RE: Most final release candidate yet: Nmap 4.49RC6

["Sina Bahram" <sbahram () nc rr com>]

I'll try the registry key now, reboot, and let you know.

As for the "first time", i meant, the first time in quite a while.

Take care,
Sina

-----Original Message-----
From: Rob Nicholls [mailto:robert () everythingeverything co uk] 
Sent: Monday, December 10, 2007 9:02 AM
To: Sina Bahram
Cc: nmap-dev () insecure org
Subject: RE: Most final release candidate yet: Nmap 4.49RC6

Sina,

Do you have UAC enabled? If so, have you tried changing the following
registry key and restarting Vista?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF\Start

Set the value to 2 (instead of the default of 3), so Vista will load the
WinPcap driver at startup. It should persist, and also allows you to run
nmap from a standard user account (which is why it works with a non-elevated
command prompt when you have UAC enabled).

Gianluca explained this a while back:

http://seclists.org/nmap-dev/2007/q1/0195.html

I should probably point out that having WinPcap running at startup
technically increases the risk of a vulnerability being exploited, as the
driver is always running, rather than loaded and unloaded as required.

When you say "things appear to work, for the first time", do you mean it
only works the first time (and then stops working), or that it works first
time (and continues to work)?


Rob


> I'm running vista.
>
> With static or dhcp, I still get:
>
> dnet: Failed to open device eth15
>
> If I run in an elevated cmd window, then things appear to work, for 
> the first time.
>
> Take care,
> Sina


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org