Issue:
I notice all the Radar scans terminated. When investigating the issue in Radar portal scan log, scans ended with the following error message:
2020-03-23 07:21:46Z|DEBUG|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.Wrapper|Nmap commandline: C:\Program Files (x86)\F-Secure\RadarScanAgent\ssscans\37df885a-1100-42c4-a31e-e4b7957f2df7\yfwiw\2020_03_23\07_21_36\psng\nmap\nmap.exe --stats-every=60s -v -d --defeat-icmp-ratelimit --defeat-rst-ratelimit --min-rate 125 --max-rtt-timeout 600ms --initial-rtt-timeout 500ms --max-scan-delay 10ms --max-retries 1 --min-hostgroup 16 --version-intensity 0 -p T:0-65535,U:0-1024 -sS -sU -O -Pn -oX 608.nmap.xml -T 3 192.168.1.10
2020-03-23 07:21:47Z|ERROR|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|dnet: Failed to open device eth1
2020-03-23 07:21:47Z|DEBUG|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|wpcap.dll present, library version: Npcap version 0.9986, based on libpcap version 1.9.1
2020-03-23 07:21:47Z|ERROR|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|QUITTING!
The issue started after the scan node was automatically upgraded.
Resolution:
- Make sure there is nothing that could block the scanner application (like an antivirus or firewall) by excluding the Radar Scan node agent folder C:\Program Files (x86)\F-Secure\RadarScanAgent from real-time scanning. Consult the anti-virus documentation on how to accomplish this task.
- Check if the user account configured to run the Scan Node Agent service (="f-secure radar scan node agent") still has local administrator rights.
If the issue persists, apply the following fix:
- Stop the radar scan node service by typing the following in elevated command prompt:
- net stop "f-secure radar scan node agent"
- Uninstall WinPcap 4.1.3 using the Control Panel applet "Uninstall or change a program" (note: if WinPcap is not listed as installed, proceed to the next step).
- Uninstall Npcap OEM using the Control Panel applet "Uninstall or change a program"
- Restart the server
- Reinstall Npcap OEM
Note: We can reinstall Npcap using the Scan node agent installer, but in this case, the recommendation is to install
Npcap manually. Download the latest version of "Npcap installer for Windows"
here. During installation, make sure to
deselect the option "Install Npcap in WinPcap API-compatible mode" as visible in the attached screenshot.

- Start the scan node service by typing the following in elevated command prompt:
- net start "f-secure radar scan node agent"
The scanning node should start and complete now. If this is not the case, proceed to contact F-Secure Support.
Article no: 000010999