Project

General

Profile

Actions

Bug #3010

closed

Suricata doesn't start on Windows 10 64 bit

Added by Victor Klimov over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

Suricata doesn't start.

Trying to start it from the command line produces a pop-up message,
something like this: suricata.exe - entry point not found.
The entry point "pcap_dump_fopen" was not found in the DLL "<Full path... >\suricata.exe"

Suricata version: 4.1.4-1-64bit
Npcap: 0.99-r9
Operating system: Windows 10

NB: 4.0.5 32bit did work, with WinPcap


Related issues 2 (0 open2 closed)

Is duplicate of Bug #2968: windows: suricata calling pcap_dump_fopenClosedPeter ManevActions
Has duplicate Bug #3024: Suricata doesn't start on Windows 10 64 bitClosedActions
Actions #1

Updated by Peter Manev over 3 years ago

  • Status changed from New to Closed
  • Priority changed from High to Normal

Duplicate of - https://redmine.openinfosecfoundation.org/issues/2968

Currently you need to stay with https://nmap.org/npcap/dist/npcap-0.992.exe to run. The error appears if you use v 993+ of npcap.

Actions #2

Updated by Victor Julien over 3 years ago

  • Target version deleted (TBD)
Actions #3

Updated by Victor Julien over 3 years ago

  • Is duplicate of Bug #2968: windows: suricata calling pcap_dump_fopen added
Actions #4

Updated by Victor Klimov over 3 years ago

Just tried with npcap-0.992.exe
Same thing, same pop-up, Suricata doesn't start.

P. S. This is after: uninstall both npcap 99r9 and Suricata, shut down Windows, start Windows, install npcap 992, install Suricata.

Actions #5

Updated by Victor Julien over 3 years ago

  • Has duplicate Bug #3024: Suricata doesn't start on Windows 10 64 bit added
Actions #6

Updated by Peter Manev over 3 years ago

Can you please try -
1 - uninstall all npcap drivers
2 - uninstall Suricata
3 - install only npcap v 0.992
4 - make sure "\Program Files\Suricata " does not exist - delete if needed
5 - install Suricata msi 4.1.4

Any luck ?

Actions #7

Updated by Victor Klimov over 3 years ago

Done step by step.

Same result.
Suricata doesn't start, same pop-up about pcap_dump_fopen

Actions #8

Updated by Peter Manev over 3 years ago

Is it possible you have different versions of wpcap.dll on the system left from other installations (winpcap etc..) ? I've seen similar results in those circumstances.

Actions #9

Updated by Victor Klimov over 3 years ago

Will search for the pcap files

Actions #10

Updated by Victor Klimov over 3 years ago

Yes, I've found \Ă—pcap\* files and deleted most of them.
Surprisingly, a DLL file was not deleted by the installer of WinPcap.

Now, Suricata doesn't start for a different reason, something like that:
execution of the code can't continue, because wpcap.dll was not found...

After I deleted the pcap files, I shut down the system. After that I installed Npcap 992, after that Suricata 4.1.4-1-64bit.

It looks like Suricata doesn't see Npcap at all. The Windows 10 operating system does see it, lists Npcap as an installed app.

Actions #11

Updated by Victor Klimov over 3 years ago

driverquery does not list WinPcap.
driverquery does list Npcap Packet Driver.

Actions #12

Updated by Peter Manev over 3 years ago

I think you need to install the npcap driver with WinPcap compatibility mode as well (just an additional tick/selection during install). Did you already do that ?

Actions #13

Updated by Victor Klimov over 3 years ago

Will look it up and/or try

Actions #14

Updated by Victor Klimov over 3 years ago

Yes, the WinPcap compatibility mode did help. Now Suricata does start. :-)

Actions

Also available in: Atom PDF