Knowledgebase & Troubleshooting

LucidWire Desktop displays Service Disconnected or shows 0 active socket connections, even though internet connectivity is working normally.

Many 3rd-party Antivirus suites inject deep WFP callout drivers (vsepflt.sys, bdhkm.sys, klif.sys). When their "Encrypted Web Scan" or "Port Inspection" feature is active, they intercept local socket loopback communication between LucidWire.Desktop.exe and LucidWire.Service.exe on port 9401, blocking the gRPC HTTP/2 stream.

1. Open your Antivirus settings panel.
2. Under Protection > Network / Firewall / Online Threat Prevention, add exclusion rules for:
   • C:\Program Files\LucidWire\service\LucidWire.Service.exe
   • C:\Program Files\LucidWire\desktop\LucidWire.exe
   • Local TCP Port: 9401
3. Ensure loopback communication (127.0.0.1 and ::1) is exempted from SSL/TLS deep inspection.
4. Restart the LucidWire Service via Windows Services (services.msc) or run LucidDoc repair.

On enterprise-managed endpoints, LucidWire installs cleanly but fails to establish a session with the background telemetry service.

Enterprise EDR platforms (CrowdStrike CSAgent, SentinelOne) enforce parent-child containment and block non-standard HTTP/2 loopback listener ports (9401) unless signed by an enterprise certificate.

1. Request your IT/SecOps administrator whitelist the directory: C:\Program Files\LucidWire\**
2. Add firewall loopback policy: Inbound/Outbound on 127.0.0.1:9401 for binary LucidWire.Service.exe.
3. Export an enterprise compliance report using: "C:\Program Files\LucidWire\doctor\LucidDoc.exe" --export

LucidWire uses low-level native Win32 APIs (GetIfTable2, GetPerTcpConnectionEStats) without third-party drivers. Generic heuristic scanners can flag recently compiled network enumerators as false positives. Whitelist LucidDoc.exe and LucidWire.Service.exe in your antivirus quarantine log and verify binary SHA-256 hashes.

Run LucidDoc with the --repair flag: "C:\Program Files\LucidWire\doctor\LucidDoc.exe" --repair, or reset the Windows firewall filters: netsh advfirewall reset followed by restarting the Base Filtering Engine (net stop bfe && net start bfe).

Error 5: Missing execute permissions on service binaries or third-party protection stripping SYSTEM tokens. Error 1053: Missing .NET 9 Desktop runtime or corrupted registry parameters.

sc.exe stop LucidWire.Service
sc.exe delete LucidWire.Service
sc.exe create LucidWire.Service binPath= "C:\Program Files\LucidWire\service\LucidWire.Service.exe" start= auto obj= "NT AUTHORITY\SYSTEM"
sc.exe start LucidWire.Service

icacls "%PROGRAMDATA%\LucidWire" /grant "NT AUTHORITY\SYSTEM":(OI)(CI)F /grant "BUILTIN\Users":(OI)(CI)M /T

Open services.msc, locate Base Filtering Engine and Windows Defender Firewall, configure their Startup Type to Automatic, and start both services.

Ephemeral processes (curl scripts, background updaters) open a socket and exit in under 200ms before the OS table enumerator correlates the PID to an executable path. In LucidWire Settings, toggle Process Ingest Cache to Aggressive (100ms).

LucidWire v1.6.0+ automatically falls back to socket-to-PID correlation via GetExtendedTcpTable without touching game process memory. LucidWire is 100% compliant with anti-cheat policies and uses zero kernel hooks or DLL injections.

Processes like MsMpEng.exe and audiodg.exe are protected by the Windows kernel under Process Protection Light. LucidWire monitors byte rates and remote IPs, while respecting Windows PPL security boundaries.

TCP Extended Statistics (TcpConnectionEstatsData) must be toggled on. Run "C:\Program Files\LucidWire\doctor\LucidDoc.exe" to re-initialize the EStats engine, then restart LucidWire.Service.

LucidWire v1.6.0+ features dynamic struct alignment probing (testing 80–128 byte allocations) to prevent error code 122 (ERROR_INSUFFICIENT_BUFFER) across Windows 11 23H2 / 24H2 builds.

Enable Filter Inactive / Closed Sockets in the Connections tab, or expand the dynamic port allocation range: netsh int ipv4 set dynamicport tcp start=10000 num=55535.

In LucidWire Dashboard, click the Adapter Selector dropdown and choose your VPN Virtual Adapter (e.g. Tailscale, Wintun) or select All Adapters (Aggregated) to inspect tunnel metrics.

Linux processes inside WSL2 run through the Hyper-V virtual switch. Select vEthernet (WSL) in LucidWire's adapter list to monitor traffic attributed to wslhost.exe.

Spikes above wire capacity reflect NIC hardware TCP Segmentation Offload. This is normal. To disable: Device Manager > Network Adapters > [NIC] > Properties > Advanced > Large Send Offload v2 -> Disabled.

Windows limits concurrent ETW traces to 64. Run LucidDoc with --repair: "C:\Program Files\LucidWire\doctor\LucidDoc.exe" --repair to flush orphaned kernel trace sessions, or query them using logman query -ets.

cd %windir%\system32
lodctr /R
cd %windir%\syswow64
lodctr /R
winmgmt /resyncperf

In Windows Settings > Network & internet > Proxy, ensure <local>;localhost;127.0.0.1;::1 is present in the Proxy Bypass list, or run LucidDoc.exe --repair.

Check the conflicting PID: netstat -ano | findstr :9401. If required, change the listening port in %PROGRAMDATA%\LucidWire\settings.json under "grpc_port": 9405 and restart the service.

• Local Usernames: C:\Users\Username\ is sanitized to %USERPROFILE%\.
• Public IP Addresses: External WAN addresses are masked to /24 subnets.
• Hostnames & Hardware: Salted and SHA-256 hashed before serialization.
• Credentials & Secrets: Zero passwords or environmental secrets are ever bundled.

Self-healing actions (restarting background services, repairing %PROGRAMDATA% DACLs, resetting corrupted WFP loopback bypasses) require local Administrator privileges. LucidDoc requests UAC elevation strictly when performing these repair actions.