[Oisf-users] Install Suricata on Win 10 with Npcap?

[Peter Manev]

On Wed, May 1, 2019 at 8:19 PM Thomas Drebert <drebert at web.de> wrote:
>
> Hello,
>
> if I check the wpcap.dll in a hex editor, I can only find a
> pcap_dump_open. I find a WinPcap issue that in the last version
> pcap_dump_fopen is missing.
>

You need to have npcap installed on the system -
https://nmap.org/npcap/ - do you have that?
Can you please sen a screenshot/out put of the error?
You are using Win 10 - correct ?

Thank you

> regards
> Thomas D.
>
> Am Mi., 1. Mai 2019 um 19:54 Uhr schrieb Thomas Drebert <drebert at web.de>:
> >
> > Hello,
> >
> > sorry, but this doesn't work for me. I get always this error:
> > "The procedure entry point "pcap_dump_fopen" was not found in the DLL
> > "C: \ Program Files \ Suricata \ suricata.exe".
> > This is my Suricata Directory:
> > 01.05.2019  19:46    <DIR>          .
> > 01.05.2019  19:46    <DIR>          ..
> > 21.01.2012  17:39                36 batch.bat
> > 07.03.2019  04:38             4.167 classification.config
> > 01.05.2019  19:46                 0 dirout.txt
> > 28.08.2018  03:01           169.631 HOW_TO_Windows.pdf
> > 18.01.2018  04:22           232.340 libGeoIP-1.dll
> > 25.04.2018  23:33            79.194 libjansson-4.dll
> > 10.05.2018  02:24           121.058 liblz4.dll
> > 02.05.2018  10:46           154.319 liblzma-5.dll
> > 11.04.2018  23:47           313.828 libnspr4.dll
> > 30.07.2018  16:02         1.928.216 libpcre-1.dll
> > 11.04.2018  23:47            28.974 libplc4.dll
> > 11.04.2018  23:47            22.901 libplds4.dll
> > 16.07.2018  01:28            57.317 libwinpthread-1.dll
> > 30.07.2018  16:04           783.396 libyaml-0-2.dll
> > 20.01.2012  17:17            17.987 LICENSE
> > 01.05.2019  17:14    <DIR>          log
> > 27.09.2017  22:03           244.502 lua53.dll
> > 25.07.2018  22:28         5.305.856 magic.mgc
> > 16.07.2016  06:18           634.824 msvcrt.dll
> > 27.06.2018  12:39         1.259.688 nss3.dll
> > 27.06.2018  12:39           163.061 nssutil3.dll
> > 07.03.2019  04:38             1.375 reference.config
> > 01.05.2019  17:16    <DIR>          rules
> > 10.03.2019  08:27        49.719.350 suricata.exe
> > 28.08.2018  03:04            68.046 suricata.yaml
> > 03.08.2018  02:51            23.552 WinDivert.dll
> > 03.08.2018  02:51            50.592 WinDivert64.sys
> > 27.04.2019  23:00           387.384 wpcap.dll
> > 19.07.2018  05:33            93.208 zlib1.dll
> >               27 Datei(en),     61.864.802 Bytes
> >
> > If I start Suricata by click on the icon, a cmd window is open and an
> > error window is popup.
> > I use the last msi from the Download Site.
> >
> > regards
> > Thomas D.
> >
> > Am Mi., 1. Mai 2019 um 18:48 Uhr schrieb Peter Manev <petermanev at gmail.com>:
> > >
> > > On Wed, May 1, 2019 at 5:21 PM Thomas Drebert <drebert at web.de> wrote:
> > > >
> > > > Hello,
> > > >
> > > > I make some tests, it is not a Npcap problem, I uninstall Npcap and
> > > > Suricata, reboot and install Suricata again. But I have the same
> > > > Error:
> > > > "The procedure entry point "pcap_dump_fopen" was not found in the DLL
> > > > "C: \ Program Files \ Suricata \ suricata.exe".
> > > >
> > >
> > > You need npcap/wpcap.dll in the same folder or in the System Path
> > > You could also try our msi pkg - https://suricata-ids.org/download/ -
> > > should work right out of the box installation.
> > > (the newer stable will be out soon)
> > >
> > > > regards
> > > > Thomas D.
> > > >
> > > > Am Di., 30. Apr. 2019 um 19:05 Uhr schrieb Thomas Drebert <drebert at web.de>:
> > > > >
> > > > > Hello,
> > > > >
> > > > > I try to install Suricata on Windows 10, but I have installed the Npcap Driver and I get the wpcap.dll error, I try Npcap install in WinPcap API Mode, but now I get this Error "pcap_dump_fopen".
> > > > > What can I do?
> > > > >
> > > > > regards
> > > > > ThomasD
> > > > _______________________________________________
> > > > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> > > > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> > > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> > > >
> > > > Conference: https://suricon.net
> > > > Trainings: https://suricata-ids.org/training/
> > >
> > >
> > >
> > > --
> > > Regards,
> > > Peter Manev
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/



-- 
Regards,
Peter Manev