Wireshark · Wireshark-dev: Re: [Wireshark-dev] Npcap 0.03 call for test

[Tyson Key <tyson.key@xxxxxxxxx>]

Hi Yang,

Thanks for looking into this. 

I can't remember when/how I installed Win10PCap (guessing that I briefly had a look, but couldn't get it to do anything on my machine, and just removed it), but I'm using VMware Player 6.0.7 build-2844087 (haven't got Workstation/Server installed); and I tried a dance of upgrading/downgrading/upgrading my AR9485WB-EG WLAN driver (first by downloading the package from http://support.lenovo.com/us/en/downloads/ds032333, to take me from 10.0.0.242, to 10.0.0.75; and then using Device Manager's driver update function, to take me to 3.0.1.155 (which I'm guessing is probably older than 242 - I'm just guessing from the sketchy build dates) - which gave me a different type of BSoD, initially, after starting Wireshark, but let me capture traffic for a little while, after rebooting.

Here's all of the MiniDump summaries that I could find:

==================================================

Dump File         : 072715-31968-01.dmp

Crash Time        : 27/07/2015 07:02:32 pm

Bug Check String  : SYSTEM_SERVICE_EXCEPTION

Bug Check Code    : 0x0000003b

Parameter 1       : 00000000`c0000005

Parameter 2       : fffff801`1be5d485

Parameter 3       : ffffd000`2324e980

Parameter 4       : 00000000`00000000

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+150ca0

File Description  : NT Kernel & System

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 6.3.9600.17736 (winblue_r9.150322-1500)

Processor         : x64

Crash Address     : ntoskrnl.exe+150ca0

Stack Address 1   : 

Stack Address 2   : 

Stack Address 3   : 

Computer Name     : 

Full Path         : C:\WINDOWS\Minidump\072715-31968-01.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 281,520

Dump File Time    : 27/07/2015 07:03:33 pm

==================================================

==================================================

Dump File         : 072715-32078-01.dmp

Crash Time        : 27/07/2015 06:47:01 pm

Bug Check String  : BAD_POOL_CALLER

Bug Check Code    : 0x000000c2

Parameter 1       : 00000000`00000099

Parameter 2       : ffffe000`7d4b31b8

Parameter 3       : 00000000`00000000

Parameter 4       : 00000000`00000000

Caused By Driver  : tcpip.sys

Caused By Address : tcpip.sys+42856

File Description  : TCP/IP Driver

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 6.3.9600.16384 (winblue_rtm.130821-1623)

Processor         : x64

Crash Address     : ntoskrnl.exe+150ca0

Stack Address 1   : 

Stack Address 2   : 

Stack Address 3   : 

Computer Name     : 

Full Path         : C:\WINDOWS\Minidump\072715-32078-01.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 281,520

Dump File Time    : 27/07/2015 06:48:04 pm

==================================================

==================================================

Dump File         : 072715-32468-01.dmp

Crash Time        : 27/07/2015 06:34:37 pm

Bug Check String  : SYSTEM_SERVICE_EXCEPTION

Bug Check Code    : 0x0000003b

Parameter 1       : 00000000`c0000005

Parameter 2       : fffff801`962a446e

Parameter 3       : ffffd001`1bd0f980

Parameter 4       : 00000000`00000000

Caused By Driver  : ndis.sys

Caused By Address : ndis.sys+546e

File Description  : Network Driver Interface Specification (NDIS)

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 6.3.9600.16384 (winblue_rtm.130821-1623)

Processor         : x64

Crash Address     : ntoskrnl.exe+150ca0

Stack Address 1   : 

Stack Address 2   : 

Stack Address 3   : 

Computer Name     : 

Full Path         : C:\WINDOWS\Minidump\072715-32468-01.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 281,520

Dump File Time    : 27/07/2015 06:35:48 pm

==================================================

==================================================

Dump File         : 072715-33859-01.dmp

Crash Time        : 27/07/2015 05:11:25 pm

Bug Check String  : BAD_POOL_CALLER

Bug Check Code    : 0x000000c2

Parameter 1       : 00000000`00000007

Parameter 2       : 00000000`00001200

Parameter 3       : 00000000`00000000

Parameter 4       : ffffe000`8d01cbf8

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+150ca0

File Description  : NT Kernel & System

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 6.3.9600.17736 (winblue_r9.150322-1500)

Processor         : x64

Crash Address     : ntoskrnl.exe+150ca0

Stack Address 1   : 

Stack Address 2   : 

Stack Address 3   : 

Computer Name     : 

Full Path         : C:\WINDOWS\Minidump\072715-33859-01.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 281,520

Dump File Time    : 27/07/2015 05:12:34 pm

==================================================

==================================================

Dump File         : 072715-48062-01.dmp

Crash Time        : 27/07/2015 05:00:25 pm

Bug Check String  : BAD_POOL_CALLER

Bug Check Code    : 0x000000c2

Parameter 1       : 00000000`00000007

Parameter 2       : 00000000`00001200

Parameter 3       : 00000000`00000000

Parameter 4       : ffffe000`4bc1b4c8

Caused By Driver  : ntoskrnl.exe

Caused By Address : ntoskrnl.exe+150ca0

File Description  : NT Kernel & System

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 6.3.9600.17736 (winblue_r9.150322-1500)

Processor         : x64

Crash Address     : ntoskrnl.exe+150ca0

Stack Address 1   : 

Stack Address 2   : 

Stack Address 3   : 

Computer Name     : 

Full Path         : C:\WINDOWS\Minidump\072715-48062-01.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 9600

Dump File Size    : 281,520

Dump File Time    : 27/07/2015 05:01:58 pm

==================================================

Frustratingly, since there are so many variables involved (unscientific method!), it seems like I'm playing a Jenga game with trying to make this work, since if I remove, or change something, it works for a little while, and then crashes in a creative, new way. (And I don't want to reinstall everything, since I don't have a disk big enough to back everything up). :(

I've uploaded a copy of the Nurago Web Meter to https://dl.dropboxusercontent.com/u/670345/nurago%20web%20meter.exe, and I seem to also have an older installer for it in my "Downloads" directory, which may exercise the LSP architecture of WinSock differently.

The SYSTEM_SERVICE_EXCEPTION error is interesting, as it is one of the few that reveals a problem in WinSock/NDIS...

I would try it in a virtual machine - but it wouldn't get us any closer to diagnosing why it fails to work, with my not-so-unique configuration.

Tyson.

2015-07-28 7:27 GMT+01:00 Yang Luo <hsluoyb@xxxxxxxxx>:

On Mon, Jul 27, 2015 at 10:42 PM, Tyson Key <tyson.key@xxxxxxxxx> wrote:

After rebooting from uninstalling MS NetMon, I restarted Wireshark, and got the usual "NPF service not running; no interfaces available" note. This persists, even if I try "NPFInstall -r", and Wireshark still claims that no interfaces are available. 

"NPFInstall -r" isn't used in Npcap. "NPF service not running; no interfaces available" is a common problem for Npcap previous versions. And I think it should disappear if you have uninstalled previous versions totally.

 

Eventually, after uninstalling NPCap, removing all of the loopback interfaces, and running CCleaner to remove any residual registry data, and then rebooting yet again, I could start Wireshark, and list the installed interfaces - but unsurprisingly, a few moments later, I received another BSoD.

If it helps, my Wireshark version is:

Version 1.99.8-492-g3f0f49d (v1.99.8rc0-492-g3f0f49d from master)

Copyright 1998-2015 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.

License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>

This is free software; see the source for copying conditions. There is NO

warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.12.16, with Pango 1.36.8, with

WinPcap (unknown), with libz 1.2.8, with GLib 2.42.0, with SMI 0.4.8, with

c-ares 1.9.1, with Lua 5.2, with GnuTLS 3.2.15, with Gcrypt 1.6.2, with MIT

Kerberos, with GeoIP, with PortAudio V19-devel (built Jul 22 2015), with

AirPcap.

Running on 64-bit Windows 8.1, build 9600, with locale English_United

Kingdom.1252, with Npcap version 0.01 (packet.dll version 0.03), based on

WinPcap version 4.1.3 (packet.dll version 4.1.0.3001), based on libpcap version

1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.2.15, with Gcrypt 1.6.2, without

AirPcap.

AMD A6-5200 APU with Radeon(TM) HD Graphics     (with SSE4.2), with 5577MB of

physical memory.

Built using Microsoft Visual C++ 12.0 build 31101

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

I used Wireshark latest stable version: Version 1.12.6 (v1.12.6-0-gee1fce6 from master-1.12). But I don't think it makes a difference by using stable version or development version, as its WinPcap related low-level code rarely changed between these two versions.

 

Other than NetMon (which I've removed), the only other things that I think could be causing a conflict are either the VMware host-only networking filters; the networking components included with whatever Bluetooth stack Lenovo shipped; the massive pile of hacks installed by the Gacela component of "Nurago Web Meter", or my Atheros WLAN drivers (which caused Acrylic Wi-Fi's NDIS filters to crash, when I briefly had that installed, a while ago).

What version VMware are you using? Workstation or just Player? I used VMware Workstation 11.1.2 build-2780323 on my host, but I didn't install it on my test VM yet.

 

Cheers,

Yang

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

--

                                          Fight Internet Censorship! http://www.eff.org
http://vmlemon.wordpress.com | Twitter/FriendFeed/Skype: vmlemon | 00447934365844