nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
3k stars 516 forks source link

Packet drops with USB (Gigabit) Ethernet adapter with ASIX chipset #172

Open JasMan78 opened 4 years ago

JasMan78 commented 4 years ago

Hi,

I've bought a USB 3.0 10/100/1000 Ethernet adapter with AX88179 chipset from UGREEN to capture packets with Wireshark 3.2.3/3.2.4 on my Win10 client.

When I did the first capture I realized that there are a lot of "Previous segment not captured" messages in different TCP streams. So I started a second capture on the client side interface to compare them both. The capture of the client sides interface had no lost packets, but the capture of the USB adapter showed about 200 "Previous segment not captured" messages in one minute of 200 kbit/s traffic.

To verify that the adapter has no hardware defect, I tried some other adapters:

All of them are having the same issue. I've already did the following troubleshootings without success:

Now I'm not sure if this is an issue with ASIX chipset in general, or something with npcap. I'm also wondering why I haven't found any other reports related to this behaviour. Is it me only?

DiagReport-20200522-161455.txt

Gl0 commented 4 years ago

Not sure if it is the same issue or not, but a lot of our users are suffering from missing packets in captured stream. One of them provided a wireshark dump, it is full of "Previous segment not captured", "TCP ACKed unseen segment" and TCP retransmissions. Dump summary also states that there is 0 lost packets. dump He is using Realtek RTL8111G on windows 10 2004. May be related to recent windows update.

Looking at our logs, it usually miss the same packets on each new session, and often the same packets for different users.

After switching from npcap to win10pcap issue is gone and dump is clear, so there is definitely something wrong with npcap.

dmiller-nmap commented 4 years ago

We have made a lot of changes related to statistics (dropped/received counters) and performance in Npcap 0.9997. Please test with that version and let us know if this issue persists. Thanks!

JasMan78 commented 4 years ago

After a first short test I can confirm that's better now, but not completly solved. I still see single lost frames, but not hundreds as before. In the meantime I bought an TP-Link UE300 adapter with RTL8153 chipset and that one works fine. Until now I havn't seen any lost frame with this adapter. This issue has been solved for me by buying an new adapter, but I can support you with further tests of course. Anyway, I appreciate your efforts.