failed to set hardware filter to promiscuous mode with Windows 11

[Hobo2k]

Describe the bug
After Upgrade from Windows 10 to Windows 11 I can't capture any more in promiscuous mode. I tried it with my LAN Interface not WLAN.
I upgraded npcap from 1.70 to 1.71 and tried Wireshark 3.6.7, 3.6.8 and 4.0.0rc1

Message is:
The capture session could not be initiated on capture device "\Device\NPF_{8B94FF32-335D-443C-8A80-F51BDC825F9F}" (failed to set hardware filter to promiscuous mode: Ein an das System angeschlossenes Gerät funktioniert nicht. (31)).

To Reproduce
Steps to reproduce the behavior:

1. Doubleclick on the Interface from StartScreen
2. Otherwise go to Capture Options.
3. Than check the promiscous mode
4. last click on start.

Expected behavior
A working capture. ;-)

Screenshots

Diagnostic information

• Windows version from winver: Windows 11 Version 21H2, OS Build 22000.856
• Output of DiagReport-20220908-131205.txt
• install.log

[Hobo2k]

The Problem only occurs with LAN adapters.
At virtualbox, WLAN, WWAN promiscuous mode can be enabled at capture start.

USB LAN nor docking is working.

[guyharris]

31 is ERROR_GEN_FAILURE. NT status codes that translate to ERROR_GEN_FAILURE include a bunch of "somebody wrote to executable memory" codes, STATUS_WIM_NOT_BOOTABLE, and STATUS_UNSUCCESSFUL, which is, I guess, the NT status equivalent of ERROR_GEN_FAILURE, as in "something bad happened but I'm not going to tell you what it was".

There appear to be a lot of places in the driver that return STATUS_UNSUCCESSFUL.

[Hobo2k]

Okay Error found:
Installing the Driver for Windows 10 instead of them for Windows 11 and it works again.
I don't know if it's a driver or npcap error.

Drivers are for Realtek USB devices: https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-usb-3-0-software

[ralish]

Can confirm I see the same issue with a Dell WD19DC dock which contains a Realtek RTL8153 USB GbE controller. Was working fine prior to Windows 11 upgrade from Windows 10 21H2. Current driver is rtu53cx22x64.sys v1153.8.20.608 (Date: 9/06/2022),

Happy to provide whatever further information would be of assistance but unsure what's most helpful.

EDIT: Using Wireshark v3.6.8 with npcap v1.71.

[ralish]

Just a thought: could it be related to a lack of support for the new NetAdapterCx driver model?

I have no idea if Npcap is expected to "Just Work" with NetAdapterCx drivers or if additional work is required.

The latest Windows 11 driver for the RTL8153 has the following details:

• Driver: rtu53cx22x64.sys
• Version: 1153.8.20.608
• Date: 9/06/2022
• Type: NetAdapterCx
• NDIS Version: 6.85

The latest Windows 10 driver for the RTL8153 has the following details:

• Driver: rtump64x64.sys
• Version: 10.52.20.608
• Date: 8/06/2022
• Type: NDIS miniport
• NDIS Version: 6.40

The Windows 10 driver works fine with Wireshark while the Windows 11 driver has the described error on starting capture.

[kotori2]

Exactly same situation here. Using Intel I225-V wired adapter, Windows 11, and Wireshark 4.0.0.
Downgrading to NDIS68 (v1.1.3.28) solves this issue for me.

[jd-imi]

On Windows 11, get the same message with Wireshark 4.0.0 and npcap 1.71 (but not with npcap 1.60) on the Ethernet interface (with the Wi-Fi, it was fine).

I reported the issue on Wireshark Q&A : https://ask.wireshark.org/question/29016/cannot-initiate-capture-session-on-a-device-after-having-installed-400/

[httpstorm]

My workaround after installing Wireshark 4.0.0 was to downgrade npcap to 1.60. This means some regression has been introduced in 1.71.
Device manager shows Realtek PCIe GbE Family controller, date 2021-01-27, version 1.0.0.4.

[overcam]

Same. Error introduced after upgrade to 1.71; resolved by downgrading back to 1.60. Using Killer E3100 2.5 Gbps interface.

[mggaskill]

I, too, was able to resolve my error (Windows 11 / Wireshark 4.0.1) by downgrading npcap from 1.71 to 1.60. Thanks for the info!

[robsan00]

A colleague of mine (who does not have a GitHub account) has a similar issue, however, for him it happens on Windows 10. He is using a "QLogic BCM57810" network card, I don't know what chipset this card contains. Downgrading to npcap 1.60 fixed his issue as well. The driver is quite old as QLogic themselves have been bought up multiple times and their successor companies more less seem to have stopped support.

[halfranklin]

This happens on Windows 10, Aquantia AQtion AQC107 10Gbit Network Adapter. Downgrade to npcap 1.60 fixed it.

[M4jx]

Previously worked on 1.60 but got the same error as yours on 1.71. Realtek Gaming 2.5GbeE Family Controller.

[rampageX]

Same here, previously worked on 1.60 but not 1.71, Realtek Gaming GbE Family Controller on laptop and Realtek USB GbE Family Controller on PC. Windows 11 x64 22H2 22621.755