F-Secure Radar scans terminate with the error message "Failed to open device eth1 (or eth0)" in the Radar portal

F-Secure Radar scans terminate with the error message "Failed to open device eth1 (or eth0)" in the Radar portal - F-Secure Community

Issue:

I notice all the Radar scans terminated. When investigating the issue in Radar portal scan log, scans ended with the following error message:


2020-03-23 07:21:46Z|DEBUG|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.Wrapper|Nmap commandline: C:\Program Files (x86)\F-Secure\RadarScanAgent\ssscans\37df885a-1100-42c4-a31e-e4b7957f2df7\yfwiw\2020_03_23\07_21_36\psng\nmap\nmap.exe --stats-every=60s -v -d --defeat-icmp-ratelimit --defeat-rst-ratelimit --min-rate 125 --max-rtt-timeout 600ms --initial-rtt-timeout 500ms --max-scan-delay 10ms --max-retries 1 --min-hostgroup 16 --version-intensity 0 -p T:0-65535,U:0-1024 -sS -sU -O -Pn -oX 608.nmap.xml -T 3 192.168.1.10
2020-03-23 07:21:47Z|ERROR|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|dnet: Failed to open device eth1
2020-03-23 07:21:47Z|DEBUG|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|wpcap.dll present, library version: Npcap version 0.9986, based on libpcap version 1.9.1
2020-03-23 07:21:47Z|ERROR|FSecure.Radar.Scanners.PortScan.PUN.NmapIntegration.NmapRunner|QUITTING!

The issue started after the scan node was automatically upgraded.

Resolution:

Make sure there is nothing that could block the scanner application (like an antivirus or firewall) by excluding the Radar Scan node agent folder C:\Program Files (x86)\F-Secure\RadarScanAgent from real-time scanning. Consult the anti-virus documentation on how to accomplish this task.
Check if the user account configured to run the Scan Node Agent service (="f-secure radar scan node agent") still has local administrator rights.

If the issue persists, apply the following fix:

Stop the radar scan node service by typing the following in elevated command prompt:

net stop "f-secure radar scan node agent"

Uninstall WinPcap 4.1.3 using the Control Panel applet "Uninstall or change a program" (note: if WinPcap is not listed as installed, proceed to the next step).
Uninstall Npcap OEM using the Control Panel applet "Uninstall or change a program"
Restart the server
Reinstall Npcap OEM

Note: We can reinstall Npcap using the Scan node agent installer, but in this case, the recommendation is to install Npcap manually. Download the latest version of "Npcap installer for Windows" here. During installation, make sure to deselect the option "Install Npcap in WinPcap API-compatible mode" as visible in the attached screenshot.

User-added image

Start the scan node service by typing the following in elevated command prompt:

net start "f-secure radar scan node agent"

The scanning node should start and complete now. If this is not the case, proceed to contact F-Secure Support.

Article no: 000010999