search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.99k stars 516 forks source link

NPcap 0.08+(Compatible Mode) doesn't keep extra the same logic as <=0.07-r17 and WinPcap for pcap_open_live? #463

Closed yyjdelete closed 3 years ago

yyjdelete commented 8 years ago

In old version, pcap_open_live also accept name in pcap_findalldevs_ex style (rpcap://\Device\NPF_{AD3C70B4-453E-4D67-AC84-D7976DAD5503}). But in new version, only pcap_findalldevs style like \Device\NPF_{AD3C70B4-453E-4D67-AC84-D7976DAD5503} is accepted.

I found this due to an issue of SharpPcap, an WinPcap wrapper for dotNet.

I know the doc says that pcap_findalldevs/pcap_open_live and pcap_findalldevs_ex/pcap_open should be used in pair. But is the new behavior by design or mistake?

Sorry for my poor English.

hsluoyz commented 8 years ago

@guyharris, do you know this issue?

chmorgan commented 8 years ago

@hsluoyz does this look like something that will be fixed in npcap? I'd hate to work around it in Sharppcap given that it worked in the past with WinPcap's version of pcap_open_live(). What do you think?

hsluoyz commented 8 years ago

Hi @chmorgan @yyjdelete, please try the attached Npcap 0.08 r6.1. Does it fix your issue? If yes, I will make a public release.

npcap-0.08-r6.1.zip

chmorgan commented 8 years ago

I'll have to defer to @yyjdelete on testing. I'm a Linux guy and haven't used the remote capture feature before. @yyjdelete can you test with that updated release to see if it fixes the rpcap issue without the sharppcap work around?

yyjdelete commented 8 years ago

@hsluoyz It works for me.

hsluoyz commented 8 years ago

OK. This issue has been fixed in latest Npcap 0.08 r7: https://github.com/nmap/npcap/releases