Bug #3010
closed
Suricata doesn't start on Windows 10 64 bit
Added by Victor Klimov over 5 years ago.
Updated over 5 years ago.
Description
Suricata doesn't start.
Trying to start it from the command line produces a pop-up message,
something like this: suricata.exe - entry point not found.
The entry point "pcap_dump_fopen" was not found in the DLL "<Full path... >\suricata.exe"
Suricata version: 4.1.4-1-64bit
Npcap: 0.99-r9
Operating system: Windows 10
NB: 4.0.5 32bit did work, with WinPcap
- Status changed from New to Closed
- Priority changed from High to Normal
- Target version deleted (
TBD)
- Is duplicate of Bug #2968: windows: suricata calling pcap_dump_fopen added
Just tried with npcap-0.992.exe
Same thing, same pop-up, Suricata doesn't start.
P. S. This is after: uninstall both npcap 99r9 and Suricata, shut down Windows, start Windows, install npcap 992, install Suricata.
- Has duplicate Bug #3024: Suricata doesn't start on Windows 10 64 bit added
Can you please try -
1 - uninstall all npcap drivers
2 - uninstall Suricata
3 - install only npcap v 0.992
4 - make sure "\Program Files\Suricata " does not exist - delete if needed
5 - install Suricata msi 4.1.4
Any luck ?
Done step by step.
Same result.
Suricata doesn't start, same pop-up about pcap_dump_fopen
Is it possible you have different versions of wpcap.dll on the system left from other installations (winpcap etc..) ? I've seen similar results in those circumstances.
Will search for the pcap files
Yes, I've found \Ă—pcap\* files and deleted most of them.
Surprisingly, a DLL file was not deleted by the installer of WinPcap.
Now, Suricata doesn't start for a different reason, something like that:
execution of the code can't continue, because wpcap.dll was not found...
After I deleted the pcap files, I shut down the system. After that I installed Npcap 992, after that Suricata 4.1.4-1-64bit.
It looks like Suricata doesn't see Npcap at all. The Windows 10 operating system does see it, lists Npcap as an installed app.
driverquery does not list WinPcap.
driverquery does list Npcap Packet Driver.
I think you need to install the npcap driver with WinPcap compatibility mode as well (just an additional tick/selection during install). Did you already do that ?
Will look it up and/or try
Yes, the WinPcap compatibility mode did help. Now Suricata does start. :-)
Also available in: Atom
PDF