Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Npcap: Monitor mode capture dies after malformed packet delivered #1001
I am experiencing an issue capturing 802.11 traffic in monitor mode using Npcap: After a seemingly arbitrary number of packets have been captured successfully (I've observed anywhere from 200 to 20000), a malformed packet will be delivered, and then no more packets will be seen until the capture is restarted.
The malformed packet appears to contain a valid radiotap header with legitimate data, but it is prefixed with other data (possibly suggesting some sort of buffer overflow). You can see in "bad.png" that there's a broadcast frame very similar to the one in "good.png", but it's 8 bytes in.
I have reproduced this problem with an Alfa AWUS036H and a Linksys WUSB600N USB adapter, on a custom built desktop and on a Surface Pro 4. On both systems, I have observed the problem using Wireshark and using a custom application that utilizes SharpPcap. Both systems are running Windows 10 with all mainline (not insider) updates applied. Both systems are running Npcap 0.94 in non-winpcap-compatible mode.
I have attached the DiagReport, install.log, and NPFInstall.log files from the desktop.
It looks like it might be an alignment problem. The bad packet starts with 7 bytes:
Thanks for the reply. I'm not seeing a whole lot of similarity between those two sets of 7 bytes, and I wasn't able to find them in a similar beacon frame from the same AP. I've attached another capture, which contains three packets:
referenced this issue
Oct 15, 2017
pushed a commit
Oct 23, 2017
@SapientGuardian Thanks for confirming this. Since WiFi capture works without crashing, could you do us a huge favor and report your network card, OS, and level of support on the WiFi Adapters page at SecWiki.org? If you'd rather reply here or via email, that's fine, too, and we can handle the formatting:
Thanks so much!
@dmiller-nmap I never got account approval, so here's the data requested:
Adapter: Alfa AWUS036H