WinDbg kernel mode debugging using ETHERNET not working

Question

I am trying to get WinDbg to debug a target machine using a manual Ethernet cable as described at https://msdn.microsoft.com/en-us/library/windows/hardware/hh439346(v=vs.85).aspx

However, WinDbg on the host seems to be stuck Waiting to reconnect... forever. Any ideas what could be wrong?

Both machines are running Windows 10 Enterprise x64. I also disabled firewall on both machines.

I double checked both my host and target NICs and made sure they are both supported.

Target NIC is

Intel(R) 82579LM Gigabit Network Connection
PCI\VEN_8086&DEV_1502&SUBSYS_161C103C&REV_04

Host NIC is

Broadcom NetLink(TM) Gigabit Ethernet
PCI\VEN_14E4&DEV_1692&SUBSYS_033D1025&REV_01

bcdedit /dbgsettings shows

C:\WINDOWS\system32>bcdedit /dbgsettings
key                     1.2.3.4
debugtype               NET
hostip                  192.168.0.104
port                    50000
dhcp                    Yes
The operation completed successfully.

I also made sure the host is accessible from my target machine using ping.

ipconfig /all yields the following:

Ethernet adapter Local Area Connection* 1:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Kernel Debug Network Adapter
   Physical Address. . . . . . . . . : XX-XX-XX-XX-XX-XX
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::20dc:c393:bcdb:b26%3(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.101(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Sunday, December 4, 2016 11:37:04 AM
   Lease Expires . . . . . . . . . . : Sunday, December 4, 2016 1:37:04 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 65278299
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-78-0A..XXX
   DNS Servers . . . . . . . . . . . : 192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

This is obvious from the name of the NIC - "Microsoft Kernel Debug Network Adapter". This is the magic NIC Windows uses so networking can actually work while KDNET is holding the a actual NIC. See https://blogs.msdn.microsoft.com/ndis/2014/03/10/kernel-debugging-over-the-network/ — conio, Dec 07 '16 at 00:22

score 1 · Answer 1 · answered Jul 14 '19 at 05:47

You can run KDNET utility to check whether your NIC is supported for Kernel Debug or not. KDNET should be in the following path if you install the WDK in the default path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kdnet.exe

And also, if your NIC is not supported, you can use an virtual machine as a target PC instead, here is the instruction from Microsoft Docs: Setting Up Kernel-Mode Debugging of a Virtual Machine Manually using a Virtual COM Port

WinDbg kernel mode debugging using ETHERNET not working

1 Answers1