Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

npcap adapter is missing in Wireshark after reboot Windows #1570

Open
ddayzzz opened this issue Apr 24, 2019 · 4 comments

Comments

Projects
None yet
3 participants
@ddayzzz
Copy link

commented Apr 24, 2019

Hello. I installed lastest version(0.992) of npcap. As soon as the installation completed, I could find the npcap lookback adapter in Wireshark. However, after I reboot, I couldn't find the same item in Wireshark. Base Filtering Engine service is enable by default and starts automatically. The Npcap lookback Adapter installed by npcap still exist, but the I can't see the network name of this adapter in my system.

OS: Windows 10 1903(18362.53), zh_CN, x86_x64
Wireshark: v3.0.1-0-gea351cd8, zh_CN
install.log
NPFInstall.log
DiagReport-20190424-164315.txt

@ddayzzz ddayzzz changed the title npcap adapter is missing in Wireshark after reboot npcap adapter is missing in Wireshark after reboot Windows Apr 24, 2019

@FlorianReimold

This comment has been minimized.

Copy link

commented Apr 25, 2019

I can confirm the missing Npcap Loopback Adapter with a fresh installation. My custom software depends on the loopback adapter and thus stops working when installing Npcap 0.992. Although Windows shows the loopback adapter in the Network manager, neither Wireshark nor my own software can find it. I installed Npcap 0.992 with default options. I am using SDK 1.01, which appears to still be the most recent one.

My current solution is to downgrade to Npcap 0.99r9 where everything works just fine. When upgrading to Npcap 0.992 again, everything still works until I reboot Windows.

wireshark
install.log
NPFInstall.log
DiagReport-20190425-090722.txt

@FlorianReimold

This comment has been minimized.

Copy link

commented Apr 25, 2019

I played around a little and discovered that when I run

sc stop npcap
sc start npcap

the Loopback adapter shows up again. I also discovered that Npcap 0.99r9 did not actually fix the problem, even with that version the adapter disappears when restarting Windows and re-appears when stopping and starting the npcap service again.

@ddayzzz

This comment has been minimized.

Copy link
Author

commented Apr 25, 2019

I played around a little and discovered that when I run

sc stop npcap
sc start npcap

the Loopback adapter shows up again. I also discovered that Npcap 0.99r9 did not actually fix the problem, even with that version the adapter disappears when restarting Windows and re-appears when stopping and starting the npcap service again.

Thank you😊! I managed to find the npcap lookback adapter with your instructions. In addition, I found that both npcap lookback adapter and other virtual adapters(e.g. Hyper-V Virtual Ethernet Adapter) disappear at the same time. I think there might be some problems between npcap and MS KM-Test driver.
Thanks a lot. :)

@dmiller-nmap

This comment has been minimized.

Copy link

commented Apr 27, 2019

Confirmed this here on Npcap 0.992. The fix for this ought to be in the next release. Thanks!

@FlorianReimold Windows often does not let you downgrade a driver, so installing Npcap 0.99-r9 may not actually install the older working driver, which is why you still experience the problem.

dmiller-nmap pushed a commit to nmap/npcap that referenced this issue Apr 27, 2019

Reverse 89973d8
This was causing issues with loopback capture. I would still like to
improve this in a similar manner in the future, but at least there are
no outstanding bugs for this version of things. See nmap/nmap#1570
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.