Ask Your Question
0

dumpcap -a duration:XX not working when capturing from Napatech card

asked 2019-10-23 12:54:35 +0000

updated 2019-10-23 13:05:37 +0000

cmaynard gravatar image

How dumpcap gets time to calculate the timeout for -a duration:XX parameter handling?

My problem is that I have a Napatech sniffing card (NT40A01), which comes with Napatech own WinPCAP (they called it WinPCAP-NT). This WinPCAP can work with normal NICs AND with Napatech cards, so I am able to use Wireshark on my normal NICs as well as on Napatech cards. Napatech cards are not seen as "normal" NICs, they don't appear under "Network adapters", they don't have associated connection to them, or IP address.

The problem is with dumpcap with "duration" parameter. On normal NICs (eg. Intel CT) it works perfectly OK (dumpcap -a duration:10 will stop capturing after 10 seconds), but when sniffing from Napatech card, sniffing is done indefinitely, regardless of parameter passed to "duration".

OS: Windows 10. Wireshark 3.0.5 32 bit

edit retag flag offensive close merge delete

Comments

Can you show the full command line you're using?

grahamb gravatar imagegrahamb ( 2019-10-23 13:31:32 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-10-23 17:47:08 +0000

Guy Harris gravatar image

I suspect that dumpcap's capture loop is not working due to some limitations of WinPcap-NT, e.g. it may not offer a HANDLE on which WaitForSingleObject()/WaitForMultipleObjects() work. It may thus mean that dumpcap blocks indefinitely waiting for packets and thus never notices that the timeout expires.

This is probably best handled initially as a Wireshark bug, so please file a bug on the Wireshark Bugzilla. We may have to talk to Napatech about making changes to WinPcap-NT (including turning it into Npcap-NT!), so if you can find a technical contact at Napatech with whom we can talk about WinPcap-NT, that would be helpful. ("We" will probably end up meaning "me along with Daniel Miller of Npcap".)

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-10-23 12:54:35 +0000

Seen: 86 times

Last updated: Oct 23 '19