nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.99k stars 516 forks source link

Remove duplicate Npcap Loopback Adapters created by earlier Npcap versions #55

Open fyodor opened 5 years ago

fyodor commented 5 years ago

Npcap versions 0.95 through 0.995 had an uninstaller problem where they didn't always correctly remove the "Npcap Loopback Adapter" that the installer creates. So systems could collect extra versions, since each upgrade during that time would add a new one without deleting any. I found I had 23 and it was bogging down Nmap scan times and Wireshark adapter listing times, mostly because adapter listing is not currently very efficient (see issue nmap/nmap#1551 ). Npcap versions 0.996 and later properly remove the loopback adapter when they uninstall, but they don't (yet) remove any old duplicate adapters left by 0.95 and 0.995 uninstalls/upgrades. It would be nice to add a feature to the uninstaller to remove ALL old Npcap Loopback Adapters when detected rather than just the latest one. But it's not quite as easy as expected because the trick is finding the appropriate one by index or GUID. There are several different registries of adapters, and the one with the "Npcap Loopback Adapter" description isn't the one that NPFInstall currently uses to remove the adapter. So it's something like: go through all the adapters by description, finding the GUIDs of the ones we want to remove. Then go through all the adapters by index, finding the ones that match one of the guids we want to remove, and remove it.

IN THE MEANTIME, users can manually remove any old loopback adapters by opening device manager (press Windows key and type "device manager"), then expand the "Network adapters" item, then, if there is more than one "Npcap Loopback Adapter", right click on them each and choose "uninstall device". Then reinstall Npcap so you get a proper one recreated. If you only have one "Npcap Loopback Adapter" and you aren't having any problems with it, then no need to delete anything as you don't have extras.

dmiller-nmap commented 5 years ago

Npcap 0.996 introduces a fix in the installer to ensure the previous version's uninstaller is called. This does not remove the old, abandoned loopback adapters from prior upgrades, which should be removed manually until we can get an automated solution built into the installer.