Npcap

Originally created back in 2013 as an enhanced version of the now discontinued WinPCap library, Npcap provides software developers with a library designed for capturing raw network traffic.

Whether we are talking about wireless or Ethernet networks, the localhost or VPNs, Npcap is capable of capturing and sending data packets. The library relies on the simple, portable Pcap API and implements a Windows kernel driver. Moreover, developers can also build their applications against the Npcap SDK.

Npcap is available on Windows as a standalone installer, which deploys the library and the Npcap drivers. Optionally, you can configure Npcap to install in WinPcap API-compatible mode, which ensures that applications written for WinPcap are compatible with the most recent releases of Npcap. If that is not the case, recompiling with the Npcap SDK should allow the application to receive all the newest functionality, security and performance features of Npcap.

With Npcap installed, applications get the power of the Libpcap API, which allows developers to capture data packets that are transmitted throughout the monitored network. With this packet sniffer for Windows, developers can capture all the loopback traffic. Packet injection is possible thanks to the pcap_inject() function.

During setup, the library can be configured to only allow system administrators to capture data packets. In this case, UAC dialogs are shown to any non-admin user who want to utilize software tools to capture data packets. For additional security, the library’s driver, DLL files and executables are signed, and the Windows ASLR and DEP security features are enabled.