Proneta Network Adapter Not Detected: Replace WinPcap with Npcap

Problem Summary

Siemens PRONETA (PROFINET Network Analysis) is the standard field tool for topology discovery, IO check, and network commissioning of PROFINET and standard Ethernet segments. After a major Windows 10 cumulative update (most commonly seen with build 1909 → 20H2 transitions and later 21H1 / 21H2 feature upgrades), PRONETA Basic 2.7, 3.1, and 3.2.0 may fail to enumerate any local network adapters. The main window displays an empty adapter list, the Topology scan button stays inactive, and the IO test cannot select an interface.

Typical accompanying symptoms:

• The Network adapters dropdown on the PRONETA start screen is empty.
• The Settings → Network panel reports No adapter found.
• Re-installing the bundled WinPcap driver fails with a dialog referencing npf.sys load failure, error code 0x800F0922 or 0x800F081F.
• Running PRONETA.exe as administrator does not restore adapter detection.
• Manually installing WinPcap_4_1_3.exe exits with "Could not install the driver NPF".

Affected Versions and Environment

PRONETA uses the WinPcap API to enumerate and bind to Ethernet adapters. The legacy WinPcap project has been unmaintained since 2013 and its npf.sys kernel driver is not signed for Windows 10 20H2+ Secure Boot enforcement. The post-update driver signature revocation list rejects the legacy npf.sys, which is the root cause of the install failure and the missing adapter list.

Root Cause Analysis

Three independent failure paths converge on the same symptom:

1. Driver signature enforcement. Modern Windows builds enforce Windows Hardware Quality Labs (WHQL) signing. The shipped npf.sys inside the PRONETA installer is signed with an older certificate that Microsoft has revoked via db and dbx EFI variables after the cumulative update. The OS returns ERROR_DRIVER_BLOCKED (0x800F0922).
2. Network adapter enumeration path. PRONETA's network module queries HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards through the WinPcap service to build its dropdown. If the service is not started, the registry subkeys still exist but the tool cannot open the adapter handle. Microsoft documents this enumeration path in the Network Adapters not displayed in advanced network settings knowledge base article, which is the same registry path PRONETA relies on.
3. Universal Windows Platform (UWP) packet capture. Windows 10 20H2 introduced the PacketDirect provider as a replacement. WinPcap does not register with PacketDirect, so the adapter bind fails silently even when installation appears to succeed.

The robust fix is to migrate the packet-capture stack to Npcap, the actively maintained WinPcap drop-in replacement that ships signed by Insecure.Com LLC and exposes the same pcap_open_live / pcap_findalldevs API surface that PRONETA's binary expects.

Prerequisites

• Local administrator account on the engineering workstation.
• Internet access to nmap.org/npcap for the current installer (Npcap 1.78 at the time of writing).
• Working Ethernet or Wi-Fi adapter with PROFINET access if the fix will be validated against live devices.
• Approx. 10 MB of free disk space and a clean Windows driver store (C:\Windows\System32\drivers must not be locked by an in-progress DISM or sfc run).
• Optional: 7-Zip or Expand.exe to inspect the PRONETA installer.

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" C:\backup\NetworkCards.reg /y

Step-by-Step Fix: Replace WinPcap with Npcap

1. Remove the broken WinPcap installation.

   Open Settings → Apps → Apps & features and uninstall WinPcap 4.1.3. If the entry is missing, run:

   sc stop npf
   sc delete npf
   del /f /q "%SystemRoot%\System32\drivers\npf.sys"

   Reboot the workstation to clear the blocked driver image from memory.

2. Download the current Npcap release from the official repository: https://nmap.org/npcap/. Use the Npcap 1.78 OEM or Installer build — not the source archive.
3. Launch the installer as administrator and step through the wizard. On the Installation Options dialog, enable the following checkboxes:

4. Click Install and accept the driver signing prompt (it is signed by Insecure.Com LLC).
5. Reboot. The Npcap service npcap is registered as a kernel service and must start at boot.
6. Verify the driver load from an elevated command prompt:

   sc qc npcap
   packet.dll --version

   Expected return includes START_TYPE: 0 BOOT_START and a reported version string matching the installer (e.g. 1.78.0-r0).

7. Start PRONETA as administrator. Open PRONETA Basic 3.x from the desktop shortcut with right-click → Run as administrator. The network adapter dropdown should now display every wired and wireless interface visible to the OS.

Step-by-Step: Verify the NetworkCards Registry Branch

If the adapter list is still empty after the Npcap install, the underlying Windows enumeration may itself be broken (the cumulative update can occasionally clear the NetworkCards subkeys for virtual adapters). Microsoft documents this exact symptom in Network Adapters not displayed in advanced network settings.

1. Open regedit.exe as administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards.
3. Confirm each physical interface has a subkey 1, 2, 3, ... with values:

   Name         REG_SZ    "Intel(R) Ethernet Connection I219-LM"
   ServiceName   REG_SZ    "e1dexpress"
   Description  REG_SZ    "Intel(R) Ethernet Connection I219-LM"

4. If the key is missing entirely, run netcfg -winpe followed by netcfg -e to re-enumerate. A full network stack reset can also be triggered with:

   netsh winsock reset
   netsh int ip reset
   ipconfig /flushdns
   reboot

5. Re-test PRONETA. The Adapter selector in the Topology and IO test screens should populate.

Step-by-Step: Administrative Privileges and Service Configuration

PRONETA opens the capture handle with OpenService(SERVICE_QUERY_CONFIG | SERVICE_START | SERVICE_USER_DEFINED_CONTROL) and binds the adapter via the Network Packet Filter alias. If the npcap or npf service is not started, the call fails with ERROR_SERVICE_NOT_ACTIVE (0x80070426).

1. Set the service to automatic:

   sc config npcap start= auto
   sc start npcap

2. Confirm the ServiceSidType is 0x3 (SERVICE_SID_TYPE_UNRESTRICTED). If a group policy has downgraded it, restore with:

   reg add "HKLM\SYSTEM\CurrentControlSet\Services\npcap" /v Type /t REG_DWORD /d 0x1 /f

3. Disable Memory integrity in Windows Security → Device security → Core isolation only if Npcap fails to load with a code-integrity 0x80070241 error. This is a fallback for Windows 11 22H2 hosts where the HVCI hash for the new npcap.sys is not yet in the Code Integrity Allow List.

Verification and Functional Test

1. Launch PRONETA, switch to the Network analysis tab, and confirm the adapter dropdown lists at least one interface.
2. Select the PROFINET-bound Ethernet port, click Read → Topology. A successful scan returns the controller, every switch, and every IO device with their device names, IP addresses, and PROFINET station names.
3. Run IO test with a known-good ET 200SP or ET 200MP station. All configured slots must report OK and the Port Statistics counters should increment.
4. Cross-validate the scan with Wireshark 4.x bound to the same adapter through Npcap. A single PROFINET DCP IdentifyAll request must be visible. If Wireshark sees traffic but PRONETA does not, the issue is the WinPcap API-compatible Mode flag — re-run the Npcap installer and enable it.

Troubleshooting Matrix

Rollback Considerations

If a clean Windows reinstall is acceptable, a fresh image of Windows 10 22H2 with PRONETA 3.2.0 and Npcap 1.78 installed before any cumulative update does not exhibit the issue. The patch sequence is therefore:

1. Deploy OS image.
2. Install Npcap 1.78 with WinPcap API-compatible Mode enabled.
3. Install PRONETA 3.2.0.
4. Validate the topology scan on a bench PROFINET line.
5. Defer Windows quality updates to the Current Branch for Business cadence (four months) to avoid the early-WHQL period during which Microsoft revokes the legacy driver certificate.

Do not roll back a Windows 10 feature update to recover PRONETA. The legacy npf.sys signature is also revoked in earlier branches, so a downgrade is no guarantee of success and exposes the workstation to months of missing security patches.

Cross-References and Tool Compatibility

The same Npcap substitution fixes other WinPcap-based PROFINET tools, including:

• Wireshark 3.6 and 4.x — set Edit → Preferences → Advanced → Capture → Use Npcap.
• Siemens Primary Setup Tool (PST) 5.x — Npcap fully replaces the bundled WinPcap.
• PROFINET IO Test Tool from PI International.
• PRONETA Professional 4.x — already uses the Npcap installer shipped by Siemens PRONETA documentation in the TIA Portal Manual Collection.

FAQ