Ask Your Question
0

Upgraded Wireshark, VPN connections stop working

asked 2020-03-27 16:00:22 +0000

dastafford gravatar image

As an infrequent user of Wireshark, when I ran the installed version this afternoon, I was prompted to upgrade to v3.2.2 from 2.4.4 on my Windows 8.1 x64 machine.

The upgrade recommended removing WinPCap (manually) and replaced it with Npcap. After the required reboot, I found that none of my Windows VPN connections worked any longer. When I click on "connect", Taskmgr shows explorer.exe as "not responding" and Device manager lists all the associated Wan Miniport devices with exclamation marks and the status of "This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)" until the connection attempt times out at which point Explorer starts responding again and the Miniport devices all go back to hidden.

Uninstalling Npcap(without a reboot) didn't help. Uninstalling Wireshark didn't help either and the only thing that got the functionality back was to do a System Restore to yesterday.

After the System Restore, I checked that all of the VPN connections were working again then tried reinstalling Wireshark. A reboot was required again and after the reboot I got exactly the same result - couldn't connect to any VPNs.

I am about to do the System Restore again but I wondered if anyone has seen this kind of behaviour before and if there anything that can be done?

Thanks in advance

David Stafford

edit retag flag offensive close merge delete

Comments

What is the VPN software you're using?

grahamb gravatar imagegrahamb ( 2020-03-27 19:06:17 +0000 )edit

It is the built-in Windows Networking VPN Client

dastafford gravatar imagedastafford ( 2020-03-28 07:05:31 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-03-27 16:13:19 +0000

Chuckc gravatar image

updated 2020-05-20 20:26:48 +0000

Guy Harris gravatar image

I have seen this where npcap causes problems with OpenVPN connections.

Npcap questions best handled here: npcap issues

Example of others seeing something similar

edit flag offensive delete link more

Comments

Note that the link of similar issues seems to be more about the problematic npcap 0.994 & 0.995 versions that were difficult to remove, although the initial report was caused by VPN issues.

FWIW, I've run used npcap and an OpenVPN based VPN since the very early days of npcap without a VPN issue.

Regardless of my good fortune, this is an npcap issue and should be reported over there.

grahamb gravatar imagegrahamb ( 2020-03-27 19:05:47 +0000 )edit

Thanks for your replies.

I will try reinstalling WinPCap and then reinstalling Wireshark.

If it turns out to be the case that Npcap is the culprit, I think the Wireshark deve[opers should consider altering the installer and not make Npcap the primary option. I am unclear as to what (theoretical) advantage NPcap has over WinPCap but I assume that there is something otherwise why would Wireshark suggest it.

I'll let you know how I go with the new plan.

dastafford gravatar imagedastafford ( 2020-03-28 07:11:52 +0000 )edit

WinPcap is abandoned and unsupported and uses an older MS technology to capture traffic (NDIS5) that is deprecated.

npcap is supported by the nmap team and uses NDIS6 which is supported by MS.

Wireshark will currently use WinPcap if npcap isn't installed, but that support may be removed at some point in the future.

Some folks have run into difficulties with npcap, and there have been some problematic versions, but the vast majority of users (both Wireshark and nmap) have no issues at all and are happy with the extra features provided by npcap.

grahamb gravatar imagegrahamb ( 2020-03-28 13:22:35 +0000 )edit

Yes, after my last post, I visited the WinpCap web site and saw that they had halted development and that they recommend npcap. Nothing clears the mind so quickly as the absence of choice, eh?

I installed Wireshark 3.2.2 with WinpCap 4.1.3 and the VPN connections still work.

I don't know enough about npcap to comment on the benefits that might be gained from it but since it broke my setup, it's not an auspicious introduction. I have used WinpCap and WireShark for quite some years, albeit infrequently, and I have never had any problems of any kind. This situation came as a surprise ... and quite an inconvenience.

Thank you, Bubba and Graham, for your prompt help. It was greatly appreciated.

dastafford gravatar imagedastafford ( 2020-03-28 13:53:12 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2020-03-27 16:00:22 +0000

Seen: 2,594 times

Last updated: May 20 '20