Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
Dear development team,
I'm trying to do raw wireless capture with RTL8821AU and find that it works with the Microsoft Network Monitor (https://www.techspot.com/downloads/4207-microsoft-network-monitor.html) but does not work with wireshark + npcap.
I wanted to see if npcap could actually get the frames reported by RTL8812AU so I installed a debug version of npcap(https://nmap.org/npcap/dist/npcap-0.96-debug.exe), but I can't observe a log similar to the one reported here: #1036 (comment) (especially NPF_AttachAdapter), but only some log prefixed with "KMLOOP". So I'm not sure if npcap works with RTL8812AU.
So my issue is how can I make npcap work with RTL8821AU
Here's my environment:
According to https://secwiki.org/w/Npcap/WiFi_adapters, I know that it can be switched into monitor mode, but capture does not work. However, as it works with Microsoft Network Monitor, I'm just trying to figure out why is that.
Ok, I built the debug version of NPCAP from source and got the log prefixed with "NPF_".
I also found that RTL8812AU has some issue with the latest NPCAP (v0.9983) but the previous versions (9982, 9981, 0.99r9) are good.
After getting the proper NPCAP version, there's one more trick, we have to connect it to an AP at least once so that its monitor mode works (e.g. connect -> disconnect -> switch to monitor mode -> capture).
The driver I'm using is a Win8.1 driver because the link below says that a Win10 WDI driver does not support monitor mode.