Split Npcap driver into one for newer Windows releases, plus a compatible version for older systems that we still support

[fyodor]

Right now we compile npcap.sys so that it supports all the operating systems still supported by Microsoft, including Windows 7 and Windows Server 2012r2. This prevents from using NDIS versions past 6.20 as well as other features not supported by older Windows releases.

We hope to improve this by building two versions of npcap.sys. One which works on all the systems we support, and one just for newer Windows releases (probably Win10+) which support all of the performance features we want. The Npcap installer would install just the best driver for the given system.

Known improvements this will enable:

• RSC (Receive Segment Coalescing) allows the network card miniport driver to coalesce multiple TCP segments into one unit for the operating system's networking subsystem to process. This is often essential for the OS to keep up with 10Gbps networks. It requires NDIS 6.30+ (Windows 8 or later; Windows Server 2012 or later). Having an NDIS driver below 6.30 on these newer systems prevents the whole OS from using RSC. Related: Issue npcap disables RSC (Receive Side Coalescing) #70 ; Issue NPCAP lowering 10gb network adapter throughput to under 2gb #195

NDIS Versions/Features and OS compatibility: https://docs.microsoft.com/en-us/windows-hardware/drivers/network/overview-of-ndis-versions

[dmiller-nmap]

Just leaving a note that WFP callout drivers (like Nmap's loopback capture feature) need to explicitly opt-in to receive large packets, otherwise RSC will be disabled in a similar way. Reference: https://docs.microsoft.com/en-us/windows-hardware/drivers/network/programming-considerations-for-rsc-drivers#rsc-support-for-lightweight-filters-and-mux-intermediate-drivers

[guyharris]

Is this now fixed? The Npcap CHANGELOG says

• On Windows 10, the Npcap driver has been updated to NDIS 6.50 and Windows 10 WFP compatibility, supporting network stack improvements like RSC. Fixes Split Npcap driver into one for newer Windows releases, plus a compatible version for older systems that we still support #196.

[dmiller-nmap]

This issue is fixed in Npcap 0.9995