pcap_next_ex not returning -1? #217
We are seeing an issue currently where our application is not handling a network interface reconnection as well as it used to, and believe it may be related to a recent change in npcap.
With npcap 0.9991, we found that pcap_next_ex returned -1 when a network device was disabled. Our app then exited the loop and created a new handle and capture for the device once re-enabled.
With 0.9995 (we've also tried 0.9993-0.9994), it seems to only return 0 (timeout) when a device is disconnected.
I've recreated the same issue by using the basic_dump_ex example from the npcap repo. When testing with 0.9991 installed, the code reaches this line and exits when the monitored device is disabled: https://github.com/nmap/npcap/blob/master/Examples-pcap/basic_dump_ex/basic_dump_ex.c#L127
With 0.9995 I find that the example code continues indefinitely.
Please could someone advise on this issue? It could be related to our setup, but from our testing there appears to be a difference in how the two versions handle disconnected devices.
The text was updated successfully, but these errors were encountered:
I can state, from bugs filed against libpcap on Linux, that views differ on what is "good" handling of interface outages.
On the *BSDs, if an interface is configured down, BPF does not report an error; only if the interface is removed is an error delivered to clients such as libpcap.
On Linux, if an interface is configured down, PF_PACKET sockets do deliver an error to clients such as libpcap; people filed bug against libpcap, because it causes capture to terminate if an interface is configured down, which can happen briefly during some network events, and they want capture to continue when the interface comes back up. (This is made more painful because no error is reliably delivered when an interface disappears! I need to suggest a patch to the Linux PF_PACKET code to provide different errors for those two conditions.)
"Disabled" in what sense? Removed, or just the Windows equivalent of a UN*X "ifconfig XXX down"?
Unfortunately, 1) the libpcap API provides no mechanism for reporting "the interface is down" errors, as distinct from "the interface disappeared" errors, so that applications know the difference, and 2) as a result, other applications just stop capturing - which is the cause of the bugs filed against libpcap.
If, for example, an error is delivered when a machine sleeps and is then woken up, that's unacceptable, as evidenced by the number of bugs filed against Wireshark-on-Windows when that happened. That was fixed in Npcap.
Thanks for this bug report. I believe this is a bug in the fix to nmap/nmap#2036, which Driver Verifier identified for me just the other day in testing. When we complete an IRP with an error informational status, the IRP handler should also return that status, but we were returning STATUS_SUCCESS instead of STATUS_DEVICE_REMOVED. The fix is in bd0fad0 and will be in the next release, which is undergoing final testing.