<div dir="ltr">Hi Paul,<div><br></div><div>As Chris pointed, Npcap <b>DOES</b> support PCAP_OPENFLAG_NOCAPTURE_LOCAL option in its latest version:</div><div><a href="https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05-r2.exe">https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05-r2.exe</a><br></div><div><br></div><div>This question exactly got asked a few days ago at nmap's mail list and I have added this feature at that moment, see this:</div><div><a href="http://seclists.org/nmap-dev/2015/q4/6">http://seclists.org/nmap-dev/2015/q4/6</a><br></div><div><br></div><div>Please allow me to paste some explanations from the above post here:</div><div><br></div><div><div>Actually, this functionality can be easily implemented by Npcap, because</div><div>the three packet flowing paths: *receive, other-send, self-send* are</div><div>totally *separated* in Npcap, so it's convenient to only restrict the</div><div>self-send path using flag.</div><div><br></div><div>Remember: other softwares can still see all possible traffic, for instance,</div><div>your software disabled the local-sent packets</div><div>using PCAP_OPENFLAGS_NOCAPTURE_LOCAL, then your software no longer sees the</div><div>self-sent packets, but another software like Wireshark can still see them,</div><div>because they're not "self" sent.</div></div><div><br></div><div><br></div><div>Cheers,</div><div>Yang</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 10, 2015 at 12:12 AM, Maynard, Chris <span dir="ltr"><<a href="mailto:Christopher.Maynard@igt.com" target="_blank">Christopher.Maynard@igt.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d">You might want to give npcap a try:
<a href="https://github.com/nmap/npcap" target="_blank">https://github.com/nmap/npcap</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d">See also:
<a href="https://wiki.wireshark.org/CaptureSetup/Loopback" target="_blank">https://wiki.wireshark.org/CaptureSetup/Loopback</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d">- Chris<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a> [<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">mailto:winpcap-users-bounces@winpcap.org</a>]
<b>On Behalf Of </b>Paul Bußmann<br>
<b>Sent:</b> Thu, November 05, 2015 4:39 AM<br>
<b>To:</b> <a href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b>Subject:</b> Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Hi Gianluca,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">we are affected by the known bug “Transmitted packets are looped back on Windows 8 even when using the flag PCAP_OPENFLAGS_NOCAPTURE_LOCAL for pcap_open.” in version 4.1.3, 08 mar 13.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">In some situations we cannot know from the winpcap frames by any means if they are sent or received therefor we really need PCAP_OPENFLAGS_NOCAPTURE_LOCAL.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Is there any alpha or beta version (not officially supported) available that works?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Best regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Paul<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Paul Bußmann
<br>
<b>Gesendet:</b> Dienstag, 22. Januar 2013 08:26<br>
<b>An:</b> <a href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b>Betreff:</b> AW: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Hi Gianluca,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">thank you for your prompt reply!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Is there a way to get an alpha or beta version (not officially supported) that could do the trick?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Best regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Paul<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a> [<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">mailto:winpcap-users-bounces@winpcap.org</a>]
<b>Im Auftrag von </b>Gianluca Varenni<br>
<b>Gesendet:</b> Montag, 21. Januar 2013 18:17<br>
<b>An:</b> <a href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b>Betreff:</b> Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">WinPcap 4.1.2 is not officially supported on Windows 8 (in fact the installer should fail on it).</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Have a nice day</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">GV</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a> [<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">mailto:winpcap-users-bounces@winpcap.org</a>]
<b>On Behalf Of </b>Paul Bußmann<br>
<b>Sent:</b> Monday, January 21, 2013 7:47 AM<br>
<b>To:</b> <a href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b>Subject:</b> [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I am running Winpcap 4.1.2 on Windows 8 and it seems as if PCAP_OPENFLAG_NOCAPTURE_LOCAL is not working. I still see all the traffic to the adapter. The program runs fine for Win XP and Windows 7?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I searched for this issue (especially with term “Windows 8”), but got no results.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">What can cause this? Any help is appreciated!<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Best regards,<u></u><u></u></p>
<p class="MsoNormal">Paul<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div></div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d">--
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div>
<p>CONFIDENTIALITY NOTICE: This message is the property of International Game Technology PLC and/or its subsidiaries and may contain proprietary, confidential or trade secret information. This message is intended solely for the use of the addressee. If you are not the intended recipient and have received this message in error, please delete this message from your system. Any unauthorized reading, distribution, copying, or other use of this message or its attachments is strictly prohibited.</p></div>
<br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" rel="noreferrer" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></blockquote></div><br></div>