Repository navigation
Upgrading from WinPcap to Npcap 0.99-r9 has multiple failures #369
Description
See related Wireshark bug: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15476
Wireshark relies on the Npcap installer to uninstall WinPcap so it seems like this issue is causing the Wireshark bug above.
OS: Windows 10, 1803. 64-bit
-
Clean machine that did not have any previous versions of Wireshark, WinPcap, or Npcap.
-
Install WinPcap 4.1.3 (https://www.winpcap.org/install/bin/WinPcap_4_1_3.exe)
-
Rebooted, even though it did not prompt. Just to be safe.
-
Install npcap-0.99-r9.exe (https://nmap.org/npcap/dist/npcap-0.99-r9.exe). Use default options.
-
ERROR: "Error opening file for writing...". Retry doesn't work. Abort causes both Wireshark and Npcap installers to hang. Click Ignore.
-
"Failed to uninstall WinPcap; files in use by: .". Retry doesn't work. Ignore doesn't work. Abort. (See Screenshot2.png)
-
Then it says uninstalling WinPcap.
-
The rest of the installation works as expected.
Activity
daulis commentedon Feb 3, 2019
Looks like the problem was introduced in 0.99-r8. I upgrading from WinPcap to Npcap 0.99-r7, and everything worked as expected.
daulis commentedon Feb 3, 2019
Test these configurations, and the problem affects them all:
daulis commentedon Feb 3, 2019
If you uncheck "Install Npcap in WinPcap API-compatible Mode", then you don't see the issue. But, having that checked is the default, so most users will experience this problem when upgrading.
daulis commentedon Feb 3, 2019
More notes:
install.log
NPFInstall.log
daulis commentedon Feb 4, 2019
The first error is that it can't write a file inside C:\Program Files\Npcap. It looks like Npcap doesn't create the folder first, before it tries to create the file, when installing from WinPcap to Npcap. It seems to work fine if you install Npcap without WinPcap previously installed.
When upgrading from WinPcap to Npcap:
This is an issue for Wireshark, because Wireshark 2.x uses WinPcap by default, the upcoming Wireshark 3.0 will install Npcap by default. So, most Windows 10 users would encounter this issue when upgrading (unless Wireshark packages an Npcap installer with the fix)
Note: I have not tested on Windows 7
dmiller-nmap commentedon Feb 5, 2019
Thanks for the detailed error report. I think I know why this is happening: we added some code to the installer to kill processes using WinPcap before running the WinPcap uninstaller, but as you noted, it needs to write and run the
NPFInstall2.exeexecutable to do so. I think that at the point where the code was inserted, the Npcap install has not started, so the installation directory potentially doesn't exist. I'll change this to either extract NPFInstall2.exe to a random temp directory first or ensure that the installation directory is created first.pquantin commentedon Feb 5, 2019
Hi Dan,
Any chance to release a 0.99-r10 soon? We are about to release Wireshark 3.0 release candidate and I would like to package this version if possible.