npcap

Installer, SDK, and debug symbols available from https://npcap.org/#download

• Complete the fix for #1398 that was only
  partially applied in Npcap 0.992. Due to this partial fix, the user-provided
  buffer was double-freed, resulting in a BAD_POOL_CALLER BSoD. This issue
  was separately reported as #1568, and has been
  issued the identifier CVE-2019-11490.

• Fix output of pcap_lib_version to again report "Npcap version 0.993, based
  on libpcap version 1.9.0" instead of "libpcap version 1.9.0 (packet.dll
  version 0.992)". Npcap 0.992 was the only version affected. Fixes
  #1566.

• Fix a regression in loopback capture that was causing the loopback adapter to
  be missing from pcap_findalldevs until the driver was manually stopped and
  restarted. Fixes #1570.

• Remove installer interface option "Automatically start the Npcap driver at
  boot time." Command-line and registry settings are still respected, but
  automatic start will be the default for all new installations, since manual
  start results in delays in network connectivity at boot. See
  #1502.

• Avoid interpreting null or uninitialized memory as out-of-band media-specific
  information for purposes of constructing the Radiotap header when capturing
  in raw 802.11 monitor mode. Fixes #1528.

• Ensure the uninstaller removes the npcapwatchdog scheduled task.

• Avoid an uninstaller failure if DLLs and executables are in use during
  uninstall by causing them to be deleted at reboot. See
  #1555.

Installer, SDK, and debug symbols available from https://npcap.org/#download

• Update libpcap to 1.9.0. See the libpcap CHANGES
  file
  for this release and #1506.

• Fix a bug in the fix for #1406 that caused
  capture filters to reject all packets when the packet header was offset from
  the start of the kernel data structure.

• Fix a bug in the fix for #1398 that caused
  BSoD (BAD_POOL_CALLER) due to mismatch in functions used to allocate and
  free a data structure.

• Remove installer interface option "Use DLT_NULL as the loopback interface'
  link layer protocol instead of DLT_EN10MB." Command-line and registry
  settings are still respected, but DLT_NULL will be the default for all new
  installations.

• Remove installer interface option "Support 802.1Q VLAN tag when capturing and
  sending data," which was unsupported for three years. Support may be restored
  in future releases, but the option has not had any effect in earlier
  installers.

Installer and debug symbols available from https://npcap.org/ . Note the version number structure change.

• Fix a bug in the BPF packet filter engine that caused capture filters with
  byte offsets to reject packets due to fragmentation within NET_BUFFER
  structures. See #1406 and
  #1438.

• Fix a bug that caused several network device drivers to crash when using the
  pcap_sendqueue_transmit function, due to queued network packets being
  allocated from paged memory that paged out before the drivers accessed it.
  See #1398.

• Fix a crash (SYSTEM_EXCEPTION_NOT_HANDLED_M) in WSKCloseSocket due to
  double-free, reported via Microsoft crash telemetry.

• Fix a BSOD inherited from WinPcap triggered when PacketGetStats is called
  with low system resources. See #1517.

• Properly quote the path to the CheckStatus.bat script in the
  npcapwatchdog scheduled task. See #1513.

• Fix errors when installing in WinPcap API-compatible mode over WinPcap when
  Npcap install directory does not already exist. See
  #1456.

Executable installer and debug symbols available from https://npcap.org/

• Install a scheduled task at startup to check whether the Npcap Loopback
  Adapter has been removed and restore it. Windows 10 feature updates remove
  the Adapter. See #1416.

• Package the correct driver version. On some platforms, the Npcap 0.99-r8
  installer would install the Npcap 0.99-r7 driver.

• Fix a crash (REFERENCE_BY_POINTER) in NPF_ReleaseOpenInstanceResources
  reported via Microsoft crash telemetry. See #1419.

Executable installer is available from https://npcap.org/#download

• Revert to using SERVICE_SYSTEM_START for the "Automatically start Npcap at
  boot" option. The previous value, SERVICE_AUTO_START had been introduced as
  a workaround for network interruption on Windows 7 that was finally solved in
  Npcap 0.99-r7. See #1208.

• Removed extra Registry keywords from Npcap Loopback Adapter which were
  causing it to not appear properly in Windows API calls.
  Fixes #1368.

• Detect in-use WinPcap installations before attempting to overwrite DLLs.
  Offer to terminate the processes just as we do for in-use Npcap.

• Improved documentation based on WinPcap
  documentation including updates for Npcap changes. Example code builds on
  Visual Studio 2015 and works with Npcap. Npcap SDK 1.01 includes these changes.

• Fix a crash in NPF_RegisterCallouts reported via Microsoft crash telemetry
  caused by a failure when opening the Npcap Loopback Adapter for packet
  capture.

• On Windows 8 and Server 2012, Npcap will rebind to network adapters after
  installation to ensure a more complete fix to
  #1031.

Npcap SDK 1.01 (ZIP).
This release of the Npcap SDK includes the latest headers and documentation from libpcap 1.8.1 and Npcap 0.99-r7. Software built with SDK 1.01 should be compatible with Npcap 0.10 or later.

Note: The SDK is only available on Npcap.org. The download links in this Github Release are source code only and do not contain the .lib files or the rendered HTML documentation.

Executable installer and debug symbols available at https://nmap.org/npcap/#download

• Fixed the installer so that Npcap in WinPcap API-compatible mode can do
  loopback capture. This capability is not guaranteed for future releases, but
  was only missing from 0.99-r3 to 0.99-r6. Native-mode Npcap was unaffected.
  Fixes #1213

• Added a script, FixInstall.bat, to fix common problems with installations,
  such as those caused by Windows 10 feature upgrades.
  See #1216

• Improved stability by restoring certain passthrough NDIS callbacks that are
  not used, but appear to cause connectivity problems if omitted.
  See #1208.

Installer and debug symbols available at https://nmap.org/npcap/#download

• Fixed installation on Windows 8 and Server 2012 so that Npcap is able to
  capture on adapters without requiring a reboot. Fixes
  #1031.

• Fixed loss of networking on Windows 7 when Npcap was configured to start at
  boot. Using AUTO_START instead of SYSTEM_START for the Npcap driver
  service solves the problem. Fixes #1208.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting
  OID_GEN_CURRENT_LOOKAHEAD. Fixes #1194.

• Fixed certain interactions between processes with open Npcap handles that
  could allow one process to stop other running captures from receiving
  packets. Fixes #1035.

Executable installer and debug symbols available at https://nmap.org/npcap/#download

• Restored installer code to silently uninstall WinPcap if silent installation
  in WinPcap API-compatible mode is needed (Npcap OEM only).

• Removed several optional passthrough driver functions that can be handled
  more efficiently by NDIS, since Npcap was not using them.

• Added validation of IRP parameters for additional security.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_SendCompleteExForEachOpen when the
  system is suspended. Fixes #1193.

• Fixed a crash reported via Microsoft crash telemetry,
  DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting
  OID_GEN_CURRENT_LOOKAHEAD. Fixes #1194.

• Bundle and install the correct public code signing certificate. The
  certificate used to sign Npcap was updated for Npcap 0.99-r4, but the public
  cert file included was not, leading to some unwanted publisher trust dialogs
  during installation.

Binary installer and debug symbols available from https://nmap.org/npcap/#download

• On Windows 7, if Npcap driver installation fails due to maximum NDIS filters
  installed, attempt to increase the limit. No such limit exists on other
  Windows versions. Fixes #1182.

• Avoid some cmd.exe popup windows during installation. See
  #1188.

• Improve the license to allow unlimited copies of Npcap to be used
  (removes the 5 copy limitation) if the copies are solely used for
  Nmap and/or Wireshark.

Binary installer, source zip, and debug symbols can be downloaded at https://nmap.org/npcap/#download

• Fix recording of the Npcap Loopback Adapter's name in the service registry
  key. Loopback packet injection was broken in WinPcap API-compatible mode in
  Npcap 0.99-r1 and 0.99-r2. Fixes #1165.

• Fix a double-close of a Registry key which could cause a crash in Packet.dll
  when debugging. Fixes #1163.

Binary installer and debug symbols available at https://nmap.org/npcap/

• Fix installer to work on 32-bit Windows.

Executable installer and debug symbols available at https://nmap.org/npcap/

• New Internal Use licensing option for Npcap OEM for users who need silent
  installs or more than five computers, but do not want to pay for
  redistribution rights.

• Improved installation of the Npcap Loopback Adapter, ensuring it can be
  correctly removed and reinstalled.

• Packet.DLL now only looks in the driver service's Parameters Registry key
  for installation options; in future releases, Npcap may stop writing these
  options to the HKLM:\Software\Npcap registry key.

• When NpcapHelper.exe is used for UAC elevation, the pipe it uses to
  communicate with the calling process is now restricted to the user SID of the
  calling process. Previously, any user could cause NpcapHelper to obtain
  handles to other devices, though the handles were only valid for the calling
  process.

• Performed Visual Studio Code Analysis on Packet.DLL and cleaned up several
  code health issues.

• Improved debug logging, error checking, and diagnostics throughout.

Binary installer and symbols available at https://nmap.org/npcap/

• Fix digital signatures for some files: OEM drivers were missing the Microsoft Attestation signature required for Windows 10 1703, and the installer was missing the SHA-1 signature required for Windows Vista.

Installer and debug symbols available at https://nmap.org/npcap/

• Only include data rate and channel fields in the RadioTap header if they are
  reported by the underlying WiFi card driver. See nmap/nmap#1036

• When the Npcap installer detects that WinPcap is present, it will default to
  installing in WinPcap API-compatible mode, replacing WinPcap. This can be
  changed by the user in the interactive installer, or by setting the
  /winpcap_mode=no command-line option.

• The Silent installation feature of the Npcap installer is now limited to the
  Npcap OEM edition.

Binary installer may be downloaded from https://nmap.org/npcap/

• Set the *IfType, *MediaType, and *PhysicalMediaType registry values for
  the Npcap Loopback Adapter. The values set should reduce the amount of
  configuration that Windows attempts to do on the adapter, preventing it from
  being labeled "Unknown Network."

• Record the ID of the Npcap Loopback Adapter in the registry when creating it,
  instead of only in the installer. This allows users to remove and create the
  adapter with NPFInstall directly, without requiring a reinstallation of Npcap.

• Expand the Npcap public license to allow 5 installations rather than only 1.

• Fix memory layout and accounting when writing Radiotap headers in raw 802.11
  monitor mode. Fixes nmap/nmap#1001
  nmap/nmap#1028, and nmap/nmap#1036.

Binary downloads available from https://nmap.org/npcap/

• When upgrading, existing installation options will be retrieved from the
  Registry. Command-line installer options will still override these.

• The installer detects Win10pcap as distinct from WinPcap; since the installer
  cannot uninstall Win10pcap, WinPcap API-compatible mode will be disabled in
  the installer when it is present. Fixes #999.

• The npcap.cat file is no longer dual-signed; since it was not a PE
  executable, only one signature is supported. The invalid signature was
  causing some installation failures. Fixes #994.

• Silent installs will not downgrade the Npcap version unless the new
  /downgrade=yes option is given. Any version of Npcap OEM
  will be considered a "newer version" than any non-OEM version.

Binary installer and license information available at https://nmap.org/npcap/

• Npcap no longer prevents checksum offloading and Large Send Offloading on adapters that support them. This may cause problems with sniffing outgoing packets on those interfaces when those features are enabled, but users can disable them through standard Windows configuration means. Fixes nmap/nmap#989

Binary installer available at http://npcap.org/

• Move the driver's Service Registry values from the
  HKLM:\SYSTEM\CurrentControlSet\Services\npcap key to the Parameters
  subkey. Applying Windows upgrades such as Windows 10 Creators Update deletes
  nonstandard values from the service key; the Parameters subkey is where these
  should be stored instead.

• Prevent the installer/uninstaller from crashing when faced with an incomplete
  Npcap installation, such as that created by applying a Windows version
  upgrade. Safely distinguish between old WinPcap installations and broken
  Npcap-in-WinPcap-API-mode installations. Fixes #906

Binary installers and debug symbols available at http://npcap.org/

• Force overwrite of files in installer, since uninstallers from versions 0.78r5 through 0.81 do not remove npcap.sys, leading to mismatched driver vs DLL versions.

• New installer commandline option to skip setting a restore point: /disable_restore_point=yes