Wireshark-dev: [Wireshark-dev] Use Npcap as the default Windows capture library for Wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Yang Luo <hsluoyb@xxxxxxxxx>
Date: Sat, 4 Jun 2016 11:27:09 +0800
Hi list,

In the past few months, Npcap (https://github.com/nmap/npcap) has gone through many versions to reach a relatively stable release now (Npcap 0.07 R9). An obvious clue is that there're no such many BSoDs found as before, nearly only one BSoD-level bug for a month. Also we have got nearly all necessary parts as a product. We have official site (http://npcap.org/), documentation, SDK, paid technical support, etc.

As I have patched Wireshark to fully support Npcap mode, there's no issue for Wireshark no matter whether Npcap is installed in Npcap mode or WinPcap-API compatible mode. However, I recommend installing in Npcap mode directly because this is the default option in the installer.

Since Wireshark has dropped XP/Win2003 support long ago, so the fact that Npcap only works for Vista and later systems won't be an issue. Plus that Npcap also installs the original WinPcap 4.1.3 when running in XP.

Currently, we have already integrated Npcap 0.07 into Nmap 7.20 beta version, and soon there will be an official Npcap 1.0 release. So I think this is also a good time for Wireshark to integrate it. What're your opinions?


Cheers,
Yang