Npcap 0.995 loopback adapter breaks multicast

[r-smith]

Npcap 0.995 / Windows 10 1903
The Npcap loopback adapter is installed with the same route metric as my physical wired NIC. This breaks applications, such as IP cameras, that use multicast traffic. Windows is sending the traffic to the Npcap loopback adapter, so my real NIC never sees it. This can be fixed by disabling the Npcap loopback adapter or by manually specifying a route metric. The Npcap installer should be setting a much higher route metric.

Here is the (trimmed) output of route print on my machine:

C:\> route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.55.1      10.0.55.90     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      169.254.0.0      255.255.0.0         On-link     169.254.81.18    281
    169.254.81.18  255.255.255.255         On-link     169.254.81.18    281
  169.254.255.255  255.255.255.255         On-link     169.254.81.18    281
      172.30.24.0    255.255.255.0         On-link        10.0.55.90    281
       10.0.55.90  255.255.255.255         On-link        10.0.55.90    281
      10.0.55.255  255.255.255.255         On-link        10.0.55.90    281
    192.168.217.0    255.255.255.0         On-link     192.168.217.1    291
    192.168.217.1  255.255.255.255         On-link     192.168.217.1    291
  192.168.217.255  255.255.255.255         On-link     192.168.217.1    291
    192.168.249.0    255.255.255.0         On-link     192.168.249.1    291
    192.168.249.1  255.255.255.255         On-link     192.168.249.1    291
  192.168.249.255  255.255.255.255         On-link     192.168.249.1    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link     192.168.217.1    291
        224.0.0.0        240.0.0.0         On-link     192.168.249.1    291
        224.0.0.0        240.0.0.0         On-link        10.0.55.90    281
        224.0.0.0        240.0.0.0         On-link     169.254.81.18    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link     192.168.217.1    291
  255.255.255.255  255.255.255.255         On-link     192.168.249.1    291
  255.255.255.255  255.255.255.255         On-link        10.0.55.90    281
  255.255.255.255  255.255.255.255         On-link     169.254.81.18    281
===========================================================================

Notice the lines for 224.0.0.0. Those are for multicast traffic. 10.0.55.90 is my physical wired NIC. 169.254.81.18 is the Npcap loopback adapter. They both have a metric of 281.

[gbdavidx]

it seems to break the outgoing interface alltogether on windows 10, 1803, i can ping outside, but can't browse anything, when i uninstall npcap internet will work normally

255.255.255.255 255.255.255.255 On-link 169.254.81.18 281

[wjholden]

I have this problem too, but I am not convinced that this is specific to Npcap. In the following listing, observe that 239.5.1.4 is bound to the Npcap interface. I have tried messing with route metrics. It looks promising but my application still does not actually work.

PS C:\windows\system32> netsh int ipv4 show join
Interface 1: Loopback Pseudo-Interface 1

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    2  Yes   239.255.255.250

Interface 13: Wi-Fi

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    3  Yes   239.255.255.250

Interface 4: Ethernet

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 20: Local Area Connection* 2

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 16: Bluetooth Network Connection

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 8: Local Area Connection* 3

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 11: Ethernet 2

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 19: VMware Network Adapter VMnet1

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    2  Yes   239.255.255.250

Interface 5: VMware Network Adapter VMnet8

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    2  Yes   239.255.255.250

Interface 6: Npcap Loopback Adapter

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    1  Yes   239.5.1.4
0                    2  Yes   239.255.255.250

Now if I Get-NetAdapter -Name "Npcap Loopback Adapter" | Disable-NetAdapter and restart my application listening to 239.5.1.4 I get a similar problem, this time with interface VMnet1.

PS C:\windows\system32> netsh int ipv4 show join

Interface 1: Loopback Pseudo-Interface 1

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    2  Yes   239.255.255.250

Interface 13: Wi-Fi

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    3  Yes   239.255.255.250

Interface 4: Ethernet

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 20: Local Area Connection* 2

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 16: Bluetooth Network Connection

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 8: Local Area Connection* 3

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 11: Ethernet 2

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1

Interface 19: VMware Network Adapter VMnet1

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    1  Yes   239.5.1.4
0                    2  Yes   239.255.255.250

Interface 5: VMware Network Adapter VMnet8

Scope       References  Last  Address
----------  ----------  ----  ---------------------------------
0                    0  Yes   224.0.0.1
0                    4  Yes   224.0.0.251
0                    1  Yes   224.0.0.252
0                    2  Yes   239.255.255.250

My program is a trivial Syslog program written in Java. The call to socket.getInterface() returns the string /0.0.0.0, which makes me suspect this is really an operating system problem.

InetAddress group = InetAddress.getByName("239.5.1.4");
try (MulticastSocket socket = new MulticastSocket(514)) {
    socket.joinGroup(group);
    System.out.println(socket.getInterface()); // returns "/0.0.0.0"
    byte[] buf = new byte[1500];
    DatagramPacket packet = new DatagramPacket(buf, buf.length);
    while (true) {
        socket.receive(packet);
        System.out.print(new String(buf, 5, packet.getLength() - 5));
    }
}

This is on Windows 10.

PS C:\windows\system32> [System.Environment]::OSVersion

Platform ServicePack Version      VersionString
-------- ----------- -------      -------------
 Win32NT             10.0.17134.0 Microsoft Windows NT 10.0.17134.0

[dmiller-nmap]

Thanks for reporting this! The Npcap Loopback Adapter has caused some problems in the past due to route metrics and address configuration, so we removed the need for it in Npcap 0.9983, released today. Be sure to deselect (un-check) the "Legacy loopback support" and let us know if that solves your problem.

[r-smith]

Thank you. Npcap 0.9983 completely resolves the issue I was seeing with multicast traffic. The new loopback interface is not placed in the route table at all.

I'm wondering, how does it behave when upgrading from a previous version if you've already installed the loopback adapter?

[chmorgan]

@r-smith can you close this out now that 0.9983 has resolved the issue?

[r-smith]

Fixed with Npcap 0.9983