What are WAN Miniport, Microsoft Kernel Debug Network Adapter, and why?

Question

What are WAN Miniport, Microsoft Kernel Debug Network Adapter, and why?

Nobody 5

WAN Miniport, Microsoft Kernel Debug Network Adapter

First, why I'm asking this here:

You have asked us some questions and provided us with some of the answers you have gotten in the community.

I noticed that you would like to go deeper into this area, for example, you would like to understand the cause or get a further explanation, and you would also like to know about the application of network adapters and the Microsoft kernel debugging packets running on network adapters and WAN micro ports.

We're sorry that we can't provide you with more in-depth answers, but please don't worry, your question is better suited to be posted on Microsoft Learn, and here's the link that directs you to Microsoft Learn.

Windows 10 Network - Microsoft Q&A

Once you click on the link, sign in to your Microsoft account at the top right and click Ask a question to post your question. There will be more specialized support staff and developers here with more in-depth knowledge of Windows systems and more development experience, and I'm providing you with the Network section, which will also have support staff who specialize in networking to provide you with more targeted help in this area.

Thank you for your understanding and support.

Best regards,

Zev - MSFT | Microsoft Community Support Specialist

The questions:

What are these two devices listed under Device Manager -> Network Adapters? (they're hidden - show hidden devices in view menu)

and why are they there?

Microsoft Kernel Debug Network Adapter (not grayed out)
WAN Miniport (SSTP) (grayed out)

Regarding 1)

Answers at answers.microsoft.om offer up things like the following, but no explanations of what or why.

"Thank you for contacting Microsoft Community Forums.

I would suggest you to make sure debugging is turned off and check the status of the issue.

a) Run this from an elevated command prompt: bcdedit /debug off

b) If it’s still showing up, then you can disable it from the device manager without problems."

Regarding 2)

"I’m happy to help you today.

This is normal and you don't need to worry about it, the WAN Miniport is a software adapter used by the operating system to access the WAN. In most cases, the WAN Miniport is used to connect to the Internet via the point-to-point protocol over the Ethernet connection."

Additional questions:

What traffic runs through these adapters (which programs use them)?

Running Wireshark, where do I see the packets running through Microsoft Kernel Debug Network Adapter and WAN Miniport?

Nobody 5 Reputation points

2024-10-10T20:12:30.3966667+00:00

Jill Zhou,

Thanks for answering.

1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

...protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since the mid-2000s in an enterprise environment, using copper. Safe to say I don't need WAN Miniport? Can you name any modern applications that still use those protocols in an average home user, fiber-to-the-prem scenario?

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would have thought the CrowdStrike fiasco would have precluded any vector into the kernel of any machine. I never knowingly allow remote-anything into my machine. Is there a situation where an average home PC user would need this?

Since you didn't mention it, is it safe to assume packet analyzers don't have access to the packets flowing on these adapters?

Sincerely,

Nobody
Nobody 5 Reputation points

2024-10-13T21:48:16.6+00:00

Out of control AI bot deleting comments for no reason.

2 answers

Your answer

Nobody 5 Reputation points

2024-10-10T20:12:30.3966667+00:00

Jill Zhou,

Thanks for answering.

1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

...protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since the mid-2000s in an enterprise environment, using copper. Safe to say I don't need WAN Miniport? Can you name any modern applications that still use those protocols in an average home user, fiber-to-the-prem scenario?

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would have thought the CrowdStrike fiasco would have precluded any vector into the kernel of any machine. I never knowingly allow remote-anything into my machine. Is there a situation where an average home PC user would need this?

Since you didn't mention it, is it safe to assume packet analyzers don't have access to the packets flowing on these adapters?

Sincerely,

Nobody
Nobody 5 Reputation points

2024-10-13T21:48:16.6+00:00

Out of control AI bot deleting comments for no reason.

Answer 1

Jing Zhou 7,765 Microsoft External Staff

Hello,

Thank you for posting in Q&A forum.

To answer your question:

1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

REF: https://learn.microsoft.com/en-us/windows-hardware/drivers/network/wan-miniport-drivers

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best regards，

Jill Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.

Nobody 5 Reputation points

2024-10-10T19:45:10.3766667+00:00

Jill,

Thanks for answering!

>>1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

... protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since, like, the mid-2000s in an enterprise environment. Safe to say I don't need WAN Miniport? Can you name any modern application that still uses any of those protocols in a non-corporate, average home user, fiber-to-the-prem scenario?

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would think the CrowdStrike fiasco would have precluded any vectors into the kernel of any machine. Certainly, I never knowingly allow remote-anything to my average home user machine. Unless there's some use you can enlighten me about?

Thanks sincerely,

Nobody
Nobody 5 Reputation points

2024-10-10T20:06:09.37+00:00

Jill Zhou,

Thanks for answering.

>>1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

...protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since the mid-2000s in an enterprise environment, using copper. Safe to say I don't need WAN Miniport? Can you name any modern applications that still use those protocols in an average home user, fiber-to-the-prem scenario?

>>2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would have thought the CrowdStrike fiasco would have precluded any vector into the kernel of any machine. I never knowingly allow remote-anything into my machine. Is there a situation where an average home PC user would need this?

Since you didn't mention it, is it safe to assume packet analyzers don't have access to the packets flowing on these adapters?

Sincerely,

Nobody
Nobody 5 Reputation points

2024-10-10T20:07:51.2433333+00:00

Jill Zhou,

Thanks for answering.

1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

...protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since the mid-2000s in an enterprise environment, using copper. Safe to say I don't need WAN Miniport? Can you name any modern applications that still use those protocols in an average home user, fiber-to-the-prem scenario?

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would have thought the CrowdStrike fiasco would have precluded any vector into the kernel of any machine. I never knowingly allow remote-anything into my machine. Is there a situation where an average home PC user would need this?

Since you didn't mention it, is it safe to assume packet analyzers don't have access to the packets flowing on these adapters?

Sincerely,

Nobody
Nobody 5 Reputation points

2024-10-10T20:33:04.9966667+00:00

terrible system here
Nobody 5 Reputation points

2024-10-10T20:35:06.8266667+00:00

Jill Zhou,

Thanks for answering.

1.WAN Miniport is a software adapter used by the Windows operating system to handle various types of network connections, particularly those involving wide area networks (WANs). These miniports are essential for enabling protocols like:

...protocols like: Remote Access Service (RAS) and the Point-to-Point Protocol (PPP) over such media as ISDN, Frame Relay, or Switched 56

I have not seen nor used those protocols since the mid-2000s in an enterprise environment, using copper. Safe to say I don't need WAN Miniport? Can you name any modern applications that still use those protocols in an average home user, fiber-to-the-prem scenario?

2.Microsoft Kernel Debug Network Adapter is a virtual NIC designed for kernel-mode debugging which facilitates remote debugging of the Windows operating system over a network connection. It provides a communication channel between the computer’s kernel and the debugger software, enabling developers and system administrators to analyze and troubleshoot low-level issues within the Windows kernel.

I would have thought the CrowdStrike fiasco would have precluded any vector into the kernel of any machine. I never knowingly allow remote-anything into my machine. Is there a situation where an average home PC user would need this?

Since you didn't mention it, is it safe to assume packet analyzers don't have access to the packets flowing on these adapters?

Sincerely,

Nobody
Nobody 5 Reputation points

2024-10-10T20:37:34.8533333+00:00

My comments back to jing Zhou did not violate any code of conduct. Your failed AI moderation is out of control.

Answer 2

After much digging, I have the answer! The WAN miniports are created by the Remote Access Connection Manager (RasMan) service. This service is not necessary if you don't use PPP or the built-in VPN feature. The built-in VPN in Windows uses older protocols, it appears not needed for modern third-party VPN software that utililizes protocols like Open VPN or Wireguard. So, you should be fine to disable it. Once RasMan is stopped from running, the WAN miniports are removed. If you have any problems with VPN connectivity, then just remember to re-enable it (or set it to manual).

Here is a link regarding the VPN protocols supported by the RasMan service:

https://www.tuxlervpn.com/a-guide-to-remote-access-connection-manager-what-is-it-and-how-to-enable-or-disable-it/

Here is Microsoft itself saying it's safe to disable:

Guidance on configuring system services - Windows IoT Enterprise | Microsoft Learn

Share via

What are WAN Miniport, Microsoft Kernel Debug Network Adapter, and why?

2 answers

Your answer