topic Re: Install OneAgent without WinPcap component in Open Q&A

Install OneAgent without WinPcap component

andre_vdveen — Fri, 14 Jun 2019 12:05:59 GMT

Is it possible to install OneAgent without installing the WinPcap component? Alternatively, is there a way to silently remove WinPcap after OneAgent installation?

I understand the impact of not having WinPcap installed, so not looking to debate that 😉

Re: Install OneAgent without WinPcap component

skrystosik — Fri, 14 Jun 2019 12:39:55 GMT

I don't think that impacting any dependency of OneAgent is actually good idea. OneAgent possibly will crash and not start at all.

Sebastian

Re: Install OneAgent without WinPcap component

Julius_Loman — Fri, 14 Jun 2019 14:15:26 GMT

No there is not. But you can turn off the functionality by disabling network monitoring for the agent. You , however, lose some metrics and functionality.

Re: Install OneAgent without WinPcap component

andre_vdveen — Fri, 14 Jun 2019 14:27:01 GMT

OneAgent runs fine without WinPcap, however, you lose out on network quality and connectivity metrics, which will impact the AI's ability to detect the network as the root cause of problems.

Re: Install OneAgent without WinPcap component

andre_vdveen — Fri, 14 Jun 2019 14:30:29 GMT

Unfortunately, turning off network monitoring for the agent doesn't remove the npf.sys driver, which is the real cause of concern. Hence the questions about removing it completely.

Re: Install OneAgent without WinPcap component

Joe_Hoffman — Fri, 14 Jun 2019 15:10:38 GMT

Can you clarify the reason or concern regarding having WinPcap installed. Is there a technical conflict your having or is it a security concern, or ??

Re: Install OneAgent without WinPcap component

dave_mauney — Fri, 14 Jun 2019 17:05:54 GMT

I found these internal notes that might help:

"first disable network traffic monitoring (Settings->Monitoring->Monitored technologies->Network traffic switch off), disable autoupdates (because winpcap will be installed again) and then uninstall winpcap (Control Panel -> uninstall section -> OneAgent Winpcap 4.1.3 entry)"

"Smartscape connections should be still visible. they will lost network metrics - traffic per process, responsiveness, connectivity"

Also, we are actively working to replace winpcap with a better solution and it appears that npcap is the most likely: https://nmap.org/npcap/. But there is no ETA or anything for this AFAIK.

HTH,

dave

Re: Install OneAgent without WinPcap component

andre_vdveen — Fri, 14 Jun 2019 20:00:37 GMT

Both, actually.

We've had BSOD at two clients in SA, both due to WinPcap. Once the agent is installed, they experienced blue screens. Support was involved and it was pinned down to WinPcap driver causing the issue.

The other reason is security: WinPcap has not been maintained since 2013 and doesn't have the functionality to prevent non-administrative users to gain access to the npf.sys driver used by WinPcap. Npcap is a safer option and I've been informed that Dynatrace is looking at replacing WinPcap with Npcap, but this is not 100% confirmed, nor do I have a 'cast in stone' release version or date yet. Dave also mentions this in his reply 🙂

Re: Install OneAgent without WinPcap component

andre_vdveen — Fri, 14 Jun 2019 20:16:25 GMT

@Dave M. thanks for the info and steps; I've actually tested that about a week or two ago already and that is what we've advised our client to do too. One thing: you'd have to stop the OneAgent service prior to uninstalling WinPcap, since it locks a dll. Removal takes about 5 seconds, after which the agent starts up just fine and works as expected.

The reason for my question today, was to see if anyone knows of a way to remove only the OneAgent WinPcap component, via script or another non-GUI way, but I couldn't find any - it seems WinPcap never supported silent installations, which means no way to silently remove it either...and I've been trying everything the past few days to figure that out, until I found this earlier today: https://www.winpcap.org/pipermail/winpcap-bugs/2011-January/001344.html

You're correct, the only things affected by the removal of WinPcap is network quality and network connectivity metrics, both of which unfortunately drives the AI's ability to detect the network as a possible root cause. It is the client's decision whether they can live without this, until such time WinPcap is replaced. Smartscape is not affected so far I can tell, although I always thought the network agent was the main driving force for that.

I've been given a non-commital ETA, so hoping it will be firmed up in the not too distant future.

Re: Install OneAgent without WinPcap component

Joe_Hoffman — Fri, 14 Jun 2019 20:36:51 GMT

If you're experiencing BSOD, there is a known workaround to this issue. Contact support. This can happen when swap file is disabled (one case).

As mentioned we will be replacing WinPCap.

Re: Install OneAgent without WinPcap component

Julius_Loman — Sat, 15 Jun 2019 22:05:00 GMT

Have any security tools been running on the host when BSOD happened?

Re: Install OneAgent without WinPcap component

andre_vdveen — Mon, 17 Jun 2019 09:22:18 GMT

The typical McAfee, but it is also running on hosts where they didn't experience BSOD. We ruled it out anyway, by turning McAfee off: issue persisted. Logs and crash dumps indicated npf.sys as the culprit, so we got support involved and turning off network monitoring plus removing WinPcap resolved the BSOD issue.

Re: Install OneAgent without WinPcap component

DavidePiras — Wed, 21 Apr 2021 14:17:50 GMT

almost two years later, have we made any progress with OneAgent running solely on npcap instead of relying on Winpcap?

we have performance issues at the moment with latest OneAgent using version 0.999 of npcap creating too many network handles and making our server performances poor.

Any update on a new version of OneAgent fully supporting npcap with no such issues is very much appreciated.

Davide

Re: Install OneAgent without WinPcap component

DanielS — Fri, 23 Apr 2021 02:52:01 GMT

I see this https://community.dynatrace.com/t5/Dynatrace-Open-Q-A/Replacing-Winpcap-with-npcap/td-p/117827

Re: Install OneAgent without WinPcap component

owen_chen — Tue, 07 Sep 2021 09:07:19 GMT

We have recently been questioned by the auditing unit because of the issue of "winpcap". Is there any progress?

Re: Install OneAgent without WinPcap component

eertul — Thu, 14 Oct 2021 09:08:13 GMT

Hello all,

I couldn't find any solid work about replacing winPcap with npcap yet. So, I will have another question about it.

Is there any chance to use this application as someone else except Dynatrace agent? If I can proove that no one can use it except Dynatrace, it will be enough. Otherwise, it's a security issue to keep winPcap installed on servers anyway.

Besties,

Erhan.

Re: Install OneAgent without WinPcap component

MaciejNeumann — Tue, 14 Dec 2021 12:48:00 GMT

According to the documentation, Npcap installation of OneAgent is already available:

Uninstall WinPcap driver to allow Npcap installation