8

EDIT: I Have found that Nmap can work in unprivileged mode. A question related to that can be found here.

I recently installed NMap 6.49BETA4, and the ZenMap GUI, on my Windows 7 Home Premium x64. I'm not familiar with NMap at all, so I expect this to be a very simple solution. When I ran the default scanme.nmap.org, scan, I received this error:

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-07-28 13:26 Eastern Daylight Time
NSE: Loaded 122 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 13:27
Completed NSE at 13:27, 0.00s elapsed
Initiating NSE at 13:27
Completed NSE at 13:27, 0.00s elapsed
Initiating Ping Scan at 13:27
dnet: Failed to open device eth1
QUITTING!

When I run --iflist, I get this return:

***********************INTERFACES************************
DEV  (SHORT) IP/MASK                      TYPE        UP   MTU  MAC
eth0 (eth0)  fe80::a167:b6ca:c16f:282b/64 ethernet    down 1500 66:6D:57:28:DB:41
eth0 (eth0)  169.254.40.43/4              ethernet    down 1500 66:6D:57:28:DB:41
eth1 (eth1)  fe80::f4e6:8b28:e268:72f0/64 ethernet    up   1500 44:6D:57:28:DB:41
eth1 (eth1)  192.168.1.6/24               ethernet    up   1500 44:6D:57:28:DB:41
eth2 (eth2)  fe80::581e:d69e:7f23:7640/64 ethernet    down 1500 24:00:04:18:00:22
eth2 (eth2)  169.254.118.64/4             ethernet    down 1500 24:00:04:18:00:22
lo0  (lo0)   ::1/128                      loopback    up   -1
lo0  (lo0)   127.0.0.1/8                  loopback    up   -1
tun0 (tun0)  (none)/0                     point2point down 1280
tun1 (tun1)  fe80::5efe:c0a8:106/128      point2point down 1280
tun2 (tun2)  (none)/0                     point2point down 1280
tun3 (tun3)  fe80::e0:0:0:0/64            point2point down 1280
tun4 (tun4)  (none)/0                     point2point down 1280
tun5 (tun5)  (none)/0                     point2point down 1280
DEV  WINDEVICE
eth0 none
eth0 none
eth1 none
eth1 none
eth2 none
eth2 none
lo0  none
lo0  none
tun0 none
tun1 none
tun2 none
tun3 none
tun4 none
tun5 none

I'm almost positive that the lack of a WINDEVICE linked with eth1 is the problem, but I'm blank on how to fix it

Addition Information: Wireless Adapter: Atheros AR5B125 Wireless Network Adapter

Beginning of ipconfig /all:

Windows IP Configuration

  Host Name . . . . . . . . . . . . : MyName-PC
  Primary Dns Suffix  . . . . . . . :
  Node Type . . . . . . . . . . . . : Broadcast
  IP Routing Enabled. . . . . . . . : Yes
  WINS Proxy Enabled. . . . . . . . : No
  DNS Suffix Search List. . . . . . : home

Wireless LAN adapter Wireless Network Connection:

  Connection-specific DNS Suffix  . : home
   Description . . . . . . . . . . . : Atheros AR5B125 Wireless Network Adapter
   Physical Address. . . . . . . . . : 44-6D-57-28-DB-41
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f4e6:8b28:e268:72f0%25(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.6(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, July 28, 2015 11:53:44 AM
   Lease Expires . . . . . . . . . . : Tuesday, July 28, 2015 2:28:11 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 457469271
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-17-28-44-78-E8-40-F2-BE-96->45
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Sorry for the long question.

Improve this question
14
  • Tried to run it as administrator? E.g. Wireshark doesn't like it when you're not runnin it specifically as admin.
    – Milen
    Commented Jul 28, 2015 at 18:15
  • Yes, the same problem persists.
    – Colin
    Commented Jul 28, 2015 at 18:37
  • 1
    If you're running it via "right-click->run as Administrator" and it still gives you trouble, then you're probably missing (or not having properly installed) WinPcap - winpcap.org -> go get it and you should be better.
    – Milen
    Commented Jul 28, 2015 at 18:44
  • 1
    That's how I always run NMap, but I haven't tried reinstalling WinPcap. Thanks for the suggestion!
    – Colin
    Commented Jul 28, 2015 at 18:48
  • Unfortunately, Reinstalling WinPcap 4.1.3 doesn't work. The installer recognizes that WinPcap is already installed. Even with the force install option, I receive the exact same error. :(
    – Colin
    Commented Jul 28, 2015 at 18:56

5 Answers 5

Reset to default
9

It turns out this ended up as a top result on Google for the stated error message. I uninstalled WinPCap (may not be necessary) and then installed Nmap version 7.01, which solved the issue for me without using the cygwin solution mentioned in the comments of the original question.

Update: I believe (for me) this may actually be a conflict with the winpcap version that Nessus uses. Both boxes that I've had this issue with have had both installed. So in addition to the above fix, make sure that the nessus service is shut down (if installed). I would also recommend (as others have stated) to grab the legit version of winpcap and NOT install it during the nmap install (just uncheck it in the installer).

tl;dr

Ensure the Nessus service isn't running (if installed)

Uninstall WinPCap

Install WinPCap from winpcap.org

Install Nmap 7.01 (uncheck winpcap in the installer)

Improve this answer
1
  • WinPcap, though still available for download (v4.1.3), has not seen an upgrade in many years and there are no road map/future plans to update the technology. While community support may persist, technical oversight by Riverbed staff, responses to questions posed by Riverbed resources, and bug reporting are no longer available. Gordon Lyon, Nmap project founder, has created Npcap, a packet capture library for Windows, that includes WinPcap compatibility and may be a suitable replacement for WinPcap and WinPcap Pro. nmap.org/npcap/vs-winpcap.html
    – HackSlash
    Commented Jun 20, 2019 at 18:17
5

I did just the opposite as eficker, I removed npcap that was installed during the installation of zenmap because I already had winpcap installed for wireshark. Once npcap was removed, zenmap stopped reporting the issue with eth0.

So the issue appears to be a confilct between npcap and winpcap. If you have both installed, it gives you this error.

Improve this answer
2
  • 1
    I uninstalled "npcap" as well and that worked for me, thanks Nathan.
    – Ben
    Commented Dec 19, 2016 at 16:18
  • I just uninstalled npcap, then run nmap, it gave a warning (WARNING: Could not import all necessary Npcap functions. You may need to upgrade to version 0.07 or higher from http://www.npcap.org. Resorting to connect() mode -- Nmap may not function completely), but finished successfully. And npcap I uninstalled is the one coming with nmap chocolatey package.
    – x-yuri
    Commented Dec 20, 2016 at 11:28
0

tl;dr Use official winpcap

I have yet another slightly different answer. I don't have wireshark installed. And it's nmap-7.31 now.

Originally, I installed nmap with chocolatey. But it gave me Failed to open device error. Then I uninstalled npcap which came with nmap. And nmap said:

WARNING: Could not import all necessary Npcap functions. You may need to
upgrade to version 0.07 or higher from http://www.npcap.org. Resorting to
connect() mode -- Nmap may not function completely

But finished successfully. I tried the above with installer from nmap.org, but it was the same.

Then I've run into the following suggestion:

Also please try it with the official WinPcap 4.0.2 installer, available at http://www.winpcap.org/install/default.htm. Remove the Nmap winpcap from "Add or Remove Programs" first, then run the installer.

And it worked.

Improve this answer
0

Download the actual npcap executable from npcap.org after uninstalling the one that comes with nmap. That did the trick for me. No more error message finding eth0. No more error message saying npcap functions not importing. Done.

Improve this answer
0

TLDR: Use --unprivileged nmap option.

I just suffered the same problem when tried to scan/test hosts thru a Wireguard 0.3.14 tunnel in Windows 8.1 and Windows 7 using the last available versions, nmap 7.91, npcap 1.31. Tried several solutions/combinations, running as admin, reinstalling, etc., except downgrading to Winpcap 4.1.3 (the last available) with the same result:

C:\Windows\system32>nmap -n -P0 -p 22 192.168.20.1
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-08 13:28 Hora de verano central (México)
dnet: Failed to open device eth0
QUITTING!

It's strange that the interface listing of nmap --iflist does not show a device name associated with eth0 (also doesn't show a MAC address, maybe it's Wireguard interface driver install/hooks at fault here). Relevant lines:

C:\Windows\system32>nmap --iflist
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-08 13:32 Hora de verano central (México)
************************INTERFACES************************
DEV  (SHORT) IP/MASK                      TYPE     UP   MTU   MAC
eth0 (eth0)  10.10.252.92/32              ethernet up   65535 00:00:00:00:00:00
    :
DEV  WINDEVICE
eth0 <none>

Relevant route print:

C:\Windows\system32>route print
===========================================================================
Interface list
8...........................Wintun Userspace Tunnel #77
  :
IPv4 Route table
===========================================================================
Active routes:
Network Destination       Net mask   Gateway   Interface       Metric
192.168.20.0         255.255.255.0   On-link   10.10.252.92      5
192.168.20.255     255.255.255.255   On-link   10.10.252.92    261

Solved it using the --unprivileged option:

C:\Windows\system32>nmap --unprivileged -n -P0 -p 22 192.168.20.1
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-08 13:22 Hora de verano central (MÚxico)
Nmap scan report for 192.168.20.1
Host is up (0.20s latency).

PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.