Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NPcap does not see interfaces/adapters after installation on Windows Server 2012 until reboot. #402

Closed
asidorenko opened this issue Oct 11, 2017 · 13 comments

Comments

@asidorenko
Copy link

@asidorenko asidorenko commented Oct 11, 2017

NPcap does not see interfaces/adapters after installation on Windows Server 2012 until reboot.
For the same use case work perfectly OK on Windows Server 2016/Windows 10.
I have tried to stop/start NPcap driver using sc stop/start npcap - it doesn't help. I need some workaround of this problem (from C++ code or command line).

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Oct 12, 2017

Duplicate of nmap/nmap#664. This is something we would like to fix in the future.

@asidorenko
Copy link
Author

@asidorenko asidorenko commented Oct 12, 2017

Strongly disagree. It is not a duplicate of nmap/nmap#664. Restarting NPcap does not fix this problem.
I have implemented workaround for nmap/nmap#664 by restarting NPcap driver and my fix works.

@hystericalOne
Copy link

@hystericalOne hystericalOne commented Jan 25, 2018

I also think this not a duplicate of #664.
This issue is not about adding new interface to already existing npcap installation, but installing npcap to already existing interfaces.

I had similar issue on Windows 2012 (it seems to be limited only to 2012). The only thing that helped beside system reboot was reseting the particular interface or just "NPFInstall.exe -r".

Can you reopen this case?

@pawel-kedzior-sw
Copy link

@pawel-kedzior-sw pawel-kedzior-sw commented Jan 31, 2018

I am able to reproduce the issue.
The problem reproduces easily on Windows Server 2012 R1.
The problem is not reproducible on Windows Server 2012 R2 and other major Windows versions.

The repro steps which I used are:

  1. On a clean Windows Server 2012 R1 machine, download: https://nmap.org/dist/nmap-7.60-setup.exe
  2. Install
  3. Run nping -tcp -p 80 google.com
    Expected Result: ping information
    Actual Result: error which indicates lack of interfaces provided by npcap.

The problem can be worked-around by either:

  • Running C:\Program Files\Npcap\NPFInstall.exe -r
  • Or rebooting the machine.

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Jan 31, 2018

Thanks everyone for reporting this. We definitely made a mistake in closing this issue. In order to better debug this issue, I need the output from:

  1. DiagReport run immediately after installation, while Npcap has the problem
  2. \Program Files\Npcap\NPFInstall.log after running NPFInstall.exe -r. This will also include the log of the initial install, so no need to collect that separately.

Running NPFInstall.exe -r disables and re-enables the binding of the Npcap driver to the adapter, which is a different process from restarting the driver itself. There should not be a problem running this on a production system as a workaround, but do note that if you installed with raw 802.11 WiFi capture, you should run NPFInstall.exe -r2 instead so that the WiFi bindings are re-enabled, too.

@dmiller-nmap dmiller-nmap reopened this Jan 31, 2018
@pawel-kedzior-sw
Copy link

@pawel-kedzior-sw pawel-kedzior-sw commented Feb 2, 2018

Attaching NPFInstall.log after installing and running NPFInstall.exe -r
NPFInstall.log

@pawel-kedzior-sw
Copy link

@pawel-kedzior-sw pawel-kedzior-sw commented Feb 2, 2018

Attaching DiagReport collected after installing (before running NPFInstall.exe -r or rebooting the machine):
DiagReport-20180202-041948.txt

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Feb 2, 2018

@zuraff Thanks, this is helpful.

Do you or anyone know if any previous Npcap release did not have this problem?

@pawel-kedzior-sw
Copy link

@pawel-kedzior-sw pawel-kedzior-sw commented Feb 5, 2018

@dmiller-nmap
I checked some of the recent versions of NMap, looks that the problem is ever since Npcap replaced WinPcap.
Details, referring to versions of NMap:
7.60 - reproduces
7.40 - reproduces
7.30 - running into a different problem ("WARNING: Could not import all necessary Npcap functions...")
7.25 Beta2: same as 7.30
7.25 Beta1: reproduces
7.12 - does not reproduce (uses WinPcap).

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Feb 6, 2018

I see one discrepancy that I would like to investigate if you can give me a little more information:

  1. Did you select "Support raw 802.11 traffic (and monitor mode) for wireless adapters" at install?
    1a. If you did, does the problem go away if you install without this option?
    1b. If you did not, does running NPFInstall.exe -u2 followed by NPFInstall.exe -i fix the broken installation?
  2. Can you provide the install.log file from the Npcap installation directory as well? This may explain why your DiagReport shows no raw-wifi support, but the NPFInstall.log shows that it tried to install raw-wifi support.

To be clear, I would appreciate all of this debug info from anyone who is experiencing this problem, not only @zuraff .

@pawel-kedzior-sw
Copy link

@pawel-kedzior-sw pawel-kedzior-sw commented Feb 13, 2018

  1. I did not select "Support raw 802.11 traffic (and monitor mode) for wireless adapters".
    install.log

  2. Running NPFInstall.exe -u2 followed by NPFInstall.exe -i does not fix the broken installation

c:\Program Files\Npcap>nping -tcp -p 80 github.com

Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2018-02-02 04:23 Pacific Sta
ndard Time
libnsock nsock_pcap_try_open(): pcap_open_live(eth0, 8192, 0, 1) failed with err
or: eth0: Error opening adapter: The system cannot find the device specified. (2
0)
libnsock nsock_pcap_open(): Will wait 4 seconds then retry.
^C

c:\Program Files\Npcap>NPFInstall.exe -u2
Npcap LWF driver (with Wi-Fi support) has failed to be uninstalled.

c:\Program Files\Npcap>NPFInstall.exe -i
Npcap LWF driver has been successfully installed!

c:\Program Files\Npcap>nping -tcp -p 80 github.com
Starting Nping 0.7.60 ( https://nmap.org/nping ) at 2018-02-02 04:25 Pacific Sta
ndard Time
libnsock nsock_pcap_try_open(): pcap_open_live(eth0, 8192, 0, 1) failed with err
or: eth0: Error opening adapter: The system cannot find the device specified. (2
0)
libnsock nsock_pcap_open(): Will wait 4 seconds then retry.
^C

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Mar 21, 2018

Ok, we have a diagnosis. This was something that actually came up back in 2013 during early Npcap development. There is a bug in Windows 8 and Server 2012 such that a NDIS filter driver with a StartType of 3 (SERVICE_DEMAND_START) will not have its FilterAttach method called except at system boot. The [workaround at that time(http://seclists.org/nmap-dev/2013/q3/503) was to change Npcap's StartType to 1 (SERVICE_SYSTEM_START), but this caused problems and was reverted.

As a fix, future installers will run NPFInstall.exe -r to rebind the filter driver to all adapters, but only on Windows 8 or Server 2012. We will close this issue when the next release is out and verified.

@dmiller-nmap
Copy link
Contributor

@dmiller-nmap dmiller-nmap commented Jun 13, 2018

This issue is fixed in Npcap 0.99-r6.

@fyodor fyodor transferred this issue from nmap/nmap May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants