nmap / nmap/npcap

No Promiscuous mode with I219-LM with VLAN enabled

Open
#677 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
3.6k
Forks
592
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
With npcap 1.70 thru 1.75, I can't receive any frames addressed to unicast MAC addresses other than NIC's own address.

Unlike in the other issues about promiscuous mode, I don't get any error messages, and I can capture "my own" frames as well as multicast frames just fine. But "someone else's" frames are neither received by wireshark nor by pypcap or our own code compiled against the npcap SDK.

With npcap 1.60 and earlier, it works just fine.

I have some VLANs configured in Intel ProSet, and on the machine where the problem occurs, I can't disable them without some major rewiring. But on a different machine featuring the same NIC model, Windows version, and NIC driver version, but with no VLANs set up, I can receive "someone else's" Ethernet frames as expected in promiscuous mode, even with npcap 1.75. So the issue seems very much connected to ProSet's VLAN feature.

Unfortunately, attaching to the trunk interface and handling VLAN in software is not really an option, not just because as soon as we set up multiple VLANs in ProSet (which is required because some software needs access to different VLANs using ordinary Windows Sockets), the NPCAP driver is no longer allowed to bind to trunk adapter (the checkbox gets reset to unckecked upon confirming the dialog), but also because it would break existing setups.

Enabling Intel's MonitorMode does not fix the issue.

To Reproduce
Steps to reproduce the behavior:

  1. Set up some VLANs in Intel ProSet
  2. Open Wireshark and start capturing on one of the virtual Interfaces created in Step 1
  3. Ensure some packets addressed to a unicast MAC different from the NIC's are on the wire
  4. Take note of their conspicuous absence

Expected behavior
These packets should show up in Wireshark, like they do with npap 1.60 (and no other changes)

Screenshots
ProSet_VLAN

Diagnostic information

  • Windows 10 22H", OS Build 19045.2965
  • Intel I219-LM NIC, Driver 12.19.2.45
  • DiagReport-20230606-133227.txt
  • install.log
  • Multiple VLANs are configured in Intel ProSet, as described above and shown in the Screenshot

Additional context

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the capture on a VLAN virtual interface in Wireshark with an I219-LM and compare npcap 1.60 against 1.70–1.75. Review the attached diagnostic and install logs, then investigate the npcap SDK capture path used by Wireshark, pypcap, and the reported application. Done means unicast frames for other MAC addresses are captured with Intel ProSet VLANs enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.