[Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

[食肉大灰兔V5]

Hi Paul,

As Chris pointed, Npcap *DOES* support PCAP_OPENFLAG_NOCAPTURE_LOCAL option
in its latest version:
https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05-r2.exe

This question exactly got asked a few days ago at nmap's mail list and I
have added this feature at that moment, see this:
http://seclists.org/nmap-dev/2015/q4/6

Please allow me to paste some explanations from the above post here:

Actually, this functionality can be easily implemented by Npcap, because
the three packet flowing paths: *receive, other-send, self-send* are
totally *separated* in Npcap, so it's convenient to only restrict the
self-send path using flag.

Remember: other softwares can still see all possible traffic, for instance,
your software disabled the local-sent packets
using PCAP_OPENFLAGS_NOCAPTURE_LOCAL, then your software no longer sees the
self-sent packets, but another software like Wireshark can still see them,
because they're not "self" sent.


Cheers,
Yang


On Tue, Nov 10, 2015 at 12:12 AM, Maynard, Chris <
Christopher.Maynard at igt.com> wrote:

> You might want to give npcap a try: https://github.com/nmap/npcap
>
> See also: https://wiki.wireshark.org/CaptureSetup/Loopback
>
> - Chris
>
>
>
> *From:* winpcap-users-bounces at winpcap.org [
> mailto:winpcap-users-bounces at winpcap.org
> <winpcap-users-bounces at winpcap.org>] *On Behalf Of *Paul Bußmann
> *Sent:* Thu, November 05, 2015 4:39 AM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not
> work on Windows 8
>
>
>
> Hi Gianluca,
>
>
>
> we are affected by the known bug “Transmitted packets are looped back on
> Windows 8 even when using the flag PCAP_OPENFLAGS_NOCAPTURE_LOCAL for
> pcap_open.” in version 4.1.3, 08 mar 13.
>
> In some situations we cannot know from the winpcap frames by any means if
> they are sent or received therefor we really need
> PCAP_OPENFLAGS_NOCAPTURE_LOCAL.
>
> Is there any alpha or beta version (not officially supported) available
> that works?
>
>
>
> Best regards,
>
> Paul
>
>
>
> *Von:* Paul Bußmann
> *Gesendet:* Dienstag, 22. Januar 2013 08:26
> *An:* winpcap-users at winpcap.org
> *Betreff:* AW: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not
> work on Windows 8
>
>
>
> Hi Gianluca,
>
>
>
> thank you for your prompt reply!
>
>
>
> Is there a way to get an alpha or beta version (not officially supported)
> that could do the trick?
>
>
>
> Best regards,
>
> Paul
>
>
>
> *Von:* winpcap-users-bounces at winpcap.org [
> mailto:winpcap-users-bounces at winpcap.org
> <winpcap-users-bounces at winpcap.org>] *Im Auftrag von *Gianluca Varenni
> *Gesendet:* Montag, 21. Januar 2013 18:17
> *An:* winpcap-users at winpcap.org
> *Betreff:* Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not
> work on Windows 8
>
>
>
> WinPcap 4.1.2 is not officially supported on Windows 8 (in fact the
> installer should fail on it).
>
>
>
> Have a nice day
>
> GV
>
>
>
> *From:* winpcap-users-bounces at winpcap.org [
> mailto:winpcap-users-bounces at winpcap.org
> <winpcap-users-bounces at winpcap.org>] *On Behalf Of *Paul Bußmann
> *Sent:* Monday, January 21, 2013 7:47 AM
> *To:* winpcap-users at winpcap.org
> *Subject:* [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not
> work on Windows 8
>
>
>
> Hello,
>
>
>
> I am running Winpcap 4.1.2 on Windows 8 and it seems as if
> PCAP_OPENFLAG_NOCAPTURE_LOCAL is not working. I still see all the traffic
> to the adapter. The program runs fine for Win XP and Windows 7?
>
>
>
> I searched for this issue (especially with term “Windows 8”), but got no
> results.
>
>
>
> What can cause this? Any help is appreciated!
>
>
>
> Best regards,
>
> Paul
>
>
>
> --
>
>
>
>
>
>
>
>
>
> CONFIDENTIALITY NOTICE: This message is the property of International Game
> Technology PLC and/or its subsidiaries and may contain proprietary,
> confidential or trade secret information.  This message is intended solely
> for the use of the addressee.  If you are not the intended recipient and
> have received this message in error, please delete this message from your
> system. Any unauthorized reading, distribution, copying, or other use of
> this message or its attachments is strictly prohibited.
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20151110/b9e6fff6/attachment-0001.html>