Npcap (Winpcap)

Npcap (Winpcap) is a useful application designed to support users to access network at data link layer in Windows environment.

Npcap (Winpcap) allows applications to capture and transmit network data packets, while also providing other useful features such as statistical network tools, kernel-level network packet filters and packet support. remote shooting.

What is Npcap (Winpcap)?

Npcap includes a driver that expands the operating system to provide low-level network access. At the same time, a library is used to allow you to easily access low-level network layers. This library also contains the Windows version of the libpcap Unix API.

Thanks to a range of useful features, Npcap is the most efficient packet filtering and capture tool of many open source tools such as protocol analysis tools, network intrusion detection systems, storage generators traffic, network testing tool and network scanning tool. Some network tools such as Wireshark, Nmap, Snort are known and used throughout the network community.

Npcap (Winpcap) is released based on the open source BSD license. This means that you can completely change and use it with your application. Binary code and source code are always available here.

The main feature of Npcap

• Npcap (Winpcap) for Windows 10 : Npcap runs on Windows 7 or later using the new NDIS 6 Light-Weight Filter (LWF) API. It runs faster than the old NDIS 5 API that Microsoft can delete at any time. In addition, the driver with the EV certificate has been signed by Microsoft, it can run on drivers requiring more stringent registration in Windows 10 1607.
• Increased security : Npcap can limit the rights that only administrators can identify packets. If a non-administrator user uses Npcap via software such as Nmap or Wireshark, that person will have to switch to the User Account Control (UAC) dialog box to use the driver. It is similar to UNIX, where root access usually requires packets. Npcap also activates the ASLR & DEP security feature and has signed drivers to prevent tampering.
• Load loopback packets (loopback) : Npcap supports detection of loopback packets using the Windows Filtering Platform (WFP). After installation, Npcap will create an adapter called Npcap Loopback for you. If you are a Wireshark user, select this adapter to load packets, you will see loopback traffic as if using a non-loopback adapter. Try it by typing a command like 'ping 127.0.0.1' (IPv4) or 'ping :: 1' (IPv6).
• Embedded loop back : Npcap also sends loopback packets using the Winsock Kernel (WSK) technique. User-level software like Nping can only send outbound packets with adpter Ncap Loopback like any adapter. After that, Npcap implemented a 'magic' to remove the packet's Ethernet header and put the payload into the Windows TCP / IP stack.
• Libcab API : Npcap uses the excellent Libcap library, activates Windows applications to use a mobile packet capture API package, supports both Linux and Mac OS X. While Winpcap is based on LibPcap 1.0.0 since 2009 , Npcap includes the latest Libcap release along with other improvements.
• Npcap compatibility: For applications that do not use the advanced features of Npcap. Npcap can be installed in 'Npcap (Winpcap) Compatible Mode.' This feature replaces any Npcap (Winpcap) installation. If compatibility mode is not selected, Npcap exists in parallel with Winpcap. Applications that only know Winpcap will continue to use it, while others may choose to use the new and faster Npcap driver.

Update the latest Npcap

Npcap 0.9981

• When upgrading Npcap, do not uninstall existing Npcap until the user clicks the Install button.
• Redefine the I / O control code used by Npcap when using the CTL_CODE macro to ensure proper control and parameter matching. This is not an exported API, but changes will require Packet.DLL and the Npcap driver of the same version.
• Fix 1-byte overflow in NPFInstall.exe when closing processes that are using Npcap DLLs.
• In case the PacketOpenAdapter is named in UTF-16LE, compile it to ASCII before performing string operations.
• Significantly rearranges internal data structures to reduce memory usage and initialization costs.