Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to capture raw Wi-Fi packets with supported adapter (NETGEAR A6210) #1778

Open
nbernhardt opened this issue Oct 8, 2019 · 3 comments

Comments

@nbernhardt
Copy link

commented Oct 8, 2019

I have a system that I have been trying to convert from using AirPcap and WinPcap to using a network adapter and Npcap to capture raw 802.11 traffic. However, up to this point I have been entirely unable to view any traffic at all in Wireshark, despite selecting an appropriate adapter from https://secwiki.org/w/Npcap/WiFi_adapters (NETGEAR A6210), and enabling monitor mode using wlanhelper.
To summarize steps I have taken (and repeated on other machines/after uninstalling all software):

  1. Install npcap (with raw 802.11 traffic and API enabled)
  2. Run wlanhelper.exe in interactive mode to set Wi-Fi to monitor mode (some issues here)
    • when running "wlanhelper Wi-Fi mode" -> Error: makeOIDRequest::initPacketFunctions
    • when running "wlanhelper Wi-Fi channel" -> Error: makeOIDRequest::initPacketFunctions
    • some other parameters cause similar issue
  3. Install and run Wireshark in administrator mode, capture->options->monitor mode checked

When I start the capture on the appropriate device, no packets are received whatsoever. I am fairly certain based on the wiki page that the device I selected should work, and that based on the output I receive from wlanhelper that it has been properly set to monitor mode. Wireshark then shows that it does allow monitor mode, but when I ensure that the monitor mode box is checked, there are no packets seen by the device. Based on some strange issues I receive in using wlanhelper I wonder if my issue lies with Npcap specifically.

I have checked (and tried deleting) the Packet.dll and wpcap.dll files located in C:/Windows/System32 and C:/Windows/SystemWOW64 (Leaving the ones in their respective \Npcap\ folder alone) as some users had deemed helpful in the comments of a blog post, but with no luck there.

I have tried other machines that had never had WinPcap or Npcap installed to try for a more "fresh" environment.

Below is a sample of the output I receive when trying a few different actions in wlanhelper.

wlanhelper_output

I have made sure that my drivers for my network device match those detailed in the wiki link that I found it in.

Please, if you have any ideas for how I can fix this issue, I have spent upwards of 50 to 60 hours trying to fix these issues. If there is any more data I can provide let me know.

@matthias-he

This comment has been minimized.

Copy link

commented Oct 11, 2019

I have found the same problem for the Netgear A6200 that I am using. Npcap will set it to monitor mode but it throws an error if trying to select any specific WiFi channel or frequency after it is in monitoring mode.

@nbernhardt

This comment has been minimized.

Copy link
Author

commented Oct 15, 2019

Do you receive any packets after you set it to monitor mode? Wireshark shows nothing being received for me.

@matthias-he

This comment has been minimized.

Copy link

commented Oct 16, 2019

No packets received in WireShark. But without specifying a channel to monitor I did not expect the adapter to actually receive and monitor anything.

I also opened an issue about this here: Npcap WLANHELPER unable to select channel with NETGEAR A6200 #1782 #1782

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.