Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Npcap: Can it detect new interfaces without restarting the driver? #435

dmiller-nmap opened this issue Jan 23, 2017 · 6 comments

Npcap: Can it detect new interfaces without restarting the driver? #435

dmiller-nmap opened this issue Jan 23, 2017 · 6 comments


Copy link

@dmiller-nmap dmiller-nmap commented Jan 23, 2017

Thread on WinPcap-users mailing list:

The user notes that WinPcap cannot detect new plug-and-play interface until the computer is rebooted. Another user comments that simply restarting the npf driver service will accomplish the same thing.

I would like to know whether Npcap has the same behavior or if this is solved with the new filter driver design. If it has the same behavior, we should investigate what it might take to detect new interfaces without restarting the driver.

Copy link

@Varunram Varunram commented Jan 24, 2017

@dmiller-nmap Npcap seems to react in the same way as WinPcap and doesn't notice the network interface without a restart.

Copy link

@capt2101akash capt2101akash commented Jan 25, 2017

@Varunram I agree with you.
@dmiller-nmap I tried using Winpcap and found that as the other user says it requires a driver restart to detect a new interface and as npcap and WinPcap works the same way, the problem persists in npcap too.
So I think we need to find out a way around to solve this problem.

Copy link

@hsluoyz hsluoyz commented Jan 28, 2017

@dmiller-nmap , the Npcap/WinPcap driver is never a plug-and-play driver. Technically, there are two difficulties:

  1. Microsoft doesn't provide such an interface for a filter driver to detect the new interface. Maybe there are some other types of drivers that can do it. But integrating such a mechanism into Npcap would need a significant amount of development.

  2. Even if Npcap can detect the new interface, NDIS 6 model doesn't allow a filter driver to bind this new interface in the halfway. All the binding work has to be done in the "main" function of the driver ("main" function gets called when you start the driver). Legacy NDIS 5 supports binding to an interface in the halfway. But unfortunately, NDIS 5 is already an antique in XP era, and totally not supported in Npcap.

IMHO, maybe having this feature would be fancy, but restarting the driver after installing a new interface just seems also good enough.

Copy link

@hdm hdm commented Mar 5, 2019

It would be great to have a better solution to this going forward.

Copy link

@gvanem gvanem commented Mar 6, 2019

Maybe this is related to how other CACE-tech products/drivers are designed?
E.g. I sometimes have problems with a hanging AirPcap driver (it's blocking at some IOCTL_x call).
A fix for me it to unplug the USB-dongle and put it back in. Always works.

Copy link
Contributor Author

@dmiller-nmap dmiller-nmap commented Sep 4, 2019

Npcap 0.9983 fixes this issue: adapters can be detected and supported for capture and injection as soon as they are bound to the NDIS stack!

@fyodor fyodor transferred this issue from nmap/nmap May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

No branches or pull requests

6 participants