nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.99k stars 516 forks source link

Problem with npcap, service won't install ! #690

Open CoCoNutsOo opened 1 year ago

CoCoNutsOo commented 1 year ago

Describe the bug Hello everyone, I have a problem, I can't use Wireshark, because npcap doesn't install its services : I have no errors when installing npcap, either through the installer on the site, or through the auto install when I installed wireshark...

To Reproduce Steps to reproduce the behavior:

  1. When I want to use Wireshark, it informs me that I don't have a capture device, and that I need to start the services with "net start npcap" if Npcap is installed or "net start npf".
  2. I get errors when I try to do these commands in a terminal as an administrator. And the command "sc query npcap" informs me that there is no service with this name.

Expected behavior I can't use Wireshark because I can't install the npcap service.

WindowsTerminal_xq3rcvUxCk Screenshots

Wireshark_KaeS3Px2qn

Diagnostic information

Thank you in advance for your help ! Kind regards.

CoCoNutsOo commented 1 year ago

setupapi.dev.log I can't find any errors during installation in the logs.

CoCoNutsOo commented 1 year ago

I had the idea to launch Windows in "safe" mode; I uninstalled Wireshark and NPCAP; I then (still in "safe" mode reinstall); I restarted Windows normally and no problem the npcap service works normally and Wireshark (well after 40 requests for admin perms, works correctly (I'm not kidding)). WindowsTerminal_KcQElecjaW Wireshark_8I0eo6IFS6

de-served commented 1 year ago

Same boat here but can't fix it with >50 uninstalls, reinstalls, sfc /scannow, Dism ... /RestoreHealth, clearing %TEMP%, removing service from registry before uninstall, checking service after uninstall (in ton of combinations of this options or without them) - but always "sc query npcap" "service is not installed". After installation of npcap Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap tree have no "ImagePath" or anything else except "Start" key and "Parameters" subtree:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap]
"Start"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters]
"LoopbackSupport"=dword:00000001
"DltNull"=dword:00000001
"Edition"="Npcap"
"AdminOnly"=dword:00000000
"Dot11Support"=dword:00000000
"VlanSupport"=dword:00000000
"WinPcapCompatible"=dword:00000000

Install.log part with service installing:

File: skipped: "C:\TEMP\nsoD0A6.tmp\nsExec.dll" (overwriteflag=1)
DetailPrint: The npcap service was successfully created
Jump: 1562
DetailPrint: Writing service options to registry
Call: 1571
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap" "Start"="0x00000001"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "LoopbackSupport"="0x00000001"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "DltNull"="0x00000001"
WriteRegStr: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "Edition"="Npcap"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "AdminOnly"="0x00000000"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "Dot11Support"="0x00000000"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "VlanSupport"="0x00000000"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters" "WinPcapCompatible"="0x00000000"
Call: 1630
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap" "Start"="0x00000001"
WriteRegDWORD: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap_wifi" "Start"="0x00000004"
Call: 1622
DetailPrint: Starting the npcap driver
Call: 1942
SetFlag: 13=6
File: overwriteflag=1, allowskipfilesflag=0, name="C:\TEMP\nsoD0A6.tmp\nsExec.dll"
File: skipped: "C:\TEMP\nsoD0A6.tmp\nsExec.dll" (overwriteflag=1)
Jump: 1810

I've tested wiresharkportable with npcap 1.76 installed separately and tested wireshark installation with included npcap 1.71. Nothing changed.

Once wireshark was working is was yesterday when I've started Portable wireshark, it ask me to download and install npcap, I've installed it, found that it is installed to default path without asking me where I want be it installed then today I've read how to install to a different directory, uninstalled npcap, installed with /D=Path option, started wireshark and... "try to run net start npcap" and then my challenge started. I've uninstalled npcap, installed it again without /D option - no luck, uninstalled, checked registry for npcap's, installed again and my install-uninstall game stuck at no solution path.

PS: finally I've installed it. https://github.com/nmap/npcap/issues/673#issuecomment-1704650714