nmap / nmap/npcap

Rx-mode injection only works with REG_SZ (causes hangs); REG_MULTI_SZ does not inject as Rx

Open
#785 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
3.6k
Forks
592
PR merge metrics
No merged PRs in 30d

Description

Problem Summary

Npcap's Rx-mode injection behavior is inconsistent:

  • If SendToRxAdapters is added as REG_SZ with \Device\{GUID}, Rx-mode works (Wireshark sees it as Rx), but the script hangs (tested using Scapy's conf.L2socket with sendp()).
  • If SendToRxAdapters is added as REG_MULTI_SZ with the same \Device\{GUID} (1 line or multiple), no hang occurs, but the packet only goes out as Tx, not Rx.

This makes Rx-mode practically unusable in production environments where hanging is unacceptable.

Repro Steps
  1. Add registry key at: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters

  2. Set value:

  • REG_SZ: \Device\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} → works as Rx, but hangs.
  • REG_MULTI_SZ: same device name → no hang, but sends as Tx.
  1. Run Scapy script with:
    from scapy.all import sendp, Ether, IP, conf
    conf.iface = "Ethernet" # NIC matching the device GUID
    pkt = Ether()/IP(dst="8.8.8.8")
    sendp(pkt)

  2. Observe:
    REG_SZ: script in cmd hangs but appears in pktmon as Rx
    REG_MULTI_SZ: script in cmd completes, but appears in pktmon as Tx

Versions
Npcap: 1.79
Wireshark: 4.4.3
OS: Windows 11 Pro
Tested on multiple interfaces

Expected Behavior
REG_MULTI_SZ should behave the same as REG_SZ — allow Rx-mode injection without hangs.

Additional Notes
Documentation at v0.05-r7 changelog mentions semicolon-separated strings, but current behavior suggests inconsistency.
Using REG_SZ is not viable for production due to app hangs.

Please clarify if:
REG_MULTI_SZ is supposed to be supported for Rx
Any syntax (semicolon-separated or newline) is expected
\Device{GUID} is still required in latest versions

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue using the Npcap registry path under Services\npcap\Parameters, the REG_SZ and REG_MULTI_SZ values, Scapy's conf.L2socket/sendp() example, and pktmon observations. Check the v0.05-r7 changelog for the documented syntax; done means REG_MULTI_SZ supports the intended Rx injection without the REG_SZ hang.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.