<div dir="ltr"><div>Hi Yang,</div><div><br></div><div>thanks for providing me the detailed information about Npcap. I will definitively have a look at it and try it.</div><div><br></div><div>Cheers,</div><div>SK</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-04 13:04 GMT+01:00 食肉大灰兔V5 <span dir="ltr"><<a href="mailto:hsluoyz@gmail.com" target="_blank">hsluoyz@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Sven,<div><br></div><div>Npcap (<a href="https://github.com/nmap/npcap" target="_blank">https://github.com/nmap/npcap</a>) has better performance because of NDIS 6. It also has several new features:</div><div><br></div><div><ol style="padding:0px 0px 0px 2em;color:rgb(51,51,51);line-height:25.6px;font-family:"Helvetica Neue",Helvetica,"Segoe UI",Arial,freesans,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:16px;margin-top:0px;margin-bottom:16px"><li><strong>NDIS 6 Support</strong>: Npcap makes use of new LWF driver in Windows Vista and later (the legacy driver is used on XP). It's faster than the legacy <a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff557012(v=vs.85).aspx" target="_blank"><strong>NDIS 5 Intermediate</strong></a> technique. One reason is that packet data stucture has changed (from<code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">NDIS_PACKET</code> to <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">NET_BUFFER_LIST</code>) since Vista and NDIS 5 needs to handle extra packet structure conversion.</li><li><strong>"Admin-only Mode" Support</strong>: Npcap supports to restrict its use to Administrators for safety purpose. If Npcap is installed with the option <strong>Restrict Npcap driver's access to Administrators only</strong> checked, when a non-Admin user tries to start a user software (Nmap, Wireshark, etc), the <a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="http://windows.microsoft.com/en-us/windows/what-is-user-account-control#1TC=windows-7" target="_blank"><strong>User Account Control (UAC)</strong></a> dialog will prompt asking for Administrator privilege. Only when the end user chooses <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">Yes</code>, the driver can be accessed. This is similar to UNIX where you need root access to capture packets.</li><li><strong>"WinPcap Compatible Mode" Support</strong>: "WinPcap Compatible Mode" is used to decide whether Npcap should coexist With WinPcap or be compatible with WinPcap. With "WinPcap Compatible Mode" <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">OFF</code>, Npcap can coexist with WinPcap and share the DLL binary interface with WinPcap. So the applications unaware of Npcap <strong>SHOULD</strong> be able to use Npcap automatically if WinPcap is unavailable. The applications who knows Npcap's existence can choose to use Npcap or WinPcap first. The key about which is loaded first is <a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx" target="_blank"><strong>DLL Search Path</strong></a>. With "WinPcap Compatible Mode" <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">OFF</code>, Npcap installs its DLLs into <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">C:\Windows\System32\Npcap\</code> instead of WinPcap's <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">C:\Windows\System32\</code>. So applications who want to load Npcap first must make <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">C:\Windows\System32\Npcap\</code> precedent to other paths in ways such as calling<a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="https://msdn.microsoft.com/en-us/library/ms686203.aspx" target="_blank"><strong>SetDllDirectory</strong></a>, etc. Another point is Npcap uses service name <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">npcap</code> instead of WinPcap's <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">npf</code> with "WinPcap Compatible Mode" <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">OFF</code>. So applications using <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">net start npf</code> for starting service must use <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">net start npcap</code> instead. If you want 100% compatibility with WinPcap, you should install Npcap choosing "WinPcap Compatible Mode" (Install Npcap in WinPcap API-compatible Mode). In this mode, Npcap will install its Dlls in WinPcap's <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">C:\Windows\System32\</code>and use the <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">npf</code> service name. It's notable that before installing in this mode, you must uninstall WinPcap first (the installer wizard will prompt you that).</li><li><strong>Loopback Packets Capture Support</strong>: Now Npcap is able to see Windows loopback packets using <a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa366510(v=vs.85).aspx" target="_blank"><strong>Windows Filtering Platform (WFP)</strong></a> technique. After installation, Npcap will create an adapter named <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">Npcap Loopback Adapter</code> for you. If you are a Wireshark user, choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters. Try it by typing in commands like <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">ping 127.0.0.1</code> (IPv4) or <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">ping ::1</code> (IPv6).</li><li><strong>Loopback Packets Send Support</strong>: Besides loopback packets capturing, Npcap can also send out loopback packets based on <a style="color:rgb(64,120,192);text-decoration:none;background-color:transparent" href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff556958(v=vs.85).aspx" target="_blank"><strong>Winsock Kernel (WSK)</strong></a> technique. A user software (e.g. Nmap) can just send packets out using <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">Npcap Loopback Adapter</code> like other adapters. <code style="margin:0px;padding:0.2em 0px;border-radius:3px;font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:13.6px;background-color:rgba(0,0,0,0.039215)">Npcap Loopback Adapter</code> will automatically remove the packet's Ethernet header and inject the payload into Windows TCP/IP stack, so this kind of loopback packet never go out of the machine.</li></ol></div><div><br></div><div>I actually didn't add a function about making user software <span style="color:rgb(0,0,0);font-size:12.8px">getting notified about media state changes. From my knowledge I don't know there's any support of such a function in libpcap. libpcap is an interface standard followed by WinPcap/Npcap. However, I think you can do it using native Windows APIs (like </span><font color="#000000"><span style="font-size:12.8px">Receiving Notification of Network Events in <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx" target="_blank">https://msdn.microsoft.com/en-us/library/windows/desktop/aa366334(v=vs.85).aspx</a>)</span></font><span style="color:rgb(0,0,0);font-size:12.8px">. And if you have any improvement advice about Npcap, I will consider it:)</span></div><div><span style="color:rgb(0,0,0);font-size:12.8px"><br></span></div><div><span style="color:rgb(0,0,0);font-size:12.8px"><br></span></div><div><span style="color:rgb(0,0,0);font-size:12.8px">Cheers,</span></div><div><font color="#000000"><span style="font-size:12.8px">Yang</span></font></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 4, 2016 at 7:18 PM, Sven Kerschbaum <span dir="ltr"><<a href="mailto:svkers@gmail.com" target="_blank">svkers@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr"><div>Oh, I have to admit that I did not try it on an update to date Windows 10 system... Thanks for the hint that this was only an issue in early Windows 10 versions.</div><div><br></div><div>I was also not aware of the Npcap. Thanks for pointing me to this fork! How does Npcap differ from WinPcap with respect to performance, feature? At least I am missing the possibility to get notified about media state changes (connected, disconnected) in WinPcap. Does Npcap offer such a functionality?</div><div><br></div><div>Furthermore: Is WinPcap still under active development? Its last release was in 2013. Or I am better advised to rely on Npcap?</div><div><br>Thank you!</div><div>Best regards,</div><div>SK</div><div><br></div><div><br></div><div><br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-04 11:08 GMT+01:00 Gisle Vanem <span dir="ltr"><<a href="mailto:gvanem@yahoo.no" target="_blank">gvanem@yahoo.no</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span>Sven Kerschbaum wrote:<br>
<br>
> is there already effort for getting WinPcap ready for Windows 10? As Pascal Quantin already pointed out WinPcap does not<br>
> run on Windows 10 due to the fact that the WinPcap driver is not an NDIS 6 driver. Please find more information here:<br>
> <a href="http://www.winpcap.org/pipermail/winpcap-users/2015-March/004936.html" target="_blank" rel="noreferrer">http://www.winpcap.org/pipermail/winpcap-users/2015-March/004936.html</a><br>
<br>
</span>Really? All my WinPcap-based programs works fine here.<br>
>From 'sigcheck c:\WINDOWS\sysnative\drivers\npf.sys':<br>
<br>
Verified: Signed<br>
Signing date: 02.49 01.03.2013<br>
Publisher: Riverbed Technology<br>
Company: Riverbed Technology, Inc.<br>
Description: npf.sys (NT5/6 AMD64) Kernel Driver<br>
Product: WinPcap<br>
Prod version: 4.1.0.2980<br>
File version: 4.1.0.2980<br>
MachineType: 64-bit<br>
<br>
<br>
The version and 'Signing date' is in accordance with what's on <a href="http://winpcap.org" target="_blank" rel="noreferrer">winpcap.org</a>.<br>
An also:<br>
<br>
F:\> windump -Dv<br>
1. \Device\NPF_{E069AC87-4219-4F7E-9CA5-DE3FBA031CEF} Descr: Microsoft<br>
Addr 0: 10.0.0.11 (mask 255.255.255.0)<br>
MAC-addr: 00:18:4D:00:DE:17, MTU 1514, link-type 802.3 over Native802_11, DOWN, 54Mb/s (NDIS)<br>
<br>
2. \Device\NPF_{990D25A5-6071-4C67-AC14-A5380B0FFDEC} Descr: Microsoft<br>
Addr 0: fe80::8089:b86f:1ef6:347e (mask ::)<br>
Addr 1: fe80::8089:b86f:1ef6:347e (mask ::)<br>
MAC-addr: 00:15:83:12:37:2F, MTU 1514, link-type 802.3 over Bluetooth, DOWN, 3Mb/s (NDIS)<br>
<br>
3. \Device\NPF_{7BA27187-146B-4FB6-B4BA-DC5D218FB607} Descr: Realtek Ethernet Controller<br>
Addr 0: 10.0.0.10 (mask 255.255.255.0)<br>
MAC-addr: E0:3F:49:81:2E:EA, MTU 1514, link-type 802.3, UP, 100Mb/s (NDIS)<br>
<br>
--------------<br>
<br>
I'm on Win 10. Version 1511 (OS-Build 10586.71).<br>
Windows 10 build 10041 (as mention in that mail) is pretty old.<br>
<span><font color="#888888"><br>
<br>
<br>
--<br>
--gv<br>
</font></span><div><div>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank" rel="noreferrer">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
</div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank" rel="noreferrer">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank" rel="noreferrer">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></blockquote></div><br></div>