mailing list archives
Re: WinPcap setup issue in Nmap Windows installer
From: LevelZero <levelzero () retry org>
Date: Fri, 14 Dec 2007 14:53:35 +0100
On Fri, 14 Dec 2007 11:50:22 +0000, jah <jah () zadkiel plus com> wrote:
On 14/12/2007 06:58, levelzero () retry org wrote:
I'm attempting to reproduce the issue you've encountered, but at the
moment I cannot. Here's what I see:
After allowing nmap upgrade winpcap by clicking yes to the message
dialog that pops-up similar to "WinPcap version 4.01 exists on this
system. Replace with version 4.02?" I briefly see the nmap-winpcap 4.02
installer appear, but then the focus is stolen by the winpcap
uninstaller for 4.01 which pops-up and prompts for an uninstall. Once
that is complete and the window closed, installation of nmap-winpcap
4.02 can be continued by pressing Next and proceeds without issue. In
your case, did the uninstaller window close before you proceeded with
the nmap-winpcap install?
I agree that it's possible to perform these actions in a different order
as there is nothing to prevent the install of nmap-winpcap 4.02 before
uninstalling the previous version, but it seems that some manual
intervention is needed to make this happen.
Is it possible that your windows setup disallows the stealing of focus
and instead you get flashing taskbar buttons? This might prevent the
installers/uninstallers appearing on the desktop in the order that was
intended. What do you think?
This isn't quite what I saw happening. The 4.01 deinstall actually got the
focus and came to the foreground, with the 4.02 install running along
happily in the background, without waiting for the deinstall to finish.
Similarly, the 4.01 uninstaller seems to require a reboot to be
This is not normally required for winpcap, but may be a result of the
installers being executed in the wrong order and a file locking clash.
After this, WinPcap 4.02 was visible in the "Add/Remove Programs" list,
wasn't uninstallable (gave an error that it might have been uninstalled
already, could then only remove it from the list of installed programs).
This is entirely consistent with the nmap-winpcap installer being run
and installing the files which are then removed by the winpcap
uninstaller. The registry keys for Add/Remove programs are different
for the two installations and so the nmap-winpcap are not removed by the
winpcap uninstaller and remain there, but without any files installed.
Please let us know whether you agree, or not, that this is what may have
Uninstalling Nmap, completing the required 4.01 uninstall reboot and
restarting the install of Nmap 4.50 + WinPcap 4.02 works :).
We perhaps need to look at the nmap-winpcap installer again and only do
an upgrade if the previous version detected is an nmap-winpcap one thus
not executing a separate uninstaller.
If a different (eg a wireshark winpcap) install is found, we should
perhaps prompt the user to uninstall it themselves and rerun nmap
installation again, aborting nmap-winpcap at that time.
I ran into another issue with the nmap-winpcap install ...
When trying to deinstall nmap + winpcap (and ethereal) to try and duplicate
the issue, the 4.02 version of nmap-winpcap refused to deinstall cleanly.
The DLLs of 4.02 remained in the system32 directory after deinstall (and
even after reboot). This made it impossible to reinstall 4.01, since 4.01
detects the DLLs and aborts install. Renaming the DLLs leads to an error
when the 4.01 installer tries to register the NPF driver. The 4.02
installer I downloaded from winpcap.org now also gives errors on the NPF
driver when installing.
Somehow the deinstaller doesn't quite deinstall cleanly. Is it really
necessary to repackage the original WinPcap installer?
I'll report back when I've managed to sort out the mess I've gotten my
laptop in now :)
Ignorance is no Excuse
Sent through the nmap-dev mailing list
Archived at http://SecLists.Org