Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No packets captured with Npcap 0.9991 #168

Closed
mikh-abc opened this issue May 8, 2020 · 5 comments
Closed

No packets captured with Npcap 0.9991 #168

mikh-abc opened this issue May 8, 2020 · 5 comments

Comments

@mikh-abc
Copy link

@mikh-abc mikh-abc commented May 8, 2020

Hello,

Compiled basic_dump with MSVC 2017 does not capture any packets after selecting interface. Npcap 0.9990 works fine.
Wireshark works fine with Npcap 0.9991.

@mikh-abc mikh-abc changed the title No packet captured with Npcap 0.9991 No packets captured with Npcap 0.9991 May 8, 2020
@victorjulien
Copy link

@victorjulien victorjulien commented May 12, 2020

I may be seeing something similar when trying 0.9991 with Suricata. By default it captures nothing. But it works when I specify a BPF. Can you try this as well?

@mikh-abc
Copy link
Author

@mikh-abc mikh-abc commented May 12, 2020

I may be seeing something similar when trying 0.9991 with Suricata. By default it captures nothing. But it works when I specify a BPF. Can you try this as well?

I tried to run https://github.com/nmap/npcap/tree/master/Examples-pcap/basic_dump
Could you point where specify a BPF in it?

@victorjulien
Copy link

@victorjulien victorjulien commented May 12, 2020

Quick glance suggests that you can't. Sorry, first time I looked at the examples.

@victorjulien
Copy link

@victorjulien victorjulien commented May 12, 2020

Can you reproduce your issue with https://github.com/nmap/npcap/blob/master/Examples-pcap/pcap_filter/pcap_filter.c as well? That one does allow you to specify a BPF.

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented May 13, 2020

Thanks for this bug report. This is a bug in Npcap 0.9991 due to the amount of free space in the kernel buffer not being updated after a call to PacketSetBuff(). The free space is updated as part of several other functions, so available workarounds are:

  • Set a BPF filter with pcap_setfilter() or PacketSetBpf()
  • Set the loopback behavior of a capture handle with PacketSetLoopbackBehavior() or the PCAP_OPENFLAG_NOCAPTURE_LOCAL flag via pcap_open() (WinPcap extension).
  • Set the timestamp mode with PacketSetTimestampMode() (currently not exposed via libpcap API).

This will be corrected in the next release.

@fyodor fyodor transferred this issue from nmap/nmap May 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants