search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
3.02k stars 519 forks source link

Upgraded Wireshark, Got Npcap, VPN connections stop working #112

Open DASCert opened 4 years ago

DASCert commented 4 years ago

As an infrequent user of Wireshark, when I ran the installed version a couple of days ago, I was prompted to upgrade to v3.2.2 from v2.4.4 on my Windows 8.1 x64 machine.

The upgrade recommended removing WinPCap (manually) and replacing it with Npcap .9986. After the obligatory reboot, I found that none of my Windows VPN connections worked any longer. When I clicked on "connect", Taskmgr showed explorer.exe as "not responding" and Device Manager listed all the associated Wan Miniport devices with exclamation marks and the status of "This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)" until the connection attempt timed out at which point Explorer started responding again and the Miniport devices all went back to hidden.

Uninstalling Npcap didn't help. Uninstalling Wireshark didn't help. Rebooting after the uninstalls didn't help, either. The only thing that got the functionality back was to do a System Restore to the previous day.

After the System Restore, I confirmed that all of the VPN connections were working again then tried reinstalling Wireshark. A reboot was required again and after the reboot I got exactly the same result - couldn't connect to any VPNs.

After another System Restore, and on the advice of Wireshark users, I reinstalled Wireshark but did not install npcap, opting instead for the original Winpcap. After another reboot, I confirmed that the VPN connections were all working and also that Wireshark was operating correctly. All good.

The version of npcap installed appears to have been bundled up with Wireshark and I notice that v.9989 is available. I reviewed the changelog between 9986 and 9989 but didn't notice anything directly related to this issue.

If there is more detail I can provide, let me know.

Regards

David Stafford

dmiller-nmap commented 4 years ago

The version of npcap installed appears to have been bundled up with Wireshark and I notice that v.9989 is available. I reviewed the changelog between 9986 and 9989 but didn't notice anything directly related to this issue.

Npcap 0.9988 removed a behavior that we believe was linked to malfunctioning VPN connections. Please upgrade and try again, and definitely let us know whether the issue is resolved. The related issues are nmap/nmap#1529 and nmap/nmap#1789.

DASCert commented 4 years ago

Installed Npcap 0.9899 and it killed all my VPN connections again. Looks like it prevents Remote Access Connection Manager (RasMan) service from starting.

System Log Entries:

Log Name: System Source: RasMan Date: 1/04/2020 4:07:07 PM Event ID: 20030 Task Category: None Level: Error Keywords: Classic User: N/A Computer: DAS004.das.local Description: Remote Access Connection Manager failed to start because it could not load one or more communication DLLs. Ensure that your communication hardware is installed and then restart the Remote Access Connection Manager service. If the problem persists, contact the system administrator. The system cannot find the file specified.

Log Name: System Source: Service Control Manager Date: 1/04/2020 4:07:07 PM Event ID: 7023 Task Category: None Level: Error Keywords: Classic User: N/A Computer: DAS004.das.local Description: The Remote Access Connection Manager service terminated with the following error: The system cannot find the file specified.

So, I'll uninstall npcap again, reboot and see if all returns to normal. If not, another system restore is on the way.

DASCert commented 4 years ago

Ok, so it required another system restore. This is getting a little tedious.

Any ideas?

dmiller-nmap commented 4 years ago

Does this issue still present when installing Npcap 0.9997 and deselecting (un-checking) the "Legacy loopback support" option? If so, please review this page of diagnostic and repair steps for the RasMan service. If the problem continues, please let us know.

rhampong commented 4 years ago

Still an issue with 0.9997. Those diagnostic and repair steps are fairly complicated with no guarantee of success. Might as well reinstall windows and all your programs from scratch.

rhampong commented 4 years ago

So I guess no one has any idea why it clobbers the Remote Access Connection Manager / VPN in the first place ?