search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.97k stars 514 forks source link

Upgrading from WinPcap to Npcap 0.99-r9 has multiple failures #369

Closed daulis closed 3 years ago

daulis commented 5 years ago

See related Wireshark bug: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15476 Wireshark relies on the Npcap installer to uninstall WinPcap so it seems like this issue is causing the Wireshark bug above.

OS: Windows 10, 1803. 64-bit

  1. Clean machine that did not have any previous versions of Wireshark, WinPcap, or Npcap.

  2. Install WinPcap 4.1.3 (https://www.winpcap.org/install/bin/WinPcap_4_1_3.exe)

  3. Rebooted, even though it did not prompt. Just to be safe.

  4. Install npcap-0.99-r9.exe (https://nmap.org/npcap/dist/npcap-0.99-r9.exe). Use default options.

  5. ERROR: "Error opening file for writing...". Retry doesn't work. Abort causes both Wireshark and Npcap installers to hang. Click Ignore. screenshot1

  6. "Failed to uninstall WinPcap; files in use by: .". Retry doesn't work. Ignore doesn't work. Abort. (See Screenshot2.png) screenshot2

  7. Then it says uninstalling WinPcap. screenshot3

  8. The rest of the installation works as expected.

daulis commented 5 years ago

Looks like the problem was introduced in 0.99-r8. I upgrading from WinPcap to Npcap 0.99-r7, and everything worked as expected.

daulis commented 5 years ago

Test these configurations, and the problem affects them all:

  1. Windows 10 Home, v1803
  2. Windows 10 Pro, v1803
  3. Windows 10 Enterprise, v1703
daulis commented 5 years ago

If you uncheck "Install Npcap in WinPcap API-compatible Mode", then you don't see the issue. But, having that checked is the default, so most users will experience this problem when upgrading.

daulis commented 5 years ago

More notes:

  1. Going from WinPcap to 0.99-r7, then 0.99-r7 to 0.99-r9 doesn't trigger the issue. Going directly from WinPcap to 0.99-r9 does trigger the issue.
  2. Attached install log files. install.log NPFInstall.log
daulis commented 5 years ago

The first error is that it can't write a file inside C:\Program Files\Npcap. It looks like Npcap doesn't create the folder first, before it tries to create the file, when installing from WinPcap to Npcap. It seems to work fine if you install Npcap without WinPcap previously installed.

When upgrading from WinPcap to Npcap:

This is an issue for Wireshark, because Wireshark 2.x uses WinPcap by default, the upcoming Wireshark 3.0 will install Npcap by default. So, most Windows 10 users would encounter this issue when upgrading (unless Wireshark packages an Npcap installer with the fix)

Note: I have not tested on Windows 7

dmiller-nmap commented 5 years ago

Thanks for the detailed error report. I think I know why this is happening: we added some code to the installer to kill processes using WinPcap before running the WinPcap uninstaller, but as you noted, it needs to write and run the NPFInstall2.exe executable to do so. I think that at the point where the code was inserted, the Npcap install has not started, so the installation directory potentially doesn't exist. I'll change this to either extract NPFInstall2.exe to a random temp directory first or ensure that the installation directory is created first.

pquantin commented 5 years ago

Hi Dan,

Any chance to release a 0.99-r10 soon? We are about to release Wireshark 3.0 release candidate and I would like to package this version if possible.