No Promiscuous mode with I219-LM with VLAN enabled
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
With npcap 1.70 thru 1.75, I can't receive any frames addressed to unicast MAC addresses other than NIC's own address.
Unlike in the other issues about promiscuous mode, I don't get any error messages, and I can capture "my own" frames as well as multicast frames just fine. But "someone else's" frames are neither received by wireshark nor by pypcap or our own code compiled against the npcap SDK.
With npcap 1.60 and earlier, it works just fine.
I have some VLANs configured in Intel ProSet, and on the machine where the problem occurs, I can't disable them without some major rewiring. But on a different machine featuring the same NIC model, Windows version, and NIC driver version, but with no VLANs set up, I can receive "someone else's" Ethernet frames as expected in promiscuous mode, even with npcap 1.75. So the issue seems very much connected to ProSet's VLAN feature.
Unfortunately, attaching to the trunk interface and handling VLAN in software is not really an option, not just because as soon as we set up multiple VLANs in ProSet (which is required because some software needs access to different VLANs using ordinary Windows Sockets), the NPCAP driver is no longer allowed to bind to trunk adapter (the checkbox gets reset to unckecked upon confirming the dialog), but also because it would break existing setups.
Enabling Intel's MonitorMode does not fix the issue.
To Reproduce
Steps to reproduce the behavior:
- Set up some VLANs in Intel ProSet
- Open Wireshark and start capturing on one of the virtual Interfaces created in Step 1
- Ensure some packets addressed to a unicast MAC different from the NIC's are on the wire
- Take note of their conspicuous absence
Expected behavior
These packets should show up in Wireshark, like they do with npap 1.60 (and no other changes)
Screenshots
Diagnostic information
- Windows 10 22H", OS Build 19045.2965
- Intel I219-LM NIC, Driver 12.19.2.45
- DiagReport-20230606-133227.txt
- install.log
- Multiple VLANs are configured in Intel ProSet, as described above and shown in the Screenshot
Additional context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the capture on a VLAN virtual interface in Wireshark with an I219-LM and compare npcap 1.60 against 1.70–1.75. Review the attached diagnostic and install logs, then investigate the npcap SDK capture path used by Wireshark, pypcap, and the reported application. Done means unicast frames for other MAC addresses are captured with Intel ProSet VLANs enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100