[Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

Thu Nov 12 07:06:13 UTC 2015

Hi Yang, hi Chris,

thank you very much, using your link I was able to send and receive frames as expected!

I needed to first patch my driver, as it checks pcap_lib_version() > 4 and I removed the calls for OID_GEN_LINK_SPEED and OID_GEN_MEDIA_CONNECT_STATUS as they didn’t succeed (I did no further track down, because I just wanted to check if sending and receiving with PCAP_OPENFLAG_NOCAPTURE_LOCAL works fine.

Thank you very much for your hint!

Best regards,
Paul

Von: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] Im Auftrag von ?????V5
Gesendet: Dienstag, 10. November 2015 06:36
An: winpcap-users at winpcap.org
Betreff: Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

Hi Paul,

As Chris pointed, Npcap DOES support PCAP_OPENFLAG_NOCAPTURE_LOCAL option in its latest version:
https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05-r2.exe

This question exactly got asked a few days ago at nmap's mail list and I have added this feature at that moment, see this:
http://seclists.org/nmap-dev/2015/q4/6

Please allow me to paste some explanations from the above post here:

Actually, this functionality can be easily implemented by Npcap, because
the three packet flowing paths: *receive, other-send, self-send* are
totally *separated* in Npcap, so it's convenient to only restrict the
self-send path using flag.

Remember: other softwares can still see all possible traffic, for instance,
your software disabled the local-sent packets
using PCAP_OPENFLAGS_NOCAPTURE_LOCAL, then your software no longer sees the
self-sent packets, but another software like Wireshark can still see them,
because they're not "self" sent.

Cheers,
Yang

On Tue, Nov 10, 2015 at 12:12 AM, Maynard, Chris <Christopher.Maynard at igt.com<mailto:Christopher.Maynard at igt.com>> wrote:
You might want to give npcap a try: https://github.com/nmap/npcap
See also: https://wiki.wireshark.org/CaptureSetup/Loopback
- Chris

From: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Paul Bußmann
Sent: Thu, November 05, 2015 4:39 AM
To: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Subject: Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

Hi Gianluca,

we are affected by the known bug “Transmitted packets are looped back on Windows 8 even when using the flag PCAP_OPENFLAGS_NOCAPTURE_LOCAL for pcap_open.” in version 4.1.3, 08 mar 13.
In some situations we cannot know from the winpcap frames by any means if they are sent or received therefor we really need PCAP_OPENFLAGS_NOCAPTURE_LOCAL.
Is there any alpha or beta version (not officially supported) available that works?

Best regards,
Paul

Von: Paul Bußmann
Gesendet: Dienstag, 22. Januar 2013 08:26
An: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Betreff: AW: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

Hi Gianluca,

thank you for your prompt reply!

Is there a way to get an alpha or beta version (not officially supported) that could do the trick?

Best regards,
Paul

Von: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [mailto:winpcap-users-bounces at winpcap.org] Im Auftrag von Gianluca Varenni
Gesendet: Montag, 21. Januar 2013 18:17
An: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Betreff: Re: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

WinPcap 4.1.2 is not officially supported on Windows 8 (in fact the installer should fail on it).

Have a nice day
GV

From: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Paul Bußmann
Sent: Monday, January 21, 2013 7:47 AM
To: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Subject: [Winpcap-users] PCAP_OPENFLAG_NOCAPTURE_LOCAL seems to not work on Windows 8

Hello,

I am running Winpcap 4.1.2 on Windows 8 and it seems as if PCAP_OPENFLAG_NOCAPTURE_LOCAL is not working. I still see all the traffic to the adapter. The program runs fine for Win XP and Windows 7?

I searched for this issue (especially with term “Windows 8”), but got no results.

What can cause this? Any help is appreciated!

Best regards,
Paul

--

CONFIDENTIALITY NOTICE: This message is the property of International Game Technology PLC and/or its subsidiaries and may contain proprietary, confidential or trade secret information.  This message is intended solely for the use of the addressee.  If you are not the intended recipient and have received this message in error, please delete this message from your system. Any unauthorized reading, distribution, copying, or other use of this message or its attachments is strictly prohibited.

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org<mailto:Winpcap-users at winpcap.org>
https://www.winpcap.org/mailman/listinfo/winpcap-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20151112/feed1907/attachment-0001.html>