I am trying to get the loopback interface working on wireshark I read here https://wiki.wireshark.org/CaptureSetup/Loopback that I should install Npcap https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nmap-0.05.exe I tried but I got these errors
"failed to create npcap service for win7, win8 and win10. Please try installing Npcap again, or use the official Npcap installer from www.nmap.org" "Failed to create the npf service for win7, win8 and win10" "Windows requires a digitally signed driver A recently installed program tried to install an unsigned driver. This version of Windows requires all drivers to have a valid digital signature. The driver is unavailable and the program that uses the driver might not work correctly....npcap.sys" I looked here https://github.com/nmap/npcap/tree/master/installer but I don't see any EXEs and one of the files says something about rolling back to 0.05 which (looking at the URL I downloaded the EXE from) is the version of EXE I have asked 16 Sep '15, 16:46  barlop edited 17 Sep '15, 01:02  Guy Harris ♦♦ |
3 Answers:
Hi, I presume you are using a Windows 7 x64 PC, right? Npcap is signed with a SHA2 certificate so you must ensure that your Windows 7 has this security update installed: https://technet.microsoft.com/en-us/library/security/3033929 Having an up-to-date Windows should solve the issue. answered 17 Sep '15, 04:11  Pascal Quantin |
This is an issue with the Npcap driver; that's still somewhat new code and may still have some rough edges. You should report it either to the Nmap mailing list or to Yang Luo, the developer - see the end of the main Npcap page for their e-mail addresses. answered 17 Sep '15, 01:04 Guy Harris ♦♦ |
Hi, I am the developer, sorry for being late! https://github.com/nmap/npcap/ is the source code repo, so you probably won't find any EXE installers there:) https://github.com/nmap/npcap/releases is where all the installers will be. And I rechecked this issue and it turned out that Pascal is right, you need to install that update to enable the SHA2 in Windows 7, otherwise Npcap will be regarded as a non-signed software and forbidden to be installed on Windows. UPDATE: Solution: You should install the lastest Npcap 0.05 R14, all signing issues should have gone. answered 17 Oct '15, 18:23  Yang Luo edited 26 Feb '16, 19:09 showing 5 of 8 show 3 more comments |
Hi, I just tried to install 0.06-R4 and 0.05-r14, the issue is still there. W7 doesn't complain about signed driver, but the npf service creation fails. If I run the "NPFInstall.exe -i" I have to following return: Npcap LWF driver has failed the installation.
Installation steps were performed with admin rights.
It's so weird. You can try Npcap on a fresh machine. Then find out what software your current machine has installed. It should be software conflict issue.
Ok, I just tried to install on a fresh W7 (no Microsoft upgrades), and it worked. So now what can I do to understand why there is this conflict on my system? install and uninstall process of winpcap works just fine.
Can the installer be made to report why the installation failed? Is there some way to determine why the service creation failed and, if not, are there any changes that could be made to Npcap to provide more information?
@NelsonB
You could run "net start npf" in CMD, it should return some information about why fails. And moreover, you can try to install Npcap with "Install Npcap in WinPcap API-compatible Mode" UNCHECKED, to see if npcap.sys can be installed or not. Just another name for npf.sys.
@Guy Harris
Good point. I will see if this is possible.
Installing with "WinPcap API-compatible Mode" UNCHECKED fails with the same issue, when trying to install the driver. I tried to start the service manually via net start, and W7 tells me it's already started.
If the service is already started, then it's just OK. You can use Wireshark with Npcap without issues.