Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique. It supports Windows Vista, 7, 8 and 10 . It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and 2015 . It also received many helpful tests from Wireshark and NetScanTools .
WinPcap Compatible Modeat install-time, Npcap will use the WinPcap-style DLL directories
c:\Windows\System32and servcie name
npf, allowing software built with WinPcap in mind to transparently use Npcap instead. If compatability mode is not selected, Npcap is installed in a different location
C:\Windows\System32\Npcapwith a different service name
npcapso that both drivers can coexist on the same system. In this case, applications which only know about WinPcap will continue using that, while other applications can choose to use the newer and faster Npcap driver instead.
Npcap Loopback Adapterfor you. If you are a Wireshark user, choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters. Try it by typing in commands like
ping 127.0.0.1(IPv4) or
Npcap Loopback Adapterjust like any other adapter. Npcap then does the magic of removing the packet's Ethernet header and injecting the payload into the Windows TCP/IP stack.
Support raw 802.11 traffic (and monitor mode) for wireless adaptersoption in the installation wizard to enable this feature. When your adapter is in
Monitor Mode, Npcap will supply all
802.11 data + control + managementpackets with
radiotapheaders. When your adapter is in
Managed Mode, Npcap will only supply
802.11 datapackets with
radiotapheaders. Moreover, Npcap provides the
WlanHelper.exetool to help you switch to
Monitor Modeon Windows. See more details about this feature in section
For softwares that use Npcap raw 802.11 feature. See more details about
installer\Build.bat : build all DLLs and the driver. The DLLs need to be built using Visual Studio 2013 . And the driver needs to be built using Visual Studio 2015 with Windows SDK 10 10586 & Windows Driver Kit 10 10586 .
installer\Deploy.bat : copy the files from build directories to deployment directories and sign the files. Generate an installer named
npcap-nmap-%VERSION%.exe using NSIS large strings build with the SysRestore plug-in (special build for Npcap) and sign the installer.
Generating debug symbols (optional)
installer\Deploy_Symbols.bat : copy the debug symbol files (.PDB) from build directories to deployment directories and package them into a zip file named
npcap-nmap-<VERSION>-DebugSymbols.zip using 7-Zip .