Forum Discussion
Solved
Npcap keeps updating and crashing the Sensors
Since last week, I keep having an issue where Npcap updates to a newer version than 1.0 and then sensors no longer work. I have uninstalled and reinstalled everything, but an autoupdate hits somehow a few hours later and crashes everything. Anyone else seeing this?
- Vendor said "This is part of the port scanner on the latest version that was released last week. We are looking into this now, as it is conflicting with your product." Recommendation is to remove Barracuda RMM device manager, for now. Also, I can confirm that changing the "AdminOnly" regkey did actually fix it, so that is another work around, if someone doesn't want to remove Barracuda RMM device manager.
19 Replies
- Faced the same issue here, root cause turned out to be packetbeat: <a href="https://github.com/elastic/beats/issues/34420" target="_blank">https://github.com/elastic/beats/issues/34420</a>
Unfortunately I have the same issue. We installed Npcap OEM 1.00 and then somehow it was updated to version 1.71.
I did a few tests and it seems as if the update occurs with the Windows update. Verified this with the latest January update. After rebooting Npac was 1.71. Is Npac somehow included into the Windows update?
- EliOfek
Microsoft
Npcap is not included in windows update. it's not a Microsoft product, we licensed it as OEM for MDI only.
Most likely something else on the machine is causing the update (policy?) and it was pending a reboot to complete, so the windows update was just the final trigger.- Thanks for your fast reply. I'll check that once again and dig deeper into it.
- EliOfek
kmcdermott MDI does not auto update npcap, and npcap does not auto upgrade.
If it happened it means you have some policy in effect that auto upgrade it...
- Eli, for your reference, I have nothing else installed on this server, other than Windows and the DC services. I install the sensor clean, which installs npcap 1.0. In a few hours it gets upgraded to npcap 1.6 and also installed nmap 7.92. This same thing happens on both of my DCs. I have replicated this over and over. This started last week.
- As a test, I'm uninstalling the npcap 1.6 and nmap 7.92 that are somehow being pushed to me and installing npcap 1.71 to see if it somehow gets downgraded to 1.6.
