Introduction
This document describes an interaction between the roaming client and the npcap software. If you are not using npcap, this article does not apply.
Background Information
When using npcap, the symptom of this interaction a total DNS failure for A and AAAA record types while the roaming client is active. TXT records can still succeed, allowing the roaming client to enter an encrypted mode.
What is Npcap?
Npcap is a third party software for packet capturing. During installation, npcap can install a npcap network interface onto the computer in order to facilitate captures. To confirm if npcap is installed in a way that can interfere with us, validate if there is a npcap network interface. If so, read on!
Impacts and Resolution
In some cases, the presence of the npcap driver can cause DNS sent to the roaming client to not reach its final destination. The impact is A and AAAA records time out and fail, resulting in a failure to load webpages. The browser error is most commonly a DNS failure NXDOMAIN. The roaming client can remain in "Protected and Encrypted" mode despite the full DNS failure due to Umbrella checks being made against TXT records, and npcap only is known to impact A and AAAA records.
To validate if npcap is the root cause:
- Open up the network and sharing center
- Click to view network interfaces
- Right click and disable the npcap interface
- Confirm if the issue immediately resolves
If the issue vanishes immediately upon disabling the npcap network interface, this confirms that the npcap NIC and driver are the root cause of the DNS resolution issue and can need to be uninstalled in order to run the roaming client correctly. This interoperability interaction occurs at the npcap level before DNS arrives to 127.0.0.1:53 where the roaming client is bound.
Feedback