search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.99k stars 516 forks source link

Npcap Bug Report #651

Open FirasTaha-d opened 1 year ago

FirasTaha-d commented 1 year ago

Hi , I have a question regarding to NPCAP/WIN10PCAP. We have a wire connection between our application(UI) and Embedded system . Which they sent to each other real time packets ( data ) via NPCAP. it is working fine when the cable connected in both sides; ( embedded side , UI side ) with Ethernet 1Gbs adapters.

The problem is that the connection does not work when the application(UI) sends/receives packets via 2.5Gbs Ethernet Adapter while the Embedded ethernet adapter is 1Gbs. it works only if both NPCAP+Win10Pcap are downloaded. So with Win10Pcap+Npcap together the specific scenario is working.

The question is: why do we need to download also Win10Pcap to make the specific scenario working? What is the relationship between Win10Pcap and 2.5Gbs adapter?

We hope you will reply as soon as possible because our project is stuck in this issue.

Thank you in advance. Firas.

dmiller-nmap commented 1 year ago

Thanks for reporting this. There are a few reasons why installing Win10Pcap might enable your application to communicate:

  1. Win10Pcap is a NDIS 6.20 Protocol Driver, so when it is installed, the NDIS stack is limited to NDIS 6.20 (Windows 7) features. This means no packet coalescing (RSC) among other changes and enhancements. However, if there is some component in the stack that functions correctly under NDIS 6.20 and not under NDIS 6.50 (the version Npcap uses for Windows 10 and later), then this might be hiding the issue.
  2. Since Npcap is a NDIS filter driver (LWF), it is set up in the stack between the miniport and the protocol drivers. If there are no protocol drivers installed (e.g. TCPIP.sys), NDIS may not be activating Npcap or passing any traffic from the miniport. Installing Win10Pcap's protocol driver would resolve this issue, but so would installing TCPIP.sys (i.e. "Internet Protocol version 4 (TCP/IPv4)" in the adapter properties dialog).

Can you describe more what you mean by "the connection does not work" with the 2.5GBps adapter? Does your application see any packets at all? Are packets sent but not received or received but not sent? Do you have indication of packet drops (i.e. pcap_stats() shows dropped packets) or resource limits being reached?

Please also include DiagReport output from the affected system.