npcap icon indicating copy to clipboard operation
npcap copied to clipboard

PcapOpenAdapter() appears to return ERROR_BAD_UNIT, not ERROR_ACCESS_DENIED, if the user says "No" to the UAC prompt

Open guyharris opened this issue 3 years ago • 1 comments

If the fix for issue #586 is applied to libpcap, so that pcap_create() doesn't fail if the user says "No" to the UAC prompt if Administrator privileges are required, the call to PcapOpenAdapter() in pcap_activate() appears to fail with ERROR_BAD_UNIT, which it interprets as "No such device", rather than with ERROR_ACCESS_DENIED, which it would interpret as "that device exists but you don't have permission to capture on it".

This, for example, causes tcpdump to report

tcpdump: \Device\NPF_{9080DB6C-2C39-480B-895F-49715A318BA0}: No such device exists

rather than reporting

tcpdump: \Device\NPF_{9080DB6C-2C39-480B-895F-49715A318BA0}: You don't have permission to capture on that device

which is more accurate.

guyharris avatar Mar 11 '22 08:03 guyharris

Does PacketOpenAdapter() need to get a list of devices?

If not, removing that requirement would help here.

If so, fixing #175 so that fetching the device list doesn't require Administrator privileges even if capturing or injecting does would help here.

guyharris avatar Mar 11 '22 09:03 guyharris