This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to get the loopback interface working on wireshark

I read here https://wiki.wireshark.org/CaptureSetup/Loopback that I should install Npcap https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05.exe

I tried but I got these errors

alt text

"failed to create npcap service for win7, win8 and win10. Please try installing Npcap again, or use the official Npcap installer from www.nmap.org"

"Failed to create the npf service for win7, win8 and win10"

"Windows requires a digitally signed driver A recently installed program tried to install an unsigned driver. This version of Windows requires all drivers to have a valid digital signature. The driver is unavailable and the program that uses the driver might not work correctly....npcap.sys"

I looked here https://github.com/nmap/npcap/tree/master/installer

but I don't see any EXEs and one of the files says something about rolling back to 0.05 which (looking at the URL I downloaded the EXE from) is the version of EXE I have

asked 16 Sep '15, 16:46

barlop's gravatar image

barlop
16337
accept rate: 0%

edited 17 Sep '15, 01:02

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


Hi,

I presume you are using a Windows 7 x64 PC, right? Npcap is signed with a SHA2 certificate so you must ensure that your Windows 7 has this security update installed: https://technet.microsoft.com/en-us/library/security/3033929

Having an up-to-date Windows should solve the issue.

permanent link

answered 17 Sep '15, 04:11

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

This is an issue with the Npcap driver; that's still somewhat new code and may still have some rough edges. You should report it either to the Nmap mailing list or to Yang Luo, the developer - see the end of the main Npcap page for their e-mail addresses.

permanent link

answered 17 Sep '15, 01:04

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Hi, I am the developer, sorry for being late!

https://github.com/nmap/npcap/ is the source code repo, so you probably won't find any EXE installers there:)

https://github.com/nmap/npcap/releases is where all the installers will be.

And I rechecked this issue and it turned out that Pascal is right, you need to install that update to enable the SHA2 in Windows 7, otherwise Npcap will be regarded as a non-signed software and forbidden to be installed on Windows.


UPDATE:

Solution:

You should install the lastest Npcap 0.05 R14, all signing issues should have gone.

permanent link

answered 17 Oct '15, 18:23

Yang%20Luo's gravatar image

Yang Luo
9117
accept rate: 4%

edited 26 Feb '16, 19:09

Hi, I just tried to install 0.06-R4 and 0.05-r14, the issue is still there. W7 doesn't complain about signed driver, but the npf service creation fails. If I run the "NPFInstall.exe -i" I have to following return: Npcap LWF driver has failed the installation.

Installation steps were performed with admin rights.

(07 Mar '16, 02:01) NelsonB

It's so weird. You can try Npcap on a fresh machine. Then find out what software your current machine has installed. It should be software conflict issue.

(07 Mar '16, 07:58) Yang Luo

Ok, I just tried to install on a fresh W7 (no Microsoft upgrades), and it worked. So now what can I do to understand why there is this conflict on my system? install and uninstall process of winpcap works just fine.

(08 Mar '16, 02:26) NelsonB

Can the installer be made to report why the installation failed? Is there some way to determine why the service creation failed and, if not, are there any changes that could be made to Npcap to provide more information?

(08 Mar '16, 17:35) Guy Harris ♦♦

@NelsonB

You could run "net start npf" in CMD, it should return some information about why fails. And moreover, you can try to install Npcap with "Install Npcap in WinPcap API-compatible Mode" UNCHECKED, to see if npcap.sys can be installed or not. Just another name for npf.sys.

(08 Mar '16, 22:41) Yang Luo

@Guy Harris

Good point. I will see if this is possible.

(08 Mar '16, 22:44) Yang Luo

Installing with "WinPcap API-compatible Mode" UNCHECKED fails with the same issue, when trying to install the driver. I tried to start the service manually via net start, and W7 tells me it's already started.

(09 Mar '16, 01:28) NelsonB

If the service is already started, then it's just OK. You can use Wireshark with Npcap without issues.

(18 Mar '16, 18:07) Yang Luo
showing 5 of 8 show 3 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×7

question asked: 16 Sep '15, 16:46

question was seen: 7,693 times

last updated: 18 Mar '16, 18:07

p​o​w​e​r​e​d by O​S​Q​A