Blocking all network traffic works for a few minutes only

[donnykwan]

I capture all the outgoing packets and drop them, this blocks all the network traffic and I cannot use a web browser to visit any website. But after a few minutes (5 minutes?), the network traffic is back to normal and I can visit websites again. It seems the ndisapi stops working.

[Vadim Smirnov]

Neither ndisapi nor the NDIS driver have no time limit.

Of course, I cannot guess what exactly happens on your PC, however, for example, it can happen if you have LAN and WiFi (or LTE, or etc..) network interfaces on your computer and both are connected to your router. My laptop is configured this way. Now lets assume that your application is filtering (and blocking packets) on wired network adapter only. By default, Windows uses a wired network adapter, so once you start blocking packets, it looses connectivity as expected. However, Windows detects that the Internet is not available through the default adapter, and after a while it switches to Wi-Fi Connection and you are able to browse Internet again.

[donnykwan]

I have WiFi only, but I do have more than one WiFi configuration. The WiFi connection did not change during that period.

I started Wireshark after the blocking started. After a few minutes, Wireshark showed a message dialog:

“The network adaptor “Wi-Fi” is no longer attached; the capture has stopped.

If you have not removed that adaptor, this may be a bug in Npcap; please report it as in issue at https://github.com/nmap/npcap/issues

Give all details, such as

………”

I could use web browser then even the blocking was still running (but it could not capture any packet either).

[Vadim Smirnov]

Another possibility is that Windows tries to repair WiFi connection by disabling and re-enabling it. This operations effectively switch off filtering, so you have to monitor the network adapters changes by setting an adapter list change event and reconfiguring filtering.

I think it will be easier to discuss if you post your code here, may be you are doing something wrong.

[donnykwan]

Having trouble uploading the code. It complained spamming.

[Vadim Smirnov]

You can send your code to support(at)ntkernel.com

[Author]

Posts