search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.92k stars 508 forks source link

npcap truncates captured frames #483

Closed sindy39 closed 3 years ago

sindy39 commented 8 years ago

Hello,

I've given a try to npcap-nmap-0.06-r7 downloaded from here as an installer (I am unable to compile from source) as a replacement (i.e. no coexistence mode) to WinPcap 4.1.3 which came along with Wireshark 2.0.2. My OS is a 64-bit Win10 (Czech language version and a result of upgrade from Win 7 if that may matter).

Issue number 1 is as described in the subject: while capturing on a wireless adaptor, regardless whether promiscuous mode is enabled or not (I know that it makes little difference for wireless adapters on Windows), the captured length of all frames is shorter than the length "on the wire" (in Wireshark display filter syntax, frame.cap_len < frame.len). For most, yet not all, frames the captured length is 16 bytes. This makes npcap unusable for most purposes.

I could not try on wired Ethernet due to factors I'll clarify in another Issue.

The capture length set in Wireshark's interface configuration window is shown as "default", if you double-click it, it says 65535. Change to some other value (like e.g. 2000) does not change the behaviour.

What additional information do you need from me to help identify the issue?

hsluoyz commented 8 years ago

Hi Pavel,

This issue is like: https://github.com/nmap/nmap/issues/335.

You have unusual malformed packets. Like truncates or additional header bytes. I think these two issues are owing to the same cause. So I will only track that issue for now.