Repository navigation
[Npcap] LoopbackInterface not correctly registered on Windows 7 #1368
Description
Hello,
I have ran several tests on a Windows 7 machine, with a fresh install of Npcap 0.99-r7 (there never was a Npcap before). I installed it with default options + support for raw 802.11
In scapy, we need (now uses the DLLs directly) needed at some point to get the GUID of all interfaces through Microsoft Powershell.
Issue:
The interface GUID of the loopback interface is missing from the result of Get-WmiObject Win32_NetworkAdapter | select * | fl
see https://pastebin.com/qRVp8USX (the npcap interface + one working interface)
I'm able to fallback with an ugly
PS> Get-WmiObject Win32_NetworkAdapter | select Name, DeviceID
Name DeviceID
---- --------
WAN Miniport (SSTP) 0
[..stuff..]
Teredo Tunneling Pseudo-Interface 11
Npcap Loopback Adapter 12
Realtek PCIe GBE Family Controller 13
TRENDnet N150 Wireless PCI Adapter 14
Carte Microsoft 6to4 15followed by a
# 12 is the DeviceID of the Npcap Loopback Adapter. The NetworkCard associated to N is N+1
PS> $key = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\" + (12 + 1)
PS > Get-ItemProperty -Path $key | select ServiceName
ServiceName
-----------
{29D40EEE-C86A-44BA-82DB-39644596E23D}But I don't understand why this value would be missing only on the Npcap Loopback Interface, and not the others :/
Side note
On Windows 10, we use Get-NetAdapter | select InterfaceDescription, InterfaceGuid (simplified), which does not have this issue.
Activity
dmiller-nmap commentedon Oct 25, 2018
I need to investigate this, but here are some related issues: #1284, #653.
We have had requests from users and paying licensees to both make the Loopback Adapter show up in these API functions and to be hidden from ordinary users. I am not sure how much of these issues are due to ordinary behavior of the Microsoft KM-TEST loopback adapter that the Npcap Loopback Adapter is built on or how much is due to the additional keywords we set in an attempt to be very clear that this is a software-only loopback adapter that does not have an IP configuration of its own.
gpotter2 commentedon Oct 25, 2018
About #1284:
pcap_findalldevs, which is surely why wireshark detects itThank you for looking into it
dmiller-nmap commentedon Oct 25, 2018
Ok, I have some findings, which I came up with by comparing Windows 7 (affected) and Windows 10 (unaffected):
Truefor thePhysicalAdapterproperty.TrueforPhysicalAdapteron Windows 10, butFalseon Windows 7.HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\<adapter id number>) are as follows:*IfType= 0x6,*MediaType= 0x0,*NdisDeviceType= 0x1,*PhysicalMediaType= 0x0*IfType= 0x18,*MediaType= 0x11,*NdisDeviceType= 0x1,*PhysicalMediaType= 0x0I believe, but will have to check, that the Windows 7 values for these additional keywords are the ones we are trying to set, but that Windows 10 has reverted them to default values in every case except
*NdisDeviceType(which is the most important). I'll have to do more testing and research to see if removing the other additional keywords will result in a more consistent presentation of the Adapter in all Windows versions, without introducing regressions.Disable setting additional keywords on Loopback. See nmap/nmap#1368
dmiller-nmap commentedon Jan 24, 2019
We believe this issue was resolved in Npcap 0.99-r8 and 0.99-r9. @gpotter2 have you tried these releases, and do they solve the issue for you?
gpotter2 commentedon Feb 8, 2019
@dmiller-nmap Looks fixed to me ! Thanks for the support