: set snaplen to 123.
Procedure is: create() set_promisc(0) set_timeout(250) set_snaplen(123) activate() set_nonblock(1) filter("") dispatch() - I will publish examplary tool and comment.

I ran those tests also with libpcap on linux, it works (although snapping at 122).

Historically when a version of WinPcap was installed, the prior version is explicitly uninstalled.

Today I tried to install npcap-nmap-0.05-r10 on a system which already had npcap-nmap-0.05-r7 already installed I was prompted with a message box that says:

"Npcap version 0.5.0.912 already exists on this system. Reinstall this version?" Yes/No

What actually happened after seeing this message and clicking Yes was the right thing (uninstall followed by an install), but the message itself is at least confusing. The wording should be changed.

I'm trying to install Npcap 0.07-r11 on a Server 2008 R2 SP1 machine which had Wireshark-win64-2.0.3 with WinPcap 4.1.3 installed. I've made several attempts with the same results, uninstalling each time. I can't find an installation log file to post here so I've attempted the installation again. This is everything I did and saw. Current situation is WinPcap 4.1.3 is not installed.

• I double-click the .exe and UAC is invoked. I enter my creds and click Yes to start the installation.
• I accept the licence agreement.
• I select 'Support lookback traffic' and 'Install Npcap in WinPcap API-compatible mode' and click Install.
• I see a couple of cmd.exe-style windows appear and disappear.
• The installation stops with the main 'Npcap 0.07 (beta) Setup' window still visible, progress bar about 3/4 across to the right, with the heading 'Failed to create the npcap service for Vista, Win7, Win8 and Win10'. A smaller window has appeared on top of it, entitled 'Npcap 0.07 (beta) Setup', which reads 'Failed to create the npcap service for Vista, Win7, Win8 and Win10. Please try installing Npcap again, or use the official Npcap installer from https://github.com/nmap/npcap/releases'. I click OK on this window.
• Another window flashes up and is gone.
• A smaller window appears on top of the main 'Npcap 0.07 (beta) Setup' window (which is in the same state as before), again entitled 'Npcap 0.07 (beta) Setup', and now reading 'Failed to create the npcap2 service for Vista, Win7, Win8 and Win10. Please try installing Npcap again, or use the official Npcap installer from https://github.com/nmap/npcap/releases'. I click OK on this window.
• More cmd.exe-style windows open and close.
• The main 'Npcap 0.07 (beta) Setup' window now reads 'Installation Complete, Setup was completed successfully' in the white header and 'Completed' with a full progress bar in the body.
• I click on Show details. It reads (I copied and pasted each line.)

Execute: net stop npf
Execute: net stop npcap
Start setting system restore point: Before installation of Npcap 0.07
Error occured when starting setting system restore point, return value=|2147942526|
Windows CurrentVersion: 6.1 (win7)
Output folder: C:\Program Files\Npcap
Extract: LICENSE
Extract: NPFInstall2.exe
Extract: NPFInstall.exe
Output folder: C:\Program Files\Npcap
Extract: npf.sys
Extract: npf.inf
Extract: npf_wfp.inf
Extract: npf_wifi.inf
Extract: npf.cat
Extract: npcap.sys
Extract: npcap.inf
Extract: npcap_wfp.inf
Extract: npcap_wifi.inf
Extract: npcap.cat
Created uninstaller: C:\Program Files\Npcap\uninstall.exe
Installing NDIS6.x x64 driver for Vista, Win7, Win8 and Win10
Output folder: C:\Windows\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NPcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NPcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NPcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\Windows\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NPcapHelper.exe
Extract: WlanHelper.exe
Execute: "C:\Program Files\Npcap\NPFInstall.exe" -n -il
Execute: "C:\Program Files\Npcap\NPFInstall.exe" -n -c
The cache in driver store was cleared
Execute: "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
Execute: "C:\Program Files\Npcap\NPFInstall.exe" -n -i
Failed to create the npcap service for Vista, Win7, Win8 and Win10
Execute: "C:\Program Files\Npcap\NPFInstall2.exe" -n -iw
Execute: "C:\Program Files\Npcap\NPFInstall2.exe" -n -i
Failed to create the npcap2 service for Vista, Win7, Win8 and Win10
Adding DLL folder: "C:\Windows\system32\Npcap" to PATH environment variable
Target was appended to PATH
Execute: net start npf
Execute: net start npcap
Completed

• I click Next.
• I am offered the option to 'Automatically start the Npcap driver at boot time'. I uncheck the box and click Next.
• The header changes to 'Finished - Thanks you for installing Npcap' and the body to 'Npcap has been installed on your computer.' and 'Click Finish to close this wizard.' so I click Finish.

To aid diagnostics, from a Command Prompt as Administrator, I tried running

cd C:\Program Files\Npcap
NPFInstall.exe -?

and saw a window entitled 'NPFInsdtall.exe - System Error' - 'The program can't start because wlanapi.ddl is missing from your computer. Try reinstalling the program to fix this problem.'

Programs and Features now contains Npcap 0.07.

The latest release of Npcap, 0.08-r6, has this version string: "Npcap 0.08, based on libpcap 1.9.0-PRE-GIT". The the-tcpdump-group/libpcap repository has a branch for the 1.8.0 release that we should be using instead of the current development head. It is also tagged "libpcap-1.8.0" if that would be easier.

Hi Yang,

I've got a Win 10 test system running Win 10 Pro Version 1511.

This system has WinPcap 4.1.3 installed.

I just installed npcap 0.08 r4 AND took all defaults during the install (thus not specifying WinPcap compatibility mode).

My App prefers npcap if it is installed (changing the library search path before dynamically loading wpcap.dll).

After wpcap.dll is dynamically loaded, it finds the entry points to pcap_lib_version and pcap_getservicename. With recent npcap versions it seems that pcap_getservicename is no longer available.

Maybe this is OK (since you've been working through things), BUT if it isn't going to be there, then npcap-guide-wrapper.html#npcap-detect-version shouldn't mention pcap_getservicename.... I think you originally introduced the pcap_getservicename API to provide a way for programmers to dynamically determine what service to start with "net start npf" or "net start npcap".....

• Mark

After installation of npcap 10 r7 I could capture on different devices with Wireshark 2.2.1 but not on LAN or NPCAP Loopback. This devices told a Link-Layer Header of "DLT -1" not like the other "Ethernet".
After reboot the LAN Interface say driver error and won't connect to LAN. The status Interface was empty.
A remove fixed this.

On my system there is a Windows 7 x64 Version 6.1.7601 Service Pack 1 Build 7601 installed.

I updated to the latest available release (Npcap 0.07 r17) and checked the option to only allow admin user to use it. When starting Wireshark, I had about 10 requests one after the other from UAC for NPcapHelper. Every time capture is started, it also pops up.

It would be great if there was no more than a single request.

Hello there.
Since I've installed nmap+npcap (latest version for Windows) I'm unable to connect to ANY wifi network.
I also tried with an additional usb wifi dongle with no success.
Win 7 Ent 64bit English
Disinstalling nmap+npcap won't work, neither would disabling the protocol driver fro the network.
I've also already checked for restore points with no luck.
I'm stuck.

PS:connection to wifi happens to work in Safe Mode so it's definetly something extra that I cannot find.

Any hints?

Right now we have our new Npcap self-installer npcap-0.01-setup.exe, but that version number 0.01 isn't anywhere in the code, and I think Npcap still thinks of itself as WinPcap 4.1.3. We should probably find the places in the code which reference the version number and change it, and there should be an easy way to get the library name, so applications like Nmap know if they are dealing with WinPcap or Npcap.

DiagReport-20161019-154912.txt

install.log.txt

Hi,

When I try to install npcap library, the service installation failed with the output below:

NIPO@TFR1NIPO C:\Program Files\Npcap
$ NPFInstall.exe -n -c
Npcap driver cache in Driver Store has been successfully cleaned up!

NIPO@TFR1NIPO C:\Program Files\Npcap
$ NPFInstall.exe -n -iw
Npcap WFP callout driver has been successfully installed!

NIPO@TFR1NIPO C:\Program Files\Npcap
$ NPFInstall.exe -n -i2
Npcap LWF driver (with Wi-Fi support) has failed to be installed.

Please can you assist me with the installation?

Thanks for your support.

According to the ReadMe at https://github.com/nmap/npcap "Npcap makes use of new LWF driver in Windows Vista and later (the legacy driver is used on XP)"
This suggests that the goal is to be a completely compatible replacement for WinPcap on all platforms WinPcap supports (from XP onward). The current version of npcap fails to install on some versions of windows due to signature verification issues.

I installed a clean system with Windows 7 SP1 and the first thing I did was install WinPcap. It installed cleanly and it worked fine. I uninstalled WinPcap and for good measure I rebooted the system. I then tried to install npcap and the installation process complained about driver signing issues.

DiagReport-20161104-133837.txt
The following is the problem that I has encountered now:
I was using Winpcap to receive and send packet normally.
Everying is good.

But I want to try the Npcap.

Here is my practice steps:

1. Uninstall the Winpcap from my windows 10.
2. Install the Npcap with the Winpcap compatible mode.
3. Run the application WireShark, the result is OK.
4. Run my application.
   4.1 The moudle of receiving packet run normally.
   4.2 The moudle of sending one packet run normally; ( call api : pcap_sendpacket )
   4.3 The moudle of sending multiple packet run abnormally; ( call api : pcap_sendqueue_transmit )
   The windows blue screen occur.

The dump file is too big, so I can not update here.
Please download it from the following URL:
http://pan.baidu.com/s/1dFBQxmp

best regards.

My Email Address:
[email protected]

With a clean Windows 7 system.

The initial network config (prior to any npcap install) looks like:

C:\Windows\system32>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : mydomain.com
   Link-local IPv6 Address . . . . . : fe80::5925:c622:7211:e444%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.49
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.6

Tunnel adapter isatap.alohasunset.com:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : mydomain.com

I install the latest (r14) npcap package. I take defaults for all questions, and the resulting IP configuration looks like:

C:\Windows\system32>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::48b8:32af:9d5a:cc02%18
   Autoconfiguration IPv4 Address. . : 169.254.204.2
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : mydomain.com
   Link-local IPv6 Address . . . . . : fe80::5925:c622:7211:e444%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.49
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.6

Tunnel adapter isatap.mydomain.com:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : mydomain.com

Tunnel adapter isatap.{499847BE-F7E6-4F04-89D1-D5C9CDE5E92C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

C:\Windows\system32>

So far, so good. EXCEPT that the interface name of the npcap Loopback adapter is "Local Area Connection 2" instead of a more useful description.

I run my application which uses WinPcap and I verify that the I see both network interfaces and, in fact pcap_datalink returns DLT_EN10MB for both interfaces.

I exit my application cleanly.

I uninstall the npcap package using the WIndows Control panel. After the uninstall the npcap package is no longer visible in the control panel. However, the network configuration has NOT been restored to what it looked like before the npcap install. It currently looks like:

C:\Windows\system32>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::48b8:32af:9d5a:cc02%18
   Autoconfiguration IPv4 Address. . : 169.254.204.2
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : mydomain.com
   Link-local IPv6 Address . . . . . : fe80::5925:c622:7211:e444%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.49
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.6

Tunnel adapter isatap.alohasunset.com:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : mydomain.com

Tunnel adapter isatap.{499847BE-F7E6-4F04-89D1-D5C9CDE5E92C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

C:\Windows\system32>

After rebooting the system, the network configuration is in WORSE shape:

C:\Windows\system32>ipconfig

Windows IP Configuration


C:\Windows\system32>

I open Control Panel->Network and Internet->Network and Sharing Center and I see some networks and click on "Change adapter settings" which brings me to Control Panel->Network and Internet->Network Connections. I see what looks like the network coming online and IP addresses being acquired. This is very strange since before installing npcap the network had come fully up prior to me being able to login. After the adapters get IP addresses ipconfig now shows:

C:\Windows\system32>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::48b8:32af:9d5a:cc02%13
   Autoconfiguration IPv4 Address. . : 169.254.204.2
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : mydomain.com
   Link-local IPv6 Address . . . . . : fe80::5925:c622:7211:e444%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.49
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.6

Tunnel adapter isatap.mydomain.com:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : mydomain.com

Tunnel adapter isatap.{499847BE-F7E6-4F04-89D1-D5C9CDE5E92C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

C:\Windows\system32>

which is what it looked like before the reboot.

So, there are 2 issues here:

1. The remaining network setup which hasn't been restored,
2. The delay while the network starts. I don't know how to better describe this.

Hi.
Today windows 10 was updated and wireshark don't see network adapters any more.
I am tried to reinstall npcap and wireshark - this wasn't helpful.
Npcap installed in winpcap compat. mode and wireshark detected npcap during install process.

Hi all,
I started tests of win server 2016 (tech. preview 4) (I know, it is not supported yet by npcap).

I could observe following error with npcap-r06.13:
Length of packets on wire is reported incorrectly, instead of expected value reported value is 2048 (for majority of packets). After adding those lengths over some period, sum is significantly greater than expected.
Length at IPv4 layer is (about) 1480.
I run those test in Virtualbox VM hosted on Win7.

I could not reproduce this behavior with winpcap or on Windows 7.
I didn't run tests on Windows 10 (yet).

best regards.

I am using Windows 7 and installed npcap using the installer. Wireshark cant see the Npcap Loopback Adapter altough it is there in the SystemControls. Adapter is active.
The NL Adapter disabled initially all other adapters which is not good.

c80198c changed the NSIS installer to no longer obey the /D option which sets $INSTDIR directly. Users have requested this feature in the past: nmap/nmap#311 for instance.

Right now, our npcap installer basically thinks it is the Nmap Winpcap installer and so it will uninstall an existing winpcap if encountered. I think in normal (non-silent mode) it asks the user first. We should instead update npcap so that it can install alongside an existing Winpcap. This means we need to use a different driver name than npf.exe, for example, and do the install in a different directory path. We need to have a good way in mind for applications to be able to select which they use, if desired. Because for Nmap we would desire this.

MS is dramatically increasing the requirements for driver signing in Windows 10, or at least they say they are going to do so. But for now we are just going to start by using a normal non-EV cert so we don't have to pay as much, use a hardware token, etc.

Hello,

I've given a try to npcap-nmap-0.06-r7 downloaded from here as an installer (I am unable to compile from source) as a replacement (i.e. no coexistence mode) to WinPcap 4.1.3 which came along with Wireshark 2.0.2. My OS is a 64-bit Win10 (Czech language version and a result of upgrade from Win 7 if that may matter).

Issue number 2 is that when capturing on the loopback interface, npcap adds two extra octets somewhere at the beginning of the IPv4 header, causing already the IP addresses to be corrupt. In detail, a packet actually sent from 192.168.5.158 to 239.255.255.250 looks as if it was sent from 0.0.192.168 to 5.158.239.255 and its IPv4's payload was beginnig with 0xff 0xfa, as can be seen in the attached file.

The frame truncation problem as described in another Issue exists on the loopback interface too.

Do you need any additional information from me to help identify the issue?

npcap_loopback_issue.zip

Windows 10 10586.164 64-bit
Npcap 0.07 r6

Reproduce:
Method 1: Use wireshark, then go to Network Connections, right-click Ethernet, disable, system freeze.
Method 2: Use wireshark, then connect to a VPN, system freeze.

Winpcap dont have this problem.

I did some tests with npcap (installed on WIN8 and SRV2008R2. One thing I noticed that it is not possible to get what version of npcap is installed.
From what I saw npcap writes to the registry key its version:
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst" "DisplayVersion"="0.08"

Unfortunately, I don’t see there the revision of the version. For example I installed version 0.08-r4 and I didn’t see any reference to “r4”. It would be good to add the “r4” too so we can actually know what is the revision installed.

npcap-0.09.exe fails to unpack NPFInstall.exe, so installation becomes broken. See errors in install.log

install.log.txt

Our latest Npcap can now capture from localhost (unlike WinPcap), but captured packets are given a fake ethernet header with the MAC addresses all zeros. It might be better to use the NULL/Loopback encapsulation type. The downside is that Nmap and other tools might not be able to recognize this without new code. Anyway, a relevant mail from Jim Young is at: https://www.wireshark.org/lists/wireshark-dev/201508/msg00097.html

Version installed: https://github.com/nmap/npcap/releases/download/v0.07-r10/npcap-0.07-r10.exe
System version: Windows 7 Prefessional / Service Pack 1

Hi,
Some time ago (13rd of Jan) I recognized that whole npcap repository on github was somehow rewritten - actual code meaning is the same, but things like formatting and contextual information were changed.
Each commit get new hash (!).
Old hash of commit tagged as v0.05-r4 fc6bcd7 (cool that github keeps this :))
Hash of corresponding commit in actual history: f8646a1 (note that tag is lost).

After that I switched to "new" version and rebased my local changes on top of it.

Issue above (full rehash) arises again (noticed totady: 17.02.16).
Old hash of commit tagged v05-r6: c6ba0da
Hash of corresponding commit in actual history: 7631643

First rehash happens between v05-r4 and v-05-r5.
Second rehash happens between v05-r8 and v05-r9.

First time I was thinking, that this was just incident (lets say that it is not that bad, remembering that repo was ported from svn).
Now I think that we must resolve that problem, there are three possibilities:

• rehashes are done by github automatically = configuration error
• it is done intentionally, (eg by rebase), if so, it will be good to stop doing this or at least explain why it is necessary
• unintentionall unknown actions are performed = need to hunt them and prevent.

Or I'm very wrong somewhere.

thanks,
Przemek Komosa

Trying to install npcap, but support raw 802.11 traffic (monitor mode) is greyed out.
I actually need this mode. Why is it greyed out?
What can be done to enable this option upon install?

Call: 62
IfFileExists: file "C:\npcap_install_options.txt" does not exist, jumping 76
Call: 77
Jump: 94
Jump: 111
Call: 115
Jump: 205
Call: 115
Call: 115
Call: 115
Call: 115
Call: 115
Call: 115
IfFileExists: file "C:\Program Files\Npcap\NPFInstall.exe" does not exist, jumping 400
Call: 1092
File: overwriteflag=0, allowskipfilesflag=2, name="C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\modern-header.bmp"
File: wrote 70976 to "C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\modern-header.bmp"
WriteINIStr: wrote [Field 1] State=1 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 414
WriteINIStr: wrote [Field 2] State=1 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 427
WriteINIStr: wrote [Field 3] State=1 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
WriteINIStr: wrote [Field 3] Flags=DISABLED in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 444
WriteINIStr: wrote [Field 4] State=0 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 457
WriteINIStr: wrote [Field 5] State=0 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
WriteINIStr: wrote [Field 5] Flags=DISABLED in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 470
WriteINIStr: wrote [Field 6] State=0 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 483
WriteINIStr: wrote [Field 7] State=0 in C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\options.ini
Jump: 500
IfFileExists: file "C:\windows\system32\wpcap.dll" does not exist, jumping 508
Call: 1092
File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\InstallOptions.dll"
File: wrote 14848 to "C:\Users\koorstra\AppData\Local\Temp\nsu6558.tmp\InstallOptions.dll"

Hello,

I've given a try to npcap-nmap-0.06-r7 downloaded from here as an installer (I am unable to compile from source) as a replacement (i.e. no coexistence mode) to WinPcap 4.1.3 which came along with Wireshark 2.0.2. My OS is a 64-bit Win10 (Czech language version and a result of upgrade from Win 7 if that may matter).

Issue number 1 is as described in the subject: while capturing on a wireless adaptor, regardless whether promiscuous mode is enabled or not (I know that it makes little difference for wireless adapters on Windows), the captured length of all frames is shorter than the length "on the wire" (in Wireshark display filter syntax, frame.cap_len < frame.len). For most, yet not all, frames the captured length is 16 bytes. This makes npcap unusable for most purposes.

I could not try on wired Ethernet due to factors I'll clarify in another Issue.

The capture length set in Wireshark's interface configuration window is shown as "default", if you double-click it, it says 65535. Change to some other value (like e.g. 2000) does not change the behaviour.

What additional information do you need from me to help identify the issue?

Hi.

Npcap 0.06-r71 is installed in winpcap compatible mode.
I don't see VmWare network interface in wireshark, but it appears, if I am using winpcap.

Current version of this adapter works strange:
It's either seen by wireshark or by sharppcap based program, once you opened device you can't use second program until you restart services:

net stop npf
net stop npcap
net start npcap

(for wireshark - npf is enough, for sharppcap based programs - npcap is enough, so stopping both)

Checked on fresh install windows 10.0.14393 x64 in hyperv, latest wireshark and sharppcap
logs.zip
In log:

1. install npcap
2. run wireshark (seen loopback there), close wireshark
3. run my program based on sharppcap, not seen loopback, close program
4. restart services
5. run program again, seen loopback there, close program
6. run wireshark again, not seen loopback there

When I install Npcap on my Windows 10, I got BSOD with error DRIVER_IRQL_LESS_OR_NOT_EQUAL(nwifi.sys).
After reboot, when i try to reinstall or uninstall npcap, in detail log:

Start setting system restore point: Before installation of Npcap 0.07
Error occured when uninstalling WinPcap, Npcap installation quits
Finish setting system restore point: Before installation of Npcap 0.07
Completed

How can I solve these problems? Thanks.

Only happened with IPv6, not with IPv4. Only happened on Windows 7, not Windows 8.1. I have some sort of Microsoft antivirus installed (Defender or something?) but no other security software. I was using Oracle Virtualbox with the network adapter in Bridged mode.

Microsoft produces some tools for testing drivers to make sure they are as robust as possible. @dmiller-nmap has already had some good results with the MS Static Driver Verifier (SDV) which is free with Visual Studio: https://msdn.microsoft.com/en-us/library/windows/hardware/ff552808(v=vs.85).aspx

We should make sure that Npcap is clean from testing with this.

Hello,

I've given a try to npcap-nmap-0.06-r7 downloaded from here as an installer (I am unable to compile from source) as a replacement (i.e. no coexistence mode) to WinPcap 4.1.3 which came along with Wireshark 2.0.2. My OS is a 64-bit Win10 (Czech language version and a result of upgrade from Win 7 if that may matter).

Two issues, which may or may not be related to each other, exist when detecting and naming network interfaces on Win 10.

First, in Win10, the interface names shown at the GUI are completely unrelated to the names shown using ipconfig (see below & attached screenshot), so the interface names presented in Wireshark are totally inconsistent with those shown in the GUI list. The "human-readable" ones given by ipconfig are not really useful as they are just "local network interface N" and there is no clue regarding their relationship to the "physical" interfaces. It may actually be a Win10 issue but it seems that WinPcap has managed to overcome it somehow.

Second, much worse, is that when a physical interface is part of a software bridge, npcap does not report any of the two to the querying application, which means that it is impossible to capture on either of them. This was not a problem with WinPcap on Win 7; I cannot say at the moment whether it was the Win 7 -> Win 10 change or the WinPcap -> npcap change which has broken this.

What additional information do you need from me to help identify the issue?

>"c:\Program Files\Wireshark\dumpcap.exe" -D
1. \Device\NPF_{5DA27B50-00C1-4524-9099-21B3B108AD7E} (Připojení k místní síti* 11)
2. \Device\NPF_{FB07DEB9-1926-4370-8395-0B9369D7BA04} (Bezdrátové připojení k síti)
3. \Device\NPF_{28D70F40-9ACB-440A-8462-4D54F7A371D2} (Připojení k místní síti* 2)
4. \Device\NPF_{A30ACB87-2138-4BB9-AAB9-50E4607A3A4D} (Připojení k místní síti* 13)
5. \Device\NPF_{DAFB87ED-6299-4F52-9DCA-94D031827F93} (Připojení k místní síti* 12)
6. \Device\NPF_{FC88C8FA-231B-4A82-97B7-34B92E9BBAD8} (Připojení k místní síti* 5)
7. \Device\NPF_{DEAE2170-9327-4CCE-967D-7A1AFF31A5EA} (Síťové připojení Bluetooth)
8. \Device\NPF_{01CABFD8-5D7D-4A57-9958-5098213B1AE4} (Npcap Loopback Adapter)

`> ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : sindelka-HP
Primary Dns Suffix . . . . . . . : sindelka-HP
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : sindelka-HP

Wireless LAN adapter Připojení k místní síti* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : 8C-70-5A-4C-43-65
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Připojení k místní síti* 5:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Hosted Network Virtual Adapter
Physical Address. . . . . . . . . : 8E-70-5A-4C-43-65
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Npcap Loopback Adapter:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Npcap Loopback Adapter
Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::eccf:dc7c:114e:aedf%12(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.174.223(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 201457740
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-8A-F4-4D-A0-B3-CC-CC-7C-70
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Síťový most:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Network Adapter Multiplexor Driver
Physical Address. . . . . . . . . : A0-B3-CC-CC-7C-70
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::b905:3c14:99d7:e306%9(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.10.90(Preferred)
Subnet Mask . . . . . . . . . . . : 255.0.0.0
Lease Obtained. . . . . . . . . . : 14. března 2016 15:44:40
Lease Expires . . . . . . . . . . : 17. března 2016 15:44:39
Default Gateway . . . . . . . . . : 192.168.10.1
DHCP Server . . . . . . . . . . . : 192.168.10.1
DHCPv6 IAID . . . . . . . . . . . : 161526732
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-8A-F4-4D-A0-B3-CC-CC-7C-70
DNS Servers . . . . . . . . . . . : 81.19.34.2
81.19.33.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Bezdrátové připojení k síti:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : lan
Description . . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6205
Physical Address. . . . . . . . . : 8C-70-5A-4C-43-64
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Síťové připojení Bluetooth:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Zařízení Bluetooth (síť PAN)
Physical Address. . . . . . . . . : C0-18-85-F1-77-8C
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{01CABFD8-5D7D-4A57-9958-5098213B1AE4}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter nmap/nmap#4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{2F713036-D16D-46AE-BDAC-1BACFCD651BD}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter nmap/nmap#5
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes`

If an application has a pcap connection open through the npf driver, an uninstall of the npcap fails ungracefully.

A message box titled "Npcap 0.05 for Nmap (beta) Uninstall" with the text "Failed to stop the npf service, stop uninstallation now. Please stop using Npcap first" OK.

The Uninstall fails and the user is presented with an option to uninstall in compatibility mode.

This set of behaviors will be, at least, unexpected and certainly somewhat confusing for some users.

If someone attempts to uninstall WinPcap 4.1.3 when the npf service is in use, the user is presented with a dialog titled: "WinPcap 4.1.3 Uninstall", and the text says: "Completing the WinPcap 4.1.3 Uninstall Wizard" "Your computer must be restarted in order to complete the uninstallation of WinPcap 4.1.3. Do you want to reboot now?" With a couple of radio buttons labeled: "Reboot Now" and "I want to manually reboot later", and a Finish button at the bottom of the dialog.

The WinPcap Reboot Now or Manually Later is what most folks would expect. Someone who is actively uninstalling npcap may not have any idea which application is actually using the npf service or how to stop it from being used. If they've engaged the uninstall it should uninstall one way or another.

setupapi.dev.log after reboot and one more NPFInstall.exe -il ("Адаптер замыкания на себя" ≈
"Loopback Adapter"):

[Boot Session: 2016/10/09 12:16:48.497]

>>>  [Device Install (Hardware initiated) - ROOT\NET\0001]
>>>  Section start 2016/10/09 12:17:01.340
     dvi: {Build Driver List} 12:17:01.402
     dvi:      Searching for hardware ID(s):
     dvi:           *msloop
     dvi:      Created Driver Node:
     dvi:           HardwareID   - *MSLOOP
     dvi:           InfName      - C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_336f686a84333886\netloop.inf
     dvi:           DevDesc      - Адаптер замыкания на себя Microsoft KM-TEST
     dvi:           Section      - kmloop.ndi.NT
     dvi:           Rank         - 0x00ff0000
     dvi:           Signer Score - INBOX
     dvi:           DrvDate      - 06/21/2006
     dvi:           Version      - 6.3.9600.16384
     dvi: {Build Driver List - exit(0x00000000)} 12:17:01.402
     dvi: {DIF_SELECTBESTCOMPATDRV} 12:17:01.402
     dvi:      Using exported function 'NetClassInstaller' in module 'C:\Windows\system32\NetCfgx.dll'.
     dvi:      Class installer == NetCfgx.dll,NetClassInstaller
     dvi:      Using exported function 'WlanDeviceClassCoInstaller' in module 'C:\Windows\system32\wlaninst.dll'.
     dvi:      CoInstaller 1 == wlaninst.dll,WlanDeviceClassCoInstaller
     dvi:      Using exported function 'WwanDeviceClassCoInstaller' in module 'C:\Windows\system32\wwaninst.dll'.
     dvi:      CoInstaller 2 == wwaninst.dll,WwanDeviceClassCoInstaller
     dvi:      CoInstaller 1: Enter 12:17:01.402
     dvi:      CoInstaller 1: Exit
     dvi:      CoInstaller 2: Enter 12:17:01.402
     dvi:      CoInstaller 2: Exit
     dvi:      Class installer: Enter 12:17:01.402
     dvi:      Class installer: Exit
     dvi:      Default installer: Enter 12:17:01.402
     dvi:           {Select Best Driver}
     dvi:                Class GUID of device remains: {4d36e972-e325-11ce-bfc1-08002be10318}.
     dvi:                Selected:
     dvi:                     Description - [Адаптер замыкания на себя Microsoft KM-TEST]
     dvi:                     InfFile     - [c:\windows\system32\driverstore\filerepository\netloop.inf_amd64_336f686a84333886\netloop.inf]
     dvi:                     Section     - [kmloop.ndi]
     dvi:           {Select Best Driver - exit(0x00000000)}
     dvi:      Default installer: Exit
     dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 12:17:01.418
     ndv: {Core Device Install} 12:17:01.418
     dvi:      {DIF_ALLOW_INSTALL} 12:17:01.418
     dvi:           CoInstaller 1: Enter 12:17:01.418
     dvi:           CoInstaller 1: Exit
     dvi:           CoInstaller 2: Enter 12:17:01.418
     dvi:           CoInstaller 2: Exit
     dvi:           Class installer: Enter 12:17:01.418
     dvi:           Class installer: Exit
     dvi:           Default installer: Enter 12:17:01.418
     dvi:           Default installer: Exit
     dvi:      {DIF_ALLOW_INSTALL - exit(0xe000020e)} 12:17:01.418
     dvi:      {DIF_INSTALLDEVICEFILES} 12:17:01.418
     dvi:           CoInstaller 1: Enter 12:17:01.418
     dvi:           CoInstaller 1: Exit
     dvi:           CoInstaller 2: Enter 12:17:01.418
     dvi:           CoInstaller 2: Exit
     dvi:           Class installer: Enter 12:17:01.418
     dvi:           Class installer: Exit
     dvi:           Default installer: Enter 12:17:01.418
     dvi:           Default installer: Exit
     dvi:      {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 12:17:01.418
     flq:      Copying 'C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_336f686a84333886\loop.sys' to 'C:\Windows\system32\DRIVERS\loop.sys'.
<ins>

>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - *msloop]
>>>  Section start 2016/10/09 12:25:01.479
      cmd: NPFInstall.exe  -il
<ins>

NPFInstall.log:

[000007B4] 2016-10-09 12:25:01 --> wmain
[000007B4] 2016-10-09 12:25:01     _tmain: executing, argv[0] = NPFInstall.exe.
[000007B4] 2016-10-09 12:25:01     _tmain: executing, argv[1] = -il.
[000007B4] 2016-10-09 12:25:01 --> InstallLoopbackAdapter
[000007B4] 2016-10-09 12:25:01 --> IsWindowsWin10
[000007B4] 2016-10-09 12:25:01     GetVersionEx: osvi.dwMajorVersion = 6, expected value = 10.
[000007B4] 2016-10-09 12:25:01 <-- IsWindowsWin10
[000007B4] 2016-10-09 12:25:01 --> InstallLoopbackDeviceInternal
[000007B4] 2016-10-09 12:25:01 --> GetLoopbackINFFilePath
[000007B4] 2016-10-09 12:25:01     SHGetSpecialFolderPath: succeed, strLoopbackInfPath = C:\Windows\inf\netloop.inf.
[000007B4] 2016-10-09 12:25:01 <-- GetLoopbackINFFilePath

DiagReport-20161009-123904.txt