How do I resolve system error 31 when trying to start the npcap service on Windows?

asked 2021-05-20 05:35:34 +0000

Amrothian
3 ●1 ●1 ●2

updated 2021-05-20 07:31:34 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

This is the first time I am using Wireshark, and only because we have a 10k piece of equipment that doesn't work the way we need it to ... and so I am using it so that the engineer at the company can know what is going on. Problem is, I can't get NPCAP to work properly for me at the moment.

Local interfaces are unavailable because the packet capture driver isn't loaded.
You can fix this by running net start npcap if you have Npcap installed or net start npf
if you have WinPcap installed. Both commands must be run as Administrator.

I already have NPCAP 1.0 installed. But when I go to run it in CMD it says the following

C:\WINDOWS\system32>net start npcap
System error 31 has occurred.
A device attached to the system is not functioning.

To further my confusion, I still am collecting some kind of traffic - but unsure what kind. I have two ports - one is "USBcap1" and the other is "USBcap2". But only the former can collect the "traffic" while the other can be clicked only to be returned with "Local interfaces are unavailable"

Any direction would be appreciated.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-05-20 06:20:56 +0000

Jaap

13742 ●711 ●115

For Npcap related issues best to refer to the Npcap pages and their GitHub. They already have a newer release over there as well.

edit flag offensive delete link

Comments

I.e., try updating to the current version of Npcap (which you can download from the Npcap site and, if the problem persists, report it on the Npcap issue list. ("System error 31" is probably the Windows error code ERROR_GEN_FAILURE; a number of internal NT errors are mapped to that, including the equally-generic STATUS_UNSUCCESSFUL, which is returned in a number of places in the current Npcap kernel-mode driver.)

Guy Harris ( 2021-05-20 06:58:23 +0000 )edit

Thanks Jaap once I updated to the latest software the message no longer appears. Thanks so much again for your help. I was also able to access the ETHERNET-to-USB traffic which I needed for troubleshooting the faulty machine. Lifesaver!

Amrothian ( 2021-05-25 01:39:41 +0000 )edit

add a comment

answered 2021-05-20 06:42:13 +0000

Guy Harris
19890 ●3 ●660 ●207

**To further my confusion, I still am collecting some kind of traffic - but unsure what kind. I have two ports - one is "USBcap1" and the other is "USBcap2". But only the former can collect the "traffic" while the other can be clicked only to be returned with "Local interfaces are unavailable" ...

Those are both "devices" for capturing traffic going over the USB bus, and have nothing to do with Npcap.

Wireshark has a mechanism to support capturing traffic from mechanisms not supported by libpcap/WinPcap/Npcap; on Windows, raw USB capture is one of them. That doesn't refer to capturing network traffic on USB adapters - that works the same way that capturing on non-USB-attached network adapters works - but to capturing USB transactions on the bus for any type of USB device. This mechanism is called "extcap", for "external capture", "external" meaning that the code to support it could be third-party code not part of Wireshark, e.g. "external" to Wireshark.

So what you're capturing on USBcap1 is USB transactions, whether it's between your keyboard or mouse and your machine, or between some device plugged into a USB connector on your machine and the machine (network adapter, disk, etc.).

They show up because, even if Wireshark gets an empty list of devices from libpcap/WinPcap/Npcap, it may still show extcap devices.

edit flag offensive delete link

Comments

Thanks for clarifying that! Glad to get some more insight into what Wireshark does.

Amrothian ( 2021-05-25 01:40:06 +0000 )edit

add a comment