Wireshark doesn't start with NPCAP 1.84 / 1.85 configured Restrict Npcap driver's Access to Administrators only

[gunnarhaslinger]

Wireshark does NOT start with NPCAP 1.84 when it is configured "Restrict Npcap driver's Access to Administrators only"

To Reproduce:

• Install NPCAP 1.84 on Windows 11

  • During Installation: Select "Restrict Npcap driver's Access to Administrators only"
  • Or: Set Registry-Key "AdminOnly" to "1"

• Install Wireshark 4.6.0

• Try to start Wireshark

  • Wireshark Process is created but NO Window is displayed.
  • Wireshark hangs without activity (ProcMon shows no activity)
  • You can / have to kill Wireshark process with ProcExp or TaskManager

Uninstall NPCAP 1.84 and ReInstall NPCAP 1.83 solves the problem
So this Issue is NEW with v1.84 and does not exist with v1.83

If you don't install with Setting "Restrict Npcap driver's Access to Administrators only" the Issue is not there.
If you Run Wireshark "as Admin" (elevated) the Issue is not there.

So it seems to have to do with Wireshark not elevated and want's to access NPCAP.

Checked this on several Machines.
It is clearly a new issue with v1.84, so I uninstall v1.84 and go back to v1.83 to avoid this issue in the meantime it gets solved.

[gunnarhaslinger]

Not sure if this has to be solved by NPCAP or by Wireshark Devs, I created an Issue for the WiresShark Developers here and linked back: https://gitlab.com/wireshark/wireshark/-/issues/20828

[SilmorSenedlen]

Wireshark does NOT start with NPCAP 1.84 when it is configured "Restrict Npcap driver's Access to Administrators only"

You should probably provide more information about your environment (at least the Windows version), which user (with which permission level) Wireshark is running, and whether, for example, antivirus affects appearance of this problem.

For instance, we use "Restrict Npcap driver's Access to Administrators only" on all our servers(mostly virtual / Windows Server 2019 x64) and workstations (Windows 10 Enterprise LTSC (1809) x64), about ~70 machines in total, and we haven’t any such problem with npcap 1.84 and Wireshark 4.6.0.

[gunnarhaslinger]

As I noted in my initial description above it is Windows 11 x64, to be more precise it is Windows 11 24H2 fully patched by Microsoft Patch-Tuestay 14.10.2025.

Doesn't matter if physical machines or virtual (Hyper-V and VMWare, both tested). Doesn't matter if Win 11 pro or Enterprise, both tested.

Local User having default User rights not part of local admin group can be used to demonstrate the problem.

As I already described: A user which is is part of local admin group can start Wireshark elevated "as admin" to demonstrate the issue is not there when running elevated.

No special antivirus configuration, issue can be demonstrated an a fresh installed Win11 machine without any additional software installed, so only defender included in Win11 is active.

[gunnarhaslinger]

Re-Tested the situation with NPCAP 1.85 ... same Issue as described with 1.84
Need to revert back to NPCAP v1.83 to be able to start Wireshark GUI without admin-rights and NPCAP Setting "Restrict Npcap driver's Access to Administrators only"

Would be nice, if somebody could look into this issue.

[bubbasnmp]

Related to a regression fix in #742 ?

Re-opening as it looks like we had a regression in Npcap 1.83 where this older fix was accidentally left out :/.

Testing with 1.80, 1.81 or 1.82 might help to prove?

[gunnarhaslinger]

Re-Tested this issue with following versions:

• NPCAP 1.79 works fine
• NPCAP 1.80 works fine
• NPCAP 1.81 works fine
• NPCAP 1.82 works fine
• NPCAP 1.83 works fine
• NPCAP 1.84 problem exists
• NPCAP 1.85 problem exists

See Wireshark Issue: https://gitlab.com/wireshark/wireshark/-/issues/20828#note_2899106215

[gunnarhaslinger]

Wireshark Devs in https://gitlab.com/wireshark/wireshark/-/issues/20828 asked me to clarify that this issue is an NPCAP 1.84 and 1.85 Issue and not a Wireshark 4.6.0 issue. I can confirm this because same problem exists with old Wireshark 4.4.1 when using new NPCAP.

Wireshark Devs tell me it hangs in load_npcap_module
HMODULE module = LoadLibraryEx(wpath, NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR);

[guyharris]

Wireshark Devs tell me it hangs in load_npcap_module HMODULE module = LoadLibraryEx(wpath, NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR);

Hanging in wpcap.dll's DllMain()? In the attach code, it calls _PacketGetInfoPriv() trying to open a handle for the loopback device, in order to get the driver version information; could that be stuck waiting to be granted privileges to open that device, as Administrator privileges are required to open devices?

1.83's DllMain() just tries to get the information from the driver's code file; 1.84 calls _PacketGetInfoPriv() first.

Should there be a special NPF device that 1) can always be opened without Administrator privileges and 2) supports only ioctls to get information that it's safe to provide to unprivileged users and programs? (I think I may have suggested this elsewhere, to allow some stuff in tcpdump/Wireshark to work without privileges.)

[dmiller-nmap]

The issue was introduced in 801eb69, which used new capability of the Npcap driver to query the driver's version directly rather than loading it from the npcap.sys file's FileVersionInfo. In order to get a handle to the Npcap driver, _PacketGetInfoPriv() ends up in a code path that may attempt to launch the NpcapHelper.exe program if Npcap was installed in admin_only mode. Since that code uses ShellExecuteEx(), it cannot be run from DllMain() without causing a deadlock. The fix that was just pushed resolves the issue by retaining the FileVersionInfo method of obtaining the driver version during DllMain, but using the _PacketGetInfoPriv() method within the PacketGetDriverVersion() function in order to always obtain the correct version number of the running driver.

[gunnarhaslinger]

👍🎉 Thanks, great. Just installed the fresh released NPCAP 1.86 package, works - solved!