Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VMware VMnet1 and VMnet8 adapters missing from Npcap 1.30 #304

Closed
dmiller-nmap opened this issue Apr 16, 2021 · 4 comments
Closed

VMware VMnet1 and VMnet8 adapters missing from Npcap 1.30 #304

dmiller-nmap opened this issue Apr 16, 2021 · 4 comments

Comments

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Apr 16, 2021

Probably due to e88b6f8 which replaced registry-mining for adapters with calls to GetAdaptersAddresses(), VMware's host-only and NAT virtual network adapters aren't showing up to Npcap. We're investigating why, but helpful information will be output of the following Powershell command: Get-NetAdapter -IncludeHidden -Name "VMware *" | select * | fl

@dmiller-nmap
Copy link
Contributor Author

@dmiller-nmap dmiller-nmap commented Apr 16, 2021

Big lead: Get-NetAdapterBinding -ComponentID INSECURE_NPCAP shows that Npcap 1.20 will bind to these adapters, but Npcap 1.30 does not. We made a small change to the INF file for npcap.sys that was intended to improve compatibility and follow microsoft guidance, but it appears this caused us to not bind to these adapters. We'll have to change that. Unfortunately, our window for being able to sign a driver for Windows 8.1 and earlier just closed yesterday, so the fix will have to wait until we can complete #237 and undergo WHQL certification for those operating systems. Windows 10 uses a different signature process for now, which will still work.

@packetfoo
Copy link

@packetfoo packetfoo commented Apr 16, 2021

PS C:\Users\Jasper> Get-NetAdapter -IncludeHidden -Name "VMware *" | select * | fl
PS C:\Users\Jasper> Get-NetAdapterBinding -ComponentID INSECURE_NPCAP

Name DisplayName ComponentID Enabled


Intel 10G NAS Npcap Packet Driver (NPCAP) INSECURE_NPCAP True
Onboard Npcap Packet Driver (NPCAP) INSECURE_NPCAP True
Intel 10G Npcap Packet Driver (NPCAP) INSECURE_NPCAP True
Bluetooth Network Connection Npcap Packet Driver (NPCAP) INSECURE_NPCAP True
Wi-Fi Npcap Packet Driver (NPCAP) INSECURE_NPCAP True
OpenVPN TAP-Windows6 Npcap Packet Driver (NPCAP) INSECURE_NPCAP True

PS C:\Users\Jasper>

As you can see the first command didn't return anything with npcap 1.30 on my system (Win10 x64 20H2, OS build 19042.928)

@dmiller-nmap
Copy link
Contributor Author

@dmiller-nmap dmiller-nmap commented May 6, 2021

Fixed in 2519976 for Npcap 1.31

@dmiller-nmap
Copy link
Contributor Author

@dmiller-nmap dmiller-nmap commented Jun 28, 2021

Npcap 1.50 addresses this for Windows versions prior to Windows 10, provided that the /prior_driver installer option ("Install older Npcap 1.31 driver") is not selected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants