R: [Winpcap-users] Using WinPcap "breaks" TCP

[Davide Schiera]

Hi Marc,
I sent a message few hours ago... maybe you wasn't able to read it :( Here
is the message!

As said in http://www.winpcap.org/misc/faq.htm#Q-10:

"Q-10: Does WinPcap work in connection with personal firewalls?
A: We got several reports saying that WinPcap does not work well if a
personal firewall is installed on the same machine as WinPcap. The typical
problem is the impossibility to capture all or part of the traffic from an
adapter, but some users reported strange behaviors (like some packets
disappearing) on the transmit side too.
Most of the times, the problem is caused by non-standard interactions
between the firewall and the network stack of the OS, so there not a lot to
do on our side; the suggested remedy consists in uninstalling the firewall.
Note: uninstalling, and not disabling, because some firewalls (like
ZoneAlarm) keep having strange behaviors even when they are disabled."

Kerio firewall seems to be another firewall that doesn't work with WinPcap.

A firewall that should work with WinPcap is Jetico Personal Firewall
(http://www.jetico.com/index.htm#/jpfirewall.htm), but I'm sure there are
other available firewalls without compatibility issues.

Bye,


Davide 

# -----Messaggio originale-----
# Da: winpcap-users-bounces at winpcap.org 
# [mailto:winpcap-users-bounces at winpcap.org] Per conto di Marc Rennhard
# Inviato: giovedì 12 luglio 2007 9.58
# A: winpcap-users at winpcap.org
# Oggetto: Re: [Winpcap-users] Using WinPcap "breaks" TCP
# 
# Googling, I just found that there seems to be problem with 
# using Winpcap and Kerio Firewall and in fact, terminating 
# Kerio has "solved" the problem for me on both my systems. Is 
# there any fix to use both Kerio and Winpcap because I do not 
# want to switch to another personal firewall? Or is there a 
# recommendation for a personal firewall product that has no 
# known compatibility issues? 
# 
# Thanks,
# Marc
# 
# 
# 
# 
# 	Dear all,
# 	
# 	I'm having a strange problem that I believe is related 
# to WinPcap because it only happens with the two WinPcap-based 
# applications I use (Wireshark and Cain). 
# 	
# 	I use the latest Wireshark and Cain versions with 
# Winpcap 4.0.1 under Windows XP with all latest patches and 
# drivers. The problem occurs on both my Laptops, a Thinkpad 
# T40p and a T60. It happens with both the wired and wireless 
# interfaces. The problem did not happen until a few weeks ago, 
# though I cannot tell exactly when it started or what ( e.g. 
# software upgrades) may have been the cause.
# 	
# 	The symtomps are as follows: without running 
# Wireshark/Cain, networking works fine. When starting 
# Wireshark or Cain, it still works. When starting sniffing, 
# TCP-based applications no longer work. With Wireshark, I can 
# see that the 3-way handshake is recorded (so handshaking 
# seems to work), but no data is exchanged afterwards and the 
# TCP connection "hangs". Other protocols still seem to work, 
# e.g. name resolutions (UDP-based) work flawlessly. Even after 
# terminating Wireshark or Cain, TCP remains "broken" and only 
# rebooting helps.
# 	
# 	Does anyone have an idea what the reason for this 
# problem may be? 
# 	
# 	Thanks for any help,
# 	Marc
# 	
# 	_______________________________________________
# 	Winpcap-users mailing list
# 	Winpcap-users at winpcap.org
# 	https://www.winpcap.org/mailman/listinfo/winpcap-users 
# <https://www.winpcap.org/mailman/listinfo/winpcap-users> 
# 	
# 	
# 
# 
#