Failure to Capture Virtual Adapter - winpcap can capture but npcap does not
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Older versions of wireshark and winpcap can capture traffic for a VPN adapter Citrix provides with their Citrix Gateway product, the newer versions show the adapter as being selectable but it captures no traffic using npcap
To Reproduce
Steps to reproduce the behavior:
- Use Wireshark Version 4.2.5 (v4.2.5-0-g4aa814ac25a1) and Npcap version 1.78
- Run as administrator
- Select the Citrix Virtual Adapter to capture traffic
- Observe a lack of packets being captured
- Use Wireshark Version 4.0.8 and winpcap 4.1.3
- run as administrator
- Select the citrix virtual adapter to capture traffic
- observe traffic captured
Expected behavior
Traffic should be displayed and captured in the newer versions of wireshark and npcap
Screenshots
No traffic
traffic with older version and winpcap 4.1.3
Diagnostic information
-
Windows version from
winver(e.g. Windows 11 Version 21H2, OS Build 22000.795)
Version 22H2 (OS Build 19045.4412) -
Output of DiagReport
DiagReport-20240530-095347.txt -
Any special hardware or software that may be relevant: VPN, firewall, antivirus, virtualization (SR-IOV passthrough, etc).
Citrix Gateway Plug-in version 20.11.3.1
Additional context
Updated wireshark info
Version 4.2.5 (v4.2.5-0-g4aa814ac25a1).
Copyright 1998-2024 Gerald Combs gerald@wireshark.org and contributors.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.37, build 32822), with GLib 2.78.0, with Qt 6.5.3, with libpcap, with zlib 1.3.0, with PCRE2, with Lua 5.2.4 (with UfW patches), with GnuTLS 3.8.4 and PKCS #11 support, with Gcrypt 1.10.2-unknown, with Kerberos (MIT), with MaxMind, with nghttp2 1.61.0, with nghttp3 1.0.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.11.5, with libsmi 0.5.0, with QtMultimedia, with automatic updates using WinSparkle 0.8.0, with AirPcap, with Minizip, with binary plugins.
Running on 64-bit Windows 10 (22H2), build 19045, with 11th Gen Intel(R) Core(TM) i9-11950H @ 2.60GHz (with SSE4.2), with 31953 MB of physical memory, with GLib 2.78.0, with Qt 6.5.3, with Npcap version 1.78, based on libpcap version 1.10.4, with PCRE2 10.42 2022-12-11, with c-ares 1.27.0, with GnuTLS 3.8.4, with Gcrypt 1.10.2-unknown, with nghttp2 1.61.0, with nghttp3 1.0.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard 1.5.2, without AirPcap, with dark display mode, without HiDPI, with QPA plugin "windows", with LC_TYPE=English_United States.utf8, binary plugins supported.
Wireshark 4.0.8 info
Version 4.0.8 (v4.0.8-0-g81696bb74857).
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.36, build 32537),
with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap,
with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with
Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0.8.0, with AirPcap, with
SpeexDSP (using bundled resampler), with Minizip, with binary plugins.
Running on 64-bit Windows 10 (22H2), build 19045, with 11th Gen Intel(R)
Core(TM) i9-11950H @ 2.60GHz (with SSE4.2), with 31953 MB of physical memory,
with GLib 2.72.3, with PCRE2 10.40 2022-04-14, with Qt 5.15.2, with WinPcap
version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0
branch 1_0_rel0b (20091008), with c-ares 1.18.1, with GnuTLS 3.6.3, with Gcrypt
1.10.1, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard
1.5.2, without AirPcap, with light display mode, without HiDPI, with
LC_TYPE=English_United States.utf8, binary plugins supported.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing DiagReport-20240530-095347.txt and install.log, then compare the Npcap 1.78 behavior with the reported WinPcap 4.1.3 behavior for the Citrix Virtual Adapter. Reproduce the capture on the stated Windows and Citrix Gateway versions; done means packets are captured from that adapter with the newer Npcap setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100