Skip to content

NPcap does not see interfaces/adapters after installation on Windows Server 2012 until reboot. #402

Closed
Closed
NPcap does not see interfaces/adapters after installation on Windows Server 2012 until reboot.#402

Description

@asidorenko
asidorenko
opened on Oct 11, 2017

NPcap does not see interfaces/adapters after installation on Windows Server 2012 until reboot.
For the same use case work perfectly OK on Windows Server 2016/Windows 10.
I have tried to stop/start NPcap driver using sc stop/start npcap - it doesn't help. I need some workaround of this problem (from C++ code or command line).

Activity

  1. dmiller-nmap commented on Oct 12, 2017

    @dmiller-nmap
    dmiller-nmap
    on Oct 12, 2017
    Contributor

    Duplicate of nmap/nmap#664. This is something we would like to fix in the future.

  2. dmiller-nmap
    closed this as completedon Oct 12, 2017

  3. asidorenko commented on Oct 12, 2017

    @asidorenko
    asidorenko
    on Oct 12, 2017
    Author

    Strongly disagree. It is not a duplicate of nmap/nmap#664. Restarting NPcap does not fix this problem.
    I have implemented workaround for nmap/nmap#664 by restarting NPcap driver and my fix works.

  4. dm0red commented on Jan 25, 2018

    @dm0red
    dm0red
    on Jan 25, 2018

    I also think this not a duplicate of #664.
    This issue is not about adding new interface to already existing npcap installation, but installing npcap to already existing interfaces.

    I had similar issue on Windows 2012 (it seems to be limited only to 2012). The only thing that helped beside system reboot was reseting the particular interface or just "NPFInstall.exe -r".

    Can you reopen this case?

  5. pawel-kedzior-sw commented on Jan 31, 2018

    @pawel-kedzior-sw
    pawel-kedzior-sw
    on Jan 31, 2018

    I am able to reproduce the issue.
    The problem reproduces easily on Windows Server 2012 R1.
    The problem is not reproducible on Windows Server 2012 R2 and other major Windows versions.

    The repro steps which I used are:

    1. On a clean Windows Server 2012 R1 machine, download: https://nmap.org/dist/nmap-7.60-setup.exe
    2. Install
    3. Run nping -tcp -p 80 google.com
      Expected Result: ping information
      Actual Result: error which indicates lack of interfaces provided by npcap.

    The problem can be worked-around by either:

    • Running C:\Program Files\Npcap\NPFInstall.exe -r
    • Or rebooting the machine.

  6. dmiller-nmap commented on Jan 31, 2018

    @dmiller-nmap
    dmiller-nmap
    on Jan 31, 2018
    Contributor

    Thanks everyone for reporting this. We definitely made a mistake in closing this issue. In order to better debug this issue, I need the output from:

    1. DiagReport run immediately after installation, while Npcap has the problem
    2. \Program Files\Npcap\NPFInstall.log after running NPFInstall.exe -r. This will also include the log of the initial install, so no need to collect that separately.

    Running NPFInstall.exe -r disables and re-enables the binding of the Npcap driver to the adapter, which is a different process from restarting the driver itself. There should not be a problem running this on a production system as a workaround, but do note that if you installed with raw 802.11 WiFi capture, you should run NPFInstall.exe -r2 instead so that the WiFi bindings are re-enabled, too.

  7. dmiller-nmap
    reopened this on Jan 31, 2018

  8. pawel-kedzior-sw commented on Feb 2, 2018

    @pawel-kedzior-sw
    pawel-kedzior-sw
    on Feb 2, 2018

    Attaching NPFInstall.log after installing and running NPFInstall.exe -r
    NPFInstall.log

  9. pawel-kedzior-sw commented on Feb 2, 2018

    @pawel-kedzior-sw
    pawel-kedzior-sw
    on Feb 2, 2018

    Attaching DiagReport collected after installing (before running NPFInstall.exe -r or rebooting the machine):
    DiagReport-20180202-041948.txt

  10. dmiller-nmap commented on Feb 2, 2018

    @dmiller-nmap
    dmiller-nmap
    on Feb 2, 2018
    Contributor

    @zuraff Thanks, this is helpful.

    Do you or anyone know if any previous Npcap release did not have this problem?

  11. pawel-kedzior-sw commented on Feb 5, 2018

    @pawel-kedzior-sw
    pawel-kedzior-sw
    on Feb 5, 2018

    @dmiller-nmap
    I checked some of the recent versions of NMap, looks that the problem is ever since Npcap replaced WinPcap.
    Details, referring to versions of NMap:
    7.60 - reproduces
    7.40 - reproduces
    7.30 - running into a different problem ("WARNING: Could not import all necessary Npcap functions...")
    7.25 Beta2: same as 7.30
    7.25 Beta1: reproduces
    7.12 - does not reproduce (uses WinPcap).

  12. dmiller-nmap commented on Feb 6, 2018

    @dmiller-nmap
    dmiller-nmap
    on Feb 6, 2018
    Contributor

    I see one discrepancy that I would like to investigate if you can give me a little more information:

    1. Did you select "Support raw 802.11 traffic (and monitor mode) for wireless adapters" at install?
      1a. If you did, does the problem go away if you install without this option?
      1b. If you did not, does running NPFInstall.exe -u2 followed by NPFInstall.exe -i fix the broken installation?
    2. Can you provide the install.log file from the Npcap installation directory as well? This may explain why your DiagReport shows no raw-wifi support, but the NPFInstall.log shows that it tried to install raw-wifi support.

    To be clear, I would appreciate all of this debug info from anyone who is experiencing this problem, not only @zuraff .

  13. pawel-kedzior-sw commented on Feb 13, 2018

    @pawel-kedzior-sw
    pawel-kedzior-sw
    on Feb 13, 2018

    1. I did not select "Support raw 802.11 traffic (and monitor mode) for wireless adapters".
      install.log

    2. Running NPFInstall.exe -u2 followed by NPFInstall.exe -i does not fix the broken installation

    c:\Program Files\Npcap>nping -tcp -p 80 github.com

Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2018-02-02 04:23 Pacific Sta
ndard Time
libnsock nsock_pcap_try_open(): pcap_open_live(eth0, 8192, 0, 1) failed with err
or: eth0: Error opening adapter: The system cannot find the device specified. (2
0)
libnsock nsock_pcap_open(): Will wait 4 seconds then retry.
^C

c:\Program Files\Npcap>NPFInstall.exe -u2
Npcap LWF driver (with Wi-Fi support) has failed to be uninstalled.

c:\Program Files\Npcap>NPFInstall.exe -i
Npcap LWF driver has been successfully installed!

c:\Program Files\Npcap>nping -tcp -p 80 github.com
Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2018-02-02 04:25 Pacific Sta
ndard Time
libnsock nsock_pcap_try_open(): pcap_open_live(eth0, 8192, 0, 1) failed with err
or: eth0: Error opening adapter: The system cannot find the device specified. (2
0)
libnsock nsock_pcap_open(): Will wait 4 seconds then retry.
^C

  14. dmiller-nmap commented on Mar 21, 2018

    @dmiller-nmap
    dmiller-nmap
    on Mar 21, 2018
    Contributor

    Ok, we have a diagnosis. This was something that actually came up back in 2013 during early Npcap development. There is a bug in Windows 8 and Server 2012 such that a NDIS filter driver with a StartType of 3 (SERVICE_DEMAND_START) will not have its FilterAttach method called except at system boot. The [workaround at that time(http://seclists.org/nmap-dev/2013/q3/503) was to change Npcap's StartType to 1 (SERVICE_SYSTEM_START), but this caused problems and was reverted.

    As a fix, future installers will run NPFInstall.exe -r to rebind the filter driver to all adapters, but only on Windows 8 or Server 2012. We will close this issue when the next release is out and verified.

  15. dmiller-nmap commented on Jun 13, 2018

    @dmiller-nmap
    dmiller-nmap
    on Jun 13, 2018
    Contributor

    This issue is fixed in Npcap 0.99-r6.

  16. dmiller-nmap
    closed this as completedon Jun 13, 2018
  17. fyodor
    transferred this issue fromnmap/nmapon May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions