Skip to content

[npcap] - wireshark stopped see adapters after windows 10 updated to "annivarsary edition" #467

Closed
Closed
[npcap] - wireshark stopped see adapters after windows 10 updated to "annivarsary edition"#467
Assignees
hsluoyz

Description

@zdm
zdm
opened on Aug 7, 2016

Hi.
Today windows 10 was updated and wireshark don't see network adapters any more.
I am tried to reinstall npcap and wireshark - this wasn't helpful.
Npcap installed in winpcap compat. mode and wireshark detected npcap during install process.

Activity

  1. zdm commented on Aug 7, 2016

    @zdm
    zdm
    on Aug 7, 2016
    Author

    Winpcap works.
    Npcap - not.

  2. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member

    Hi @zdm ,

    Is your OS x86 or x64? Which Npcap version and Wireshark version did you use? Which Npcap installation options did you choose? Thanks.

    I have tested latest Npcap 0.08 r3 (with WinPcap Compat Mode) and latest Wireshark Development Release (2.1.1) on my Win10 x64 Anniversary version without any issues.

    Please don't use Wireshark Stable Release because it can't recognize the new version Npcap when installed in non-WinPcap Compat Mode (which is by default).

  3. hsluoyz
    self-assigned this
    on Aug 8, 2016

  4. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author

    Windows 10 x64

    Wireshark 2.0.5 x 64

    I tried following npcap versions:
    0.08-r2
    0.08
    0.07-r17

    On 08.08.2016 03:42, Yang Luo wrote:

    Hi @zdm https://github.com/zdm ,

    Is your OS x86 or x64? Which Npcap version and Wireshark version did
    you use? Thanks.

    —
    You are receiving this because you were mentioned.
    Reply to this email directly, view it on GitHub
    https://github.com/nmap/nmap/issues/492#issuecomment-238119783, or
    mute the thread
    https://github.com/notifications/unsubscribe-auth/AA-mSPLEBGTtgI64dafMqjuEtOfrt_7sks5qdnt3gaJpZM4JekI0.

  5. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member

    I tried your environment and didn't encounter that issue. What error message did you actually see?

  6. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author

    Wireshark doesn't show any errors, just shows no adapters.

    On 08.08.2016 08:10, Yang Luo wrote:

    I tried your environment and didn't encounter that issue. What error
    message did you actually see?

    —
    You are receiving this because you were mentioned.
    Reply to this email directly, view it on GitHub
    https://github.com/nmap/nmap/issues/492#issuecomment-238143145, or
    mute the thread
    https://github.com/notifications/unsubscribe-auth/AA-mSKXeekOXzqlfxLlmsNTGN7LmW13Fks5qdrozgaJpZM4JekI0.

  7. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member
    1. Install Npcap with default options.
    2. Reboot after intall.
    3. try nmap --iflis and paste the output here.

  8. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author

    I have removed winpcap and installed npcap-v0.08-r2 with default options.

    In not elevated cmd nmap return nothing:
    screenshot 2016-08-08 08 36 38

    But in elevated I got error:
    screenshot 2016-08-08 08 36 48

  9. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member

    Oh, I forgot to say.

    Please install Nmap's dev version: https://nmap.org/dist/nmap-7.25BETA1-setup.exe

    And please install latest Npcap 0.08 r3.

  10. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author

    With nmap-7.25-beta1 results are the same.

    On 08.08.2016 08:41, Yang Luo wrote:

    Oh, I forgot to see. Please install Nmap's dev version:
    https://nmap.org/dist/nmap-7.25BETA1-setup.exe

    —
    You are receiving this because you were mentioned.
    Reply to this email directly, view it on GitHub
    https://github.com/nmap/nmap/issues/492#issuecomment-238146254, or
    mute the thread
    https://github.com/notifications/unsubscribe-auth/AA-mSM5dyTxbmUKly16L0gYzKfaVlElHks5qdsGYgaJpZM4JekI0.

  11. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member
    1. See if the C:\Windows\System32\Npcap folder contains these two files: wpcap.dll, Packet.dll
    2. In Administrator CMD, enter sc query npcap and paste the result here.

  12. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author
    1. Files are present;
    2. Service is stopped
    SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 31  (0x1f)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

  13. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member

    In Administrator CMD, enter net start npcap and paste the result here.

  14. zdm commented on Aug 8, 2016

    @zdm
    zdm
    on Aug 8, 2016
    Author

    Problem with signature

    d:\downloads\111>net start npcap
System error 577 has occurred.

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  15. hsluoyz commented on Aug 8, 2016

    @hsluoyz
    hsluoyz
    on Aug 8, 2016
    Member
    1. Unzip the attached signtool.zip, put signtool.exe to somewhere your CMD can find (e.g. . C:\Program Files\Npcap)
    2. In CMD, cd into the C:\Program Files\Npcap path, enter signtool verify /kp /c npcap.cat npcap.sys and paste the result here.

    signtool.zip

  16. 38 remaining items

  17. BavoB commented on Dec 13, 2016

    @BavoB
    BavoB
    on Dec 13, 2016

    npcap 0 78 r4 beta ev version
    For completeness sake: this is the EV version installed on Windows 2012 R2 (server) - UEFI with secure boot. So AFAIK the attestation is also needed here or else there is still something else wrong.
    I got the Windows Security pop-up 'Would you like to install this device software ?", to which I answered 'no' (do not always trust Insecure LLC).

  18. mhoes commented on Dec 13, 2016

    @mhoes
    mhoes
    on Dec 13, 2016 via email

  19. BavoB commented on Dec 13, 2016

    @BavoB
    BavoB
    on Dec 13, 2016 via email

  20. hsluoyz commented on Dec 13, 2016

    @hsluoyz
    hsluoyz
    on Dec 13, 2016
    Member

    @BavoB

    I got the Windows Security pop-up 'Would you like to install this device software ?", to which I answered 'no'

    If you choose no here, then you will always fail the driver install no matter how our driver is signed. So please choose yes.

  21. BavoB commented on Dec 13, 2016

    @BavoB
    BavoB
    on Dec 13, 2016 via email

  22. mhoes commented on Dec 13, 2016

    @mhoes
    mhoes
    on Dec 13, 2016

    It appears to me as if two things are getting mixed up here, but I may be wrong ? (I made a screenshot of the pop-up I get, yours may be different). In the pop-up, there are actually two related, but different, things. First of all, there is a 'checkbox' that you can check if you always want to trust drivers singed by "Insecure.Com LLC". You don't have to check that box, but you can. I'm guessing that if you do check the box to always trust the signer that you will never get this pop-up again, and that you will get the pop-up again if you don't.

    Then there are the 'install' and 'dont install' buttons. If you want to install the driver (and I'm guessing that you want to) then you must click the button that says 'install'. If you haven't checked the checkbox in combination with clicking on 'install', you will only trust the signer once, for this install only, instead of always.

    pop-up

  23. marlop352 commented on Dec 13, 2016

    @marlop352
    marlop352
    on Dec 13, 2016

    0.78 r2-ev does not work(fails to create services)
    0.78 r2-atestation works
    with 0.78 r4 windows gives an error after installation saying that it blocked the installation of a driver not digitally signed

    0.78 r4-ev still gives me the same error as 0.78 r4 even if I mark the always trust box(witch does not appear on 0.78 r4) (checking that box should have made it accept the driver I think)

    Windows 10 Pro 1607 (it's a clean install, not an update from a previous version) with secure boot enabled

  24. dmiller-nmap commented on Dec 15, 2016

    @dmiller-nmap
    dmiller-nmap
    on Dec 15, 2016
    Contributor

    Ok, all: I just published Npcap 0.78 r5, which has attestation-signed drivers for Win10 users, dual-signed SHA1/SHA256 drivers with MS Cross-Certs for Windows 8 and earlier. We are back in business! Do let us know if you still experience these problems.

  25. BavoB commented on Dec 15, 2016

    @BavoB
    BavoB
    on Dec 15, 2016 via email

  26. mhoes commented on Dec 16, 2016

    @mhoes
    mhoes
    on Dec 16, 2016 via email

  27. BavoB commented on Dec 20, 2016

    @BavoB
    BavoB
    on Dec 20, 2016

    OK, I had a chance to uninstall 0.78 r4 on a Window Win2012 R2 server + install 0.78 r5 (system with secure boot enabled). My findings, some of which have been reported before:

    • uninstalling took very long and didn't remove the adapters (which I removed manually), but eventually it did uninstall - it seemed to be stuck on the 'stopping npcap driver' stage
    • installing 0.78 r5 worked, but I did get the 'failed to create service' error: however after installing it seemed to work ==> i did not have winpcap installed on this system, I installed npcap in winpcap api compatible mode and the programs that normally rely on winpcap seemed to be working normally

    So I guess there is some progress ;-)

    I have some questions:

    1. what services are created by the installer, what is their name? (I'd like to check in services msc to see if it is running)
    2. are the uninstall problems also related to the (kernel) driver signing requirements/problems ==> although here I'm not running on Win10 based system
    3. what is the current status of npcap compared to winpcap: can this be run safely with a program like Wireshark (without Winpcap)?

  28. mhoes commented on Dec 20, 2016

    @mhoes
    mhoes
    on Dec 20, 2016 via email

  29. dmiller-nmap commented on Jan 19, 2017

    @dmiller-nmap
    dmiller-nmap
    on Jan 19, 2017
    Contributor

    Looks like we handled the core issue reported here. If you continue to have problems with uninstalling, please open a new issue so we can track and fix it. Thanks!

  30. dmiller-nmap
    closed this as completedon Jan 19, 2017
  31. fyodor
    transferred this issue fromnmap/nmapon May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions