npcap v1.10 blocks VM network (VNET1) on Windows 10 until 2nd tracing with Wireshark is started

phunsoft commented 3 years ago

Environment is

Thinkpad X1 Carbon with 16GB RAM
Windows 10 Pro (1909)
VMWare Workstation 15.5
Archlinux as VMWare guest connected via "Host only network" (VNET1 adapter), IP4 192.168.111.0/24 and host IP 192.168.111.111
Wireshark 3.4.2
npcap V1.10
(previously WinPCap V4.1.3)

This all worked fine until I changed from WinPCap 4.1.3 to npcap 1.10. Since changing to npcap, the Archlinux VMWare guest cannot be reached from the Windows host until Wireshark is started and a trace of the VNET1 adapter is started twice!

I uninstalled npcap and reinstalled WinPCap, and everthing works as desired. Then uninstall WinPCap, and install npcap again, and the problem is back. So it is definitely a problem with npcap.

Some more details:

The Archlinux guest is suspended, then restarted. So it is not shutdown across (re-)installs, or Windows reboots.
A ping to Archlinux (192.168.111.111) succeeds in every scenartio with WinPCap, but is blocked (timeout) with npcap.
Tracing the WLAN adapter with Wireshark works but does not help the VNET1 network.
Tracing the VNET1 adapter with Wireshark does not help the VNET1 network. The pings are not seen in the trace,
Stopping the VNET1 trace and starting a second time resolves the network problem. Pings are now seen in Wireshark, and pings are now responded by Archlinux guest.
Connection to Archlinux guest thereafter succeeds even without Wireshark running, until Windows is rebooted.
Accessing the internet from Windows works in any case, so the problem seems to occur with the virtual adapter(s), only.
I tried both, installing npcap in "WinPcap API-compatible mode", and in non-compatible mode. No difference.

Is there anything I can do?

I'm going to reinstall WinPcap for the time being, but will of course try out whatever you suggest, and will send more docmentation upon request.

TIA Peter

phunsoft commented 3 years ago

It was suggested to manually copy npcap.sys to the windows/system32/drivers folder to recolve the issue. However, the file was already there, so the installation routine copied it as requested.

My issue is still open

sky5454 commented 3 years ago

Reset the aptaper VMware Network Adapter VMnet1 and try again. If it succeeds, then maybe the same problem

dias-yelgonov commented 3 years ago

Many people come here to talk/report about that problem. I mentioned that problem since 0.9.0 release. They don't care about it. When you reboot or pc/net adapter(vmnet) or start capturing the traffic on that adapter - only after that VMs will be reachable. You can shutdown your pc - and the issues will appear again. I thought at the beginning the problem was somewhere in Windows Updates or Vmware WS updates. But the problem is only in Npcap. Strongly recommend do not use it.

phunsoft commented 3 years ago

Many people come here to talk/report about that problem. I mentioned that problem since 0.9.0 release. They don't care about it. When you reboot or pc/net adapter(vmnet) or start capturing the traffic on that adapter - only after that VMs will be reachable.

Yeah, and what other adverse things might happen. I understand its freeware, but nevertheless I would expect some kind of reaction from the developers. To bad Wireshark is recommending npcap over WinPCap.

But the problem is only in Npcap. Strongly recommend do not use it.

Exactly what I do. I don't miss a thing with WinPCap.

dias-yelgonov commented 3 years ago

Many people come here to talk/report about that problem. I mentioned that problem since 0.9.0 release. They don't care about it. When you reboot or pc/net adapter(vmnet) or start capturing the traffic on that adapter - only after that VMs will be reachable.

Yeah, and what other adverse things might happen. I understand its freeware, but nevertheless Iwould expect some kind of reactin from the developers. To bad Wireshark is recommending npcap over WinPCap.

But the problem is only in Npcap. Strongly recommend do not use it.

Exactly what I do. I don't miss a thing with WinPCap.

Yes, and one more sad thing for me is that Win10Pcap has been inactive since 2016. And the error with npcap is repeated only on the host machine, inside the VM it was not possible to repeat the error.

phunsoft commented 3 years ago

I had some troubles when I tried Win10PCap (can't remember right now what is was). I have the elder WinPCap 4.1.3, and this is all I need (until some Win10 update renders it useless).

gvanem commented 3 years ago

(until some Win10 update renders it useless).

Renders WinPcap usesless? I have used WinPcap since 2002 on Win-XP -- Win-10 and have never seen Win-update messing with WinPcap.

phunsoft commented 3 years ago

(until some Win10 update renders it useless).

Renders WinPcap usesless? I have used WinPcap since 2002 on Win-XP -- Win-10 and have never seen Win-update messing with WinPcap.

I didn't say it will happen, and I hope it never will (and I had better said "non-functional" than "useless").

nmap / npcap

npcap v1.10 blocks VM network (VNET1) on Windows 10 until 2nd tracing with Wireshark is started #278