search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
3.02k stars 519 forks source link

Npcap: Suspending Windows interrupts network #63

Open dmiller-nmap opened 5 years ago

dmiller-nmap commented 5 years ago

Reported here: https://seclists.org/nmap-dev/2019/q1/89

On a Windows 10 laptop with VMware Workstation Pro 14.1.6, Npcap is running on the host OS but not on the Windows 10 VM. User suspends the VM, then hibernates the laptop. On wakeup, the VM has no network access until Npcap is uninstalled. Host OS is not affected.

Reported as affecting 0.99-r8 through 0.992.

dmiller-nmap commented 5 years ago

In my testing, Hyper-V was not affected. Will need to perform additional testing on VMware. Additionally, I would like to see whether Driver Verifier produces any bugchecks on affected systems.

hdm commented 5 years ago

I noticed this once without the suspend/hibernate cycle on a Windows 10 VM. I removed old WinPcap (from a Wireshark install), then installed npcap v0.99-r2, and all network interfaces went missing. Uninstalling npcap fixed this. It might have happened once more during testing, but a restart of the driver seemed to fix it, and it hasn't come up again recently.