Wireshark · Wireshark-dev: Re: [Wireshark-dev] Npcap 0.04 call for test

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

2015-09-01 17:23 GMT+02:00 Pascal Quantin <pascal.quantin@xxxxxxxxx>:

2015-09-01 3:19 GMT+02:00 Yang Luo <hsluoyb@xxxxxxxxx>:

Hi Pascal,

Thanks for this bug. This bug is because loopback flag in Npcap driver isn't set when the driver is paused and restarted (occurs when system resumes from sleep). I have fixed it.

Try lastest installer at:

https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.04-r9.exe

Hi Yang,

thanks for the updated driver. I just tested it on the Windows 7 x64 laptop that was having BSoD beginning of August and I can happily tell you that:

- it does not crash anymore and WiFi is working fine with Npcap installed

- loopback interface is still working after a suspend / resume

Thanks for your work and congratulation for your GSoC. I guess (hope?) it was considered as being successful :)

Hi Yang,

a small glitch I just noticed: you forgot to update the string used by Wireshark to get Ncap version (as seen in About Wireshark dialog box:). It reports "Npcap version 0.04 (packet.dll version 1.00), based on WinPcap version 4.1.3 (packet.dll version 4.1.0.3001), based on libpcap version 1.0 branch 1_0_rel0b (20091008)".

Pascal.

Pascal.

Cheers,

Yang

On Fri, Aug 28, 2015 at 4:17 AM, Pascal Quantin <pascal.quantin@xxxxxxxxx> wrote:

2015-08-25 12:00 GMT+02:00 Yang Luo <hsluoyb@xxxxxxxxx>:

Hi Guy,

Now PCAP_IF_LOOPBACK flag in pcap_if_t struct will be set for "Npcap Loopback Adapter" both for DLT_NULL mode and Fake Ethernet mode.

See Npcap 0.04 r8 at:

https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.04-r8.exe

Cheers,

Yang

Hi Yang,

I noticed an issue when running Npcap 0.4r8 with DLT_NULL option on my Windows 10 x64 host. After putting my laptop in standby mode and resuming my session, when launching Wireshark the Npcap loopback interface is no more working as expected:

- the capture is no more done with Null/Loopback encapsulation type, but with Ethernet type using a MAC address 02:00:4c:4f:4f:50

- pinging loopback address is no more captured

- when checking the interface characteristics with Wireshark GTK UI, the media supported is Ethernet instead of Null/Loopback

Rebooting the PC solves the issue. Any idea on how to investigate this?

You will find attached th corresponding DebugView log when launching Wireshark.

Cheers,

Pascal.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe