Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

After installing npcap-1.30, wireshark can only capture the loopback package #302

Closed
BruceBeanSun opened this issue Apr 13, 2021 · 5 comments
Closed

Comments

@BruceBeanSun
Copy link

@BruceBeanSun BruceBeanSun commented Apr 13, 2021

After npcap-1.30 is installed on Windows 10, the list of Wireshark network cards is as shown in the picture.
微信图片_20210413144902

Many additional network cards are added, and the link layer headers of all network cards are changed to loopback. As a result, no matter which network card is selected, can only capture the loopback packets。

@BruceBeanSun
Copy link
Author

@BruceBeanSun BruceBeanSun commented Apr 13, 2021

The same problem occurs on Windows Server 2012

@guyharris
Copy link

@guyharris guyharris commented Apr 13, 2021

The sparklines (the traffic graph between the adapter name and the adapter link-layer type) look suspiciously similar; could Npcap be capturing on the exact same device, whatever that might be, for all of those adapters?

@BruceBeanSun
Copy link
Author

@BruceBeanSun BruceBeanSun commented Apr 13, 2021

The sparklines are the same because the traffic of these interfaces is the same. The packet captured on each adapter is exactly same, and there are only loopback packets.

@guyharris
Copy link

@guyharris guyharris commented Apr 13, 2021

The sparklines are the same because the traffic of these interfaces is the same.

That's a tautology, because what the the sparklines are displaying is the traffic.

The question is why the traffic on all of the interfaces is the same; my question is whether Npcap might, somehow, be tapping the same underlying device (its special loopback adapter) for all of them?

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Apr 13, 2021

This appears to be caused by a misplaced parenthesis in the comparison of an adapter name with that of the legacy Npcap Loopback Adapter retrieved from the Registry. This is resulting in every comparison being true. To fix the issue, reinstall Npcap and un-check the installation option box for "Legacy Loopback support." We will issue a bugfix release soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants