Bug #3010
closedSuricata doesn't start on Windows 10 64 bit
Description
Suricata doesn't start.
Trying to start it from the command line produces a pop-up message,
something like this: suricata.exe - entry point not found.
The entry point "pcap_dump_fopen" was not found in the DLL "<Full path... >\suricata.exe"
Suricata version: 4.1.4-1-64bit
Npcap: 0.99-r9
Operating system: Windows 10
NB: 4.0.5 32bit did work, with WinPcap
Updated by Peter Manev almost 5 years ago
- Status changed from New to Closed
- Priority changed from High to Normal
Duplicate of - https://redmine.openinfosecfoundation.org/issues/2968
Currently you need to stay with https://nmap.org/npcap/dist/npcap-0.992.exe to run. The error appears if you use v 993+ of npcap.
Updated by Victor Julien almost 5 years ago
- Is duplicate of Bug #2968: windows: suricata calling pcap_dump_fopen added
Updated by Victor Klimov almost 5 years ago
Just tried with npcap-0.992.exe
Same thing, same pop-up, Suricata doesn't start.
P. S. This is after: uninstall both npcap 99r9 and Suricata, shut down Windows, start Windows, install npcap 992, install Suricata.
Updated by Victor Julien almost 5 years ago
- Has duplicate Bug #3024: Suricata doesn't start on Windows 10 64 bit added
Updated by Peter Manev almost 5 years ago
Can you please try -
1 - uninstall all npcap drivers
2 - uninstall Suricata
3 - install only npcap v 0.992
4 - make sure "\Program Files\Suricata " does not exist - delete if needed
5 - install Suricata msi 4.1.4
Any luck ?
Updated by Victor Klimov almost 5 years ago
Done step by step.
Same result.
Suricata doesn't start, same pop-up about pcap_dump_fopen
Updated by Peter Manev almost 5 years ago
Is it possible you have different versions of wpcap.dll on the system left from other installations (winpcap etc..) ? I've seen similar results in those circumstances.
Updated by Victor Klimov almost 5 years ago
Yes, I've found \×pcap\* files and deleted most of them.
Surprisingly, a DLL file was not deleted by the installer of WinPcap.
Now, Suricata doesn't start for a different reason, something like that:
execution of the code can't continue, because wpcap.dll was not found...
After I deleted the pcap files, I shut down the system. After that I installed Npcap 992, after that Suricata 4.1.4-1-64bit.
It looks like Suricata doesn't see Npcap at all. The Windows 10 operating system does see it, lists Npcap as an installed app.
Updated by Victor Klimov almost 5 years ago
driverquery does not list WinPcap.
driverquery does list Npcap Packet Driver.
Updated by Peter Manev almost 5 years ago
I think you need to install the npcap driver with WinPcap compatibility mode as well (just an additional tick/selection during install). Did you already do that ?
Updated by Victor Klimov almost 5 years ago
Yes, the WinPcap compatibility mode did help. Now Suricata does start. :-)