Npcap 0.99-r7

@dmiller-nmap dmiller-nmap released this Jul 6, 2018

Executable installer and debug symbols available at

  • Fixed the installer so that Npcap in WinPcap API-compatible mode can do
    loopback capture. This capability is not guaranteed for future releases, but
    was only missing from 0.99-r3 to 0.99-r6. Native-mode Npcap was unaffected.
    Fixes #1213

  • Added a script, FixInstall.bat, to fix common problems with installations,
    such as those caused by Windows 10 feature upgrades.
    See #1216

  • Improved stability by restoring certain passthrough NDIS callbacks that are
    not used, but appear to cause connectivity problems if omitted.
    See #1208.

Npcap 0.99-r6

@dmiller-nmap dmiller-nmap released this Jun 13, 2018

Installer and debug symbols available at

  • Fixed installation on Windows 8 and Server 2012 so that Npcap is able to
    capture on adapters without requiring a reboot. Fixes

  • Fixed loss of networking on Windows 7 when Npcap was configured to start at
    boot. Using AUTO_START instead of SYSTEM_START for the Npcap driver
    service solves the problem. Fixes #1208.

  • Fixed a crash reported via Microsoft crash telemetry,
    DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting

  • Fixed certain interactions between processes with open Npcap handles that
    could allow one process to stop other running captures from receiving
    packets. Fixes #1035.

Npcap 0.99-r5

@dmiller-nmap dmiller-nmap released this May 1, 2018

Executable installer and debug symbols available at

  • Restored installer code to silently uninstall WinPcap if silent installation
    in WinPcap API-compatible mode is needed (Npcap OEM only).

  • Removed several optional passthrough driver functions that can be handled
    more efficiently by NDIS, since Npcap was not using them.

  • Added validation of IRP parameters for additional security.

  • Fixed a crash reported via Microsoft crash telemetry,
    DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_SendCompleteExForEachOpen when the
    system is suspended. Fixes #1193.

  • Fixed a crash reported via Microsoft crash telemetry,
    DRIVER_IRQL_NOT_LESS_OR_EQUAL in NPF_IOControl when setting

  • Bundle and install the correct public code signing certificate. The
    certificate used to sign Npcap was updated for Npcap 0.99-r4, but the public
    cert file included was not, leading to some unwanted publisher trust dialogs
    during installation.

Npcap 0.99-r4

@dmiller-nmap dmiller-nmap released this Apr 20, 2018

Binary installer and debug symbols available from

  • On Windows 7, if Npcap driver installation fails due to maximum NDIS filters
    installed, attempt to increase the limit. No such limit exists on other
    Windows versions. Fixes #1182.

  • Avoid some cmd.exe popup windows during installation. See

  • Improve the license to allow unlimited copies of Npcap to be used
    (removes the 5 copy limitation) if the copies are solely used for
    Nmap and/or Wireshark.

Npcap 0.99-r3

@dmiller-nmap dmiller-nmap released this Apr 7, 2018

Binary installer, source zip, and debug symbols can be downloaded at

  • Fix recording of the Npcap Loopback Adapter's name in the service registry
    key. Loopback packet injection was broken in WinPcap API-compatible mode in
    Npcap 0.99-r1 and 0.99-r2. Fixes #1165.

  • Fix a double-close of a Registry key which could cause a crash in Packet.dll
    when debugging. Fixes #1163.

Npcap 0.99-r2

@dmiller-nmap dmiller-nmap released this Mar 13, 2018

Binary installer and debug symbols available at

  • Fix installer to work on 32-bit Windows.

Npcap 0.99-r1

@dmiller-nmap dmiller-nmap released this Mar 6, 2018

Executable installer and debug symbols available at

  • New Internal Use licensing option for Npcap OEM for users who need silent
    installs or more than five computers, but do not want to pay for
    redistribution rights.

  • Improved installation of the Npcap Loopback Adapter, ensuring it can be
    correctly removed and reinstalled.

  • Packet.DLL now only looks in the driver service's Parameters Registry key
    for installation options; in future releases, Npcap may stop writing these
    options to the HKLM:\Software\Npcap registry key.

  • When NpcapHelper.exe is used for UAC elevation, the pipe it uses to
    communicate with the calling process is now restricted to the user SID of the
    calling process. Previously, any user could cause NpcapHelper to obtain
    handles to other devices, though the handles were only valid for the calling

  • Performed Visual Studio Code Analysis on Packet.DLL and cleaned up several
    code health issues.

  • Improved debug logging, error checking, and diagnostics throughout.

Npcap 0.98

@dmiller-nmap dmiller-nmap released this Jan 17, 2018

Binary installer and symbols available at

  • Fix digital signatures for some files: OEM drivers were missing the Microsoft Attestation signature required for Windows 10 1703, and the installer was missing the SHA-1 signature required for Windows Vista.

Npcap 0.97

@dmiller-nmap dmiller-nmap released this Nov 28, 2017

Installer and debug symbols available at

  • Only include data rate and channel fields in the RadioTap header if they are
    reported by the underlying WiFi card driver. See nmap/nmap#1036

  • When the Npcap installer detects that WinPcap is present, it will default to
    installing in WinPcap API-compatible mode, replacing WinPcap. This can be
    changed by the user in the interactive installer, or by setting the
    /winpcap_mode=no command-line option.

  • The Silent installation feature of the Npcap installer is now limited to the
    Npcap OEM edition.

Npcap 0.96

@dmiller-nmap dmiller-nmap released this Nov 1, 2017

Binary installer may be downloaded from

  • Set the *IfType, *MediaType, and *PhysicalMediaType registry values for
    the Npcap Loopback Adapter. The values set should reduce the amount of
    configuration that Windows attempts to do on the adapter, preventing it from
    being labeled "Unknown Network."

  • Record the ID of the Npcap Loopback Adapter in the registry when creating it,
    instead of only in the installer. This allows users to remove and create the
    adapter with NPFInstall directly, without requiring a reinstallation of Npcap.

  • Expand the Npcap public license to allow 5 installations rather than only 1.

  • Fix memory layout and accounting when writing Radiotap headers in raw 802.11
    monitor mode. Fixes nmap/nmap#1001
    nmap/nmap#1028, and nmap/nmap#1036.