Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Split Npcap driver into one for newer Windows releases, plus a compatible version for older systems that we still support #196

Closed
fyodor opened this issue Jun 24, 2020 · 3 comments

Comments

@fyodor
Copy link
Member

@fyodor fyodor commented Jun 24, 2020

Right now we compile npcap.sys so that it supports all the operating systems still supported by Microsoft, including Windows 7 and Windows Server 2012r2. This prevents from using NDIS versions past 6.20 as well as other features not supported by older Windows releases.

We hope to improve this by building two versions of npcap.sys. One which works on all the systems we support, and one just for newer Windows releases (probably Win10+) which support all of the performance features we want. The Npcap installer would install just the best driver for the given system.

Known improvements this will enable:

  • RSC (Receive Segment Coalescing) allows the network card miniport driver to coalesce multiple TCP segments into one unit for the operating system's networking subsystem to process. This is often essential for the OS to keep up with 10Gbps networks. It requires NDIS 6.30+ (Windows 8 or later; Windows Server 2012 or later). Having an NDIS driver below 6.30 on these newer systems prevents the whole OS from using RSC. Related: Issue #70 ; Issue #195

NDIS Versions/Features and OS compatibility: https://docs.microsoft.com/en-us/windows-hardware/drivers/network/overview-of-ndis-versions

@fyodor fyodor changed the title Split Npcap driver into one for Win10+ and a compatible version for older systems Split Npcap driver into one for newer Windows releases, plus a compatible version for older systems that we still support Jun 24, 2020
@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Jun 25, 2020

Just leaving a note that WFP callout drivers (like Nmap's loopback capture feature) need to explicitly opt-in to receive large packets, otherwise RSC will be disabled in a similar way. Reference: https://docs.microsoft.com/en-us/windows-hardware/drivers/network/programming-considerations-for-rsc-drivers#rsc-support-for-lightweight-filters-and-mux-intermediate-drivers

@guyharris
Copy link

@guyharris guyharris commented Jul 11, 2020

Is this now fixed? The Npcap CHANGELOG says

  • On Windows 10, the Npcap driver has been updated to NDIS 6.50 and Windows 10 WFP compatibility, supporting network stack improvements like RSC. Fixes #196.

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Jul 13, 2020

This issue is fixed in Npcap 0.9995

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants