Trying to do 802.11 capture with RTL8812AU

[yujuiwu]

Dear development team,

I'm trying to do raw wireless capture with RTL8821AU and find that it works with the Microsoft Network Monitor (https://www.techspot.com/downloads/4207-microsoft-network-monitor.html) but does not work with wireshark + npcap.

I wanted to see if npcap could actually get the frames reported by RTL8812AU so I installed a debug version of npcap(https://nmap.org/npcap/dist/npcap-0.96-debug.exe), but I can't observe a log similar to the one reported here: https://github.com/nmap/nmap/issues/1036#issuecomment-343669220 (especially NPF_AttachAdapter), but only some log prefixed with "KMLOOP". So I'm not sure if npcap works with RTL8812AU.

So my issue is how can I make npcap work with RTL8821AU

Here's my environment:
Wi-Fi driver: from realtek.com.tw, 1030.25.0701.2017, used the Windows 8.1 driver
OS: Win10 18362 x86
Wiresharek version: 3.0.5
npcap version: npcap-0.96-debug.exe

According to https://secwiki.org/w/Npcap/WiFi_adapters, I know that it can be switched into monitor mode, but capture does not work. However, as it works with Microsoft Network Monitor, I'm just trying to figure out why is that.

DiagReport-20191014-183630.txt

Thanks!

[yujuiwu]

Ok, I built the debug version of NPCAP from source and got the log prefixed with "NPF_".

I also found that RTL8812AU has some issue with the latest NPCAP (v0.9983) but the previous versions (9982, 9981, 0.99r9) are good.

After getting the proper NPCAP version, there's one more trick, we have to connect it to an AP at least once so that its monitor mode works (e.g. connect -> disconnect -> switch to monitor mode -> capture).

The driver I'm using is a Win8.1 driver because the link below says that a Win10 WDI driver does not support monitor mode.
https://github.com/MicrosoftDocs/windows-driver-docs/issues/1476#issuecomment-498465506

[dmiller-nmap]

This issue is resolved in Npcap 1.30.

[AnjeloPeiris711]

I am currently facing challenges while attempting to perform raw wireless capture using the Alfa AC1200 adapter equipped with the Realtek 8812AU chipset.

I have encountered issues with Wireshark and npcap when attempting to conduct the capture with the RTL8821AU chipset. Despite using the recommended drivers from realtek.com.tw (version 1030.25.0701.2017), I have not been successful in achieving the desired results on my Win11 Home operating system.

However, I have the ability to change the interface mode to Monitor Mode using Wireshark and wlanhelper.exe.

Here are the specifics of my environment:

Wi-Fi Driver: Realtek.com.tw, version 1030.25.0701.2017
Operating System: Windows 11 Home
Wireshark Version: 4.2.0
Npcap Version: npcap-1.78

I am reaching out to seek your expertise and guidance in resolving this issue. Any assistance or recommendations you can provide would be greatly appreciated.