Rx-mode injection only works with REG_SZ (causes hangs); REG_MULTI_SZ does not inject as Rx
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
Problem Summary
Npcap's Rx-mode injection behavior is inconsistent:
- If
SendToRxAdaptersis added asREG_SZwith\Device\{GUID}, Rx-mode works (Wireshark sees it as Rx), but the script hangs (tested using Scapy'sconf.L2socketwithsendp()). - If
SendToRxAdaptersis added asREG_MULTI_SZwith the same\Device\{GUID}(1 line or multiple), no hang occurs, but the packet only goes out as Tx, not Rx.
This makes Rx-mode practically unusable in production environments where hanging is unacceptable.
Repro Steps
-
Add registry key at: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters
-
Set value:
- REG_SZ:
\Device\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}→ works as Rx, but hangs. - REG_MULTI_SZ: same device name → no hang, but sends as Tx.
-
Run Scapy script with:
from scapy.all import sendp, Ether, IP, conf
conf.iface = "Ethernet" # NIC matching the device GUID
pkt = Ether()/IP(dst="8.8.8.8")
sendp(pkt) -
Observe:
REG_SZ: script in cmd hangs but appears in pktmon as Rx
REG_MULTI_SZ: script in cmd completes, but appears in pktmon as Tx
Versions
Npcap: 1.79
Wireshark: 4.4.3
OS: Windows 11 Pro
Tested on multiple interfaces
Expected Behavior
REG_MULTI_SZ should behave the same as REG_SZ — allow Rx-mode injection without hangs.
Additional Notes
Documentation at v0.05-r7 changelog mentions semicolon-separated strings, but current behavior suggests inconsistency.
Using REG_SZ is not viable for production due to app hangs.
Please clarify if:
REG_MULTI_SZ is supposed to be supported for Rx
Any syntax (semicolon-separated or newline) is expected
\Device{GUID} is still required in latest versions
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue using the Npcap registry path under Services\npcap\Parameters, the REG_SZ and REG_MULTI_SZ values, Scapy's conf.L2socket/sendp() example, and pktmon observations. Check the v0.05-r7 changelog for the documented syntax; done means REG_MULTI_SZ supports the intended Rx injection without the REG_SZ hang.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100