DOCSEARCHbyAlgolia
Submit Docs

Npcap Documentation

repository·master·Indexed 25 days ago

https://github.com/nmap/npcap

A high-performance packet capture and injection library for Windows developed by the Nmap Project as a modern successor to WinPcap. Compatible with Windows 7 through 11, it provides the wpcap.dll API for development and supports features such as nanosecond-precision timestamps via PACKET_MODE_NANO and driver statistics via PacketGetInfo().

Tokens
965
Snippets
3
Records
12
Agent score
86%

What's inside Npcap

  1. Overview of Npcap

    master
    Npcap is a packet capture and injection library for Windows developed by the Nmap Project. It serves as a modern, maintained replacement for the unmaintained WinPcap project, offering improved speed, reliability, and security. It is compatible with Windows 7, 8, 8.1, 10, and 11.

  2. Download Npcap installer, SDK, and source

    master

    The latest Npcap installers, Software Development Kits (SDK), source code, and debug symbols are available for download at the official Npcap website.

    https://npcap.com/#download

  3. Access the Npcap HTML documentation

    master

    The full, detailed Npcap documentation is available in HTML format at the official website. This guide contains comprehensive information regarding installation, API usage, and development details.

    https://npcap.com/guide/

  4. Get link speed information

    master

    The PacketGetNetType() function now always sets the LinkSpeed field to 0. If your software requires link speed information, use one of the following instead:

    • pcap_oid_get_request()
    • GetAdaptersAddresses()

  5. Report Npcap bugs

    master

    Bugs and issues should be reported via the GitHub issues tracker. When reporting a bug, you should include:

    • The output from the DiagReport tool.
    • The version of the user software being used (e.g., Nmap, Wireshark).
    • Clear steps to reproduce the issue.
    • Any other relevant technical information.
    https://github.com/nmap/npcap/issues

  6. Check supported BPF extensions with NPF_GETINFO_BPFEXT

    master

    Use PacketGetInfo() with the NPF_GETINFO_BPFEXT constant to determine which BPF extensions the driver supports.

    Supported extensions include:

    • SKF_AD_VLAN_TAG
    • SKF_AD_VLAN_TAG_PRESENT

    Note: These constants have the same meanings as the Linux kernel's BPF extensions of the same names.

  7. Enable nanosecond-precision timestamps with PACKET_MODE_NANO

    master

    You can enable nanosecond-precision timestamps on a packet handle by using the PACKET_MODE_NANO mode with the PacketSetMode() or pcap_setmode() functions.

    Requirement: Requires Npcap 1.83 driver or later.

  8. Retrieve driver information and statistics using PacketGetInfo()

    master

    The PacketGetInfo() function allows you to issue information requests to the Npcap driver using the PACKET_OID_DATA structure.

    Available Request Constants:

    • NPF_GETINFO_VERSION: Retrieves the version.
    • NPF_GETINFO_CONFIG: Retrieves configuration information.
    • NPF_GETINFO_BPFEXT: Determines which BPF extensions are supported by the driver.
    • NPF_GETINFO_MODES: Returns supported mode bits for PacketSetMode().
    • NPF_GETINFO_STATS: Retrieves performance statistics for the filter module.
    • NPF_GETINFO_MODDBG: Retrieves internal debugging info unique to a filter module.

    Requirement: NPF_GETINFO_MODES, NPF_GETINFO_STATS, and NPF_GETINFO_MODDBG require Npcap 1.84 driver or later.

  9. Get the Packet.dll runtime version

    master

    To get the runtime version of the Packet.dll library, use the PacketGetVersion() function.

    Note: The undocumented char PacketLibraryVersion[] export has been removed; PacketGetVersion() is the documented and preferred method.

  10. Configure SendToRx mode via PacketSetMode()

    master

    To enable or disable the SendToRx feature independently of systemwide Registry settings, use the following modes with PacketSetMode() or pcap_setmode():

    • MODE_SENDTORX: Enables the SendToRx feature.
    • MODE_SENDTORX_CLEAR: Disables the SendToRx feature.

    Requirement: Requires Npcap 1.83 driver or later.

  12. Understand the Npcap License

    master

    The Npcap License allows end users to download, install, and use Npcap for free on up to 5 systems, including for commercial usage.

    Software providers (open source or otherwise) that wish to use Npcap functionality are encouraged to direct their users to npcap.com to download and install the library.

    For enterprise features like a silent installer, commercial support, and special license rights, users can purchase Npcap OEM.