Published on June 4th, 2016 📆 | 6206 Views ⚑0
Npcap – the Nmap Project’s packet sniffing library for Windows
Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique. It supports Windows Vista, 7, 8 and 10 . It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and2015 . It also received many helpful tests from Wireshark and NetScanTools .
- NDIS 6 Support : Npcap makes use of new NDIS 6 Light-Weight Filter (LWF) API in Windows Vista and later (the legacy driver is used on XP). It's faster than the deprecated NDIS 5 API, which Microsoft could remove at any time.
- Extra Security : Npcap can be restricted so that only Administrators can sniff packets. If a non-Admin user tries to utilize Npcap through software such as Nmap or Wireshark, the user will have to pass a User Account Control (UAC) dialog to utilize the driver. This is conceptually similar to UNIX, where root access is generally required to capture packets.
- WinPcap Compatibility : If you choose
WinPcap Compatible Modeat install-time, Npcap will use the WinPcap-style DLL directories
c:\Windows\System32and servcie name
npf, allowing software built with WinPcap in mind to transparently use Npcap instead. If compatability mode is not selected, Npcap is installed in a different location
C:\Windows\System32\Npcapwith a different service name
npcapso that both drivers can coexist on the same system. In this case, applications which only know about WinPcap will continue using that, while other applications can choose to use the newer and faster Npcap driver instead.
- Loopback Packet Capture : Npcap is able to sniff loopback packets (transmissions between services on the same machine) by using the Windows Filtering Platform (WFP) . After installation, Npcap will create an adapter named
Npcap Loopback Adapterfor you. If you are a Wireshark user, choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters. Try it by typing in commands like
ping 127.0.0.1(IPv4) or
- Loopback Packet Injection : Npcap is also able to send loopback packets using the Winsock Kernel (WSK)technique. User-level software such as Nping can just send the packets out using
Npcap Loopback Adapterjust like any other adapter. Npcap then does the magic of removing the packet's Ethernet header and injecting the payload into the Windows TCP/IP stack.
- Raw 802.11 Packet Capture : Npcap is able to see 802.11 packets instead of fake Ethernet packets on ordinary wireless adapters. You need to select the
Support raw 802.11 traffic (and monitor mode) for wireless adaptersoption in the installation wizard to enable this feature. When your adapter is in
Monitor Mode, Npcap will supply all
802.11 data + control + managementpackets with
radiotapheaders. When your adapter is in
Managed Mode, Npcap will only supply
802.11 datapackets with
radiotapheaders. Moreover, Npcap provides the
WlanHelper.exetool to help you switch to
Monitor Modeon Windows. See more details about this feature in section
For softwares that use Npcap raw 802.11 feature. See more details about
installer\Build.bat: build all DLLs and the driver. The DLLs need to be built using Visual Studio 2013 . And the driver needs to be built using Visual Studio 2015 with Windows SDK 10 10586 & Windows Driver Kit 10 10586.
installer\Deploy.bat: copy the files from build directories to deployment directories and sign the files. Generate an installer named
npcap-nmap-%VERSION%.exeusing NSIS large strings build with the SysRestore plug-in (special build for Npcap) and sign the installer.
Generating debug symbols (optional)
installer\Deploy_Symbols.bat: copy the debug symbol files (.PDB) from build directories to deployment directories and package them into a zip file named
npcap-nmap-<VERSION>-DebugSymbols.zipusing 7-Zip .