cap icon indicating copy to clipboard operation
cap copied to clipboard

0 bytes packets capture only

Open Azperin opened this issue 5 years ago • 11 comments

Win10, npcap-0.9991, dhcp network (no ip) Tried every device in deviceList, same result with no packet capture.

var Cap = require('cap').Cap;
var device = Cap.deviceList()[2].name; // physical realtek card
var buffer = Buffer.alloc(65535);
var linkType = c.open(device, '', (10 * 1024 * 1024), buffer);
c.setMinBytes && c.setMinBytes(0);

c.on('packet', function(nbytes, trunc) {
  console.log('packet: length ' + nbytes + ' bytes, truncated? ' + (trunc ? 'yes' : 'no'));
});

A lot of: packet: length 0 bytes, truncated? no in console. How to make it work ?

Azperin avatar May 21 '20 04:05 Azperin

Does bumping up the value passed to setMinBytes() help at all? What about passing a non-empty filter?

mscdex avatar May 21 '20 04:05 mscdex

Tried many filters, as well as setMinBytes > 0, none helps, constantly packet: length 0 bytes, truncated? no, not a single packet with length > 0

Azperin avatar May 21 '20 05:05 Azperin

Not sure then, maybe something changed in npcap or their WinPcap compatibility layer?

CI is using version npcap 0.98, with tests passing.

mscdex avatar May 21 '20 07:05 mscdex

And CI using node version <= 12, there is already 14+

Azperin avatar May 21 '20 07:05 Azperin

Right, but that shouldn't matter as long as the binding compiles correctly.

mscdex avatar May 21 '20 15:05 mscdex

So it's only compilation test, not for actual packet capture one ?

Azperin avatar May 21 '20 18:05 Azperin

No, I mean the difference in node versions used in CI shouldn't matter. The unit tests do capture actual packets.

mscdex avatar May 21 '20 20:05 mscdex

Is there any public result for unit tests with win10, node14, npcap-0.9991 ? Because I don't have a clue why it's not working

Azperin avatar May 21 '20 20:05 Azperin

If you try with npcap-0.98 do you get the same result?

mscdex avatar May 22 '20 00:05 mscdex

Looks like npcap-0.98 working, at least got non-zero length bytes flow. But would be nice to have latest npcap version support. Thank you.

Azperin avatar May 22 '20 00:05 Azperin

Well, it's not capturing any TCP packets, with or without filters. Network device https://i.imgur.com/R86LguP.jpg

Azperin avatar May 22 '20 01:05 Azperin