Pcap#WinPcap

libpcap, WinPcap, and Npcap provide the packet-capture and filtering engines of many open-source and commercial network tools, including protocol analyzers (packet sniffers), network monitors, network intrusion detection systems, traffic-generators and network-testers.

Most current Unix-like systems provide a mechanism by which a program can capture network traffic to and from the machine running the program and, in some cases, other traffic to which that machine is attached. However, these mechanisms are significantly different from one another; the libpcap library provides a common API to access these mechanisms, allowing programs to be written to capture network traffic without having to worry about the details of all those mechanisms.

libpcap, WinPcap, and Npcap also support saving captured packets to a file, and reading files containing saved packets; applications can be written, using libpcap, WinPcap, or Npcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap, WinPcap, and Npcap use can be read by applications that understand that format, such as tcpdump, Wireshark, CA NetMaster, or Microsoft Network Monitor 3.x. The file format is described by Internet-Draft draft-ietf-opsawg-pcap;{{cite IETF |draft=draft-ietf-opsawg-pcap |title=PCAP Capture File Format |date=23 July 2023}} the current editors' version of the draft is also available.{{cite web |url=https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcap.html |title=PCAP Capture File Format |date=1 March 2024}}

The MIME type for the file format created and read by libpcap, WinPcap, and Npcap is application/vnd.tcpdump.pcap. The typical file extension is .pcap, although .cap and .dmp are also in common use.{{cite web |last=Turner |first=Glen |date=2011-03-30 |title=IANA record of application for MIME type application/vnd.tcpdump.pcap |url=https://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap |access-date=2023-02-25 |website=IANA}}

libpcap was originally developed by the tcpdump developers in the Network Research Group at Lawrence Berkeley Laboratory. The low-level packet capture, capture file reading, and capture file writing code of tcpdump was extracted and made into a library, with which tcpdump was linked.{{cite web|url=https://sharkfest.wireshark.org/retrospective/sfus/presentations11/McCanne-Sharkfest'11_Keynote_Address.pdf|title=libpcap: An Architecture and Optimization Methodology for Packet Capture|first=Steve|last=McCanne|access-date=December 27, 2013}} It is now developed by the same tcpdump.org group that develops tcpdump.{{cite web|url=https://www.tcpdump.org/|title=TCPDUMP/LIBPCAP public repository|access-date=December 27, 2013}}

While libpcap was originally developed for Unix-like operating systems, a successful port for Windows was made, called WinPcap. It has been unmaintained since 2013,{{cite web|url=https://www.winpcap.org/news.htm|title=WinPcap News|access-date=November 6, 2017}} and several competing forks have been released with new features and support for newer versions of Windows.

WinPcap consists of:{{cite web|url=http://www.winpcap.org/docs/docs_412/html/group__internals.html|title=WinPcap internals|access-date=December 27, 2013}}

• x86 and x86-64 drivers for the Windows NT family (Windows NT 4.0, 2000, XP, Server 2003, Vista, 7, 8, and 10), which use Network Driver Interface Specification (NDIS) 5.x to read packets directly from a network adapter;
• implementations of a lower-level library for the listed operating systems, to communicate with those drivers;
• a port of libpcap that uses the API offered by the low-level library implementations.

Programmers at the Politecnico di Torino wrote the original code. As of 2008, CACE Technologies, a company set up by some of the WinPcap developers, developed and maintained the product. CACE was acquired by Riverbed Technology on October 21, 2010.{{cite press release|url=http://www.riverbed.com/us/company/news/press_releases/2010/press_102110.php|title=Riverbed Expands Further Into The Application-Aware Network Performance Management Market with the Acquisition of CACE Technologies|publisher=Riverbed Technology|date=2010-10-21|access-date=2010-10-21|archive-url=https://web.archive.org/web/20130308100122/http://www.riverbed.com/us/company/news/press_releases/2010/press_102110.php|archive-date=2013-03-08|url-status=dead}}

Because WinPcap uses the older NDIS 5.x APIs, it does not work on some builds of Windows 10, which have deprecated or removed those APIs in favor of the newer NDIS 6.x APIs. It also forces some limitations such as being unable to capture 802.1Q VLAN tags in Ethernet headers.

The WinPcap project has ceased development and WinPcap and WinDump are no longer maintained. The last official WinPcap release was 4.1.3 released March 8, 2013.{{cite web |date=2013-03-08 |title=WinPcap · News |url=https://www.winpcap.org/news.htm |website=WinPcap}}

Npcap is the Nmap Project's packet sniffing library for Windows.{{cite web|url=https://npcap.com|title=Npcap}} It is based on WinPcap, but written to make use of Windows networking improvements in NDIS version 6. Its authors rewrote the WinPcap NDIS 5 Protocol Driver as a Light-Weight Filter (LWF) driver, a change that reduces processing overhead.{{cite web |url=https://docs.microsoft.com/en-us/windows-hardware/drivers/network/ndis-filter-drivers|title=Filter drivers|date=15 December 2021 }}

Npcap maintenance releases updated the version of the included libpcap library to the latest available, allowing software authors to use the newer API features that Linux software had already supported.{{cite web |url=https://github.com/nmap/npcap/releases/tag/v1.20|title=Release Npcap 1.20|website=GitHub }} Most software that used WinPcap can be easily ported to use Npcap with minimal changes.{{cite web |url=https://npcap.com/guide/npcap-devguide.html#npcap-devguide-updating|work=Developing software with Npcap |title=Updating WinPcap software to Npcap |access-date=2023-02-25}}

Npcap introduced several innovations that were not available in WinPcap:

• Npcap can be restricted so that only Administrators can sniff packets.{{cite web |work=Npcap Users' Guide |title=Graphical installer options |url=https://npcap.com/guide/npcap-users-guide.html#npcap-installer-options-gui |access-date=2023-02-25}}
• Npcap is able to sniff and inject loopback packets (transmissions between services on the same machine) by using the Windows Filtering Platform.{{cite web |url=https://npcap.com/guide/npcap-devguide.html#npcap-feature-loopback|work=Npcap User's Guide |title=For software that uses Npcap loopback feature|accessdate=2023-02-25}}
• Npcap can capture 802.11 WiFi frames on a variety of commonly-available network adapters.{{cite web |url=https://npcap.com/guide/npcap-devguide.html#npcap-feature-dot11|work=Npcap User's Guide |title=For software that uses Npcap raw 802.11 feature|access-date=2023-02-25}}

Unlike Nmap, Npcap is proprietary software and requires a special license for use and redistribution except for some limited internal uses.{{cite web|url=https://github.com/nmap/npcap/blob/master/LICENSE|title=Npcap License|website=GitHub }}

Win10Pcap implementation is also based on the NDIS 6 driver model and works stably with Windows 10.{{cite web|url=http://www.win10pcap.org|title=Win10Pcap: WinPcap for Windows 10}} The project, however, has been inactive since 2016.{{Citation|title=Win10Pcap: WinPcap for Windows 10 (NDIS 6.x driver model): SoftEtherVPN/Win10Pcap|date=2019-12-31|url=https://github.com/SoftEtherVPN/Win10Pcap|publisher=SoftEther VPN Project|access-date=2020-01-09}}

• Bit-Twist, a libpcap-based Ethernet packet generator and editor for BSD, Linux, and Windows.
• Cain and Abel, a discontinued password recovery tool for Microsoft Windows
• EtherApe, a graphical tool for monitoring network traffic and bandwidth usage in real time.
• Firesheep, a discontinued extension for the Firefox web browser that captured packets and performed session hijacking
• iftop, a tool for displaying bandwidth usage (like top for network traffic)
• Kismet, for 802.11 wireless LANs
• L0phtCrack, a password auditing and recovery application.
• McAfee ePolicy Orchestrator, Rogue System Detection feature
• ngrep, aka "network grep", isolate strings in packets, show packet data in human-friendly output.
• Nmap, a port-scanning and fingerprinting network utility
• Pirni, a discontinued network security tool for jailbroken iOS devices.
• Scapy, a packet manipulation tool for computer networks, written in Python by Philippe Biondi.
• Snort, a network-intrusion-detection system.
• Suricata, a network intrusion prevention and analysis platform.
• Symantec Data Loss Prevention, Used to monitor and identify sensitive data, track its use, and location. Data loss policies allow sensitive data to be blocked from leaving the network or copied to another device.
• tcpdump, a tool for capturing and dumping packets for further analysis, and WinDump, the Windows port of tcpdump.
• Zeek, an intrusion detection system and network monitoring platform.
• [https://www.techopedia.com/definition/26915/url-snooping URL Snooper], locate the URLs of audio and video files in order to allow recording them.
• WhatPulse, a statistical (input, network, uptime) measuring application.
• Wireshark (formerly Ethereal), a graphical packet-capture and protocol-analysis tool.
• XLink Kai, software that allows various LAN console games to be played online
• Xplico, a network forensics analysis tool (NFAT).

• C++: [https://libtins.github.io/ Libtins], [https://github.com/pellegre/libcrafter Libcrafter], [https://pcapplusplus.github.io/ PcapPlusPlus]
• Perl: [http://search.cpan.org/~saper/Net-Pcap/Pcap.pm Net::Pcap]
• Python: [http://sourceforge.net/projects/pylibpcap/ python-libpcap], [https://www.coresecurity.com/corelabs-research/open-source-tools/pcapy Pcapy], [http://github.com/orweis/winpcapy WinPcapy]
• Ruby: [https://github.com/packetfu/packetfu PacketFu]
• Rust: [https://github.com/ebfull/pcap pcap]
• Tcl: [http://tclpcap.sourceforge.net/ tclpcap], [http://monkey.org/~jose/software/tcap/ tcap], [http://home.roadrunner.com/~maccody/pktsrc.html pktsrc]
• Java: [http://jpcap.sourceforge.net/ jpcap], [https://web.archive.org/web/20121104024808/http://jnetpcap.com/ jNetPcap], [https://archive.today/20101017042631/http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html Jpcap], [https://github.com/kaitoy/pcap4j Pcap4j], [https://github.com/jxnet/Jxnet Jxnet]
• .NET: WinPcapNET, [https://github.com/chmorgan/sharppcap SharpPcap], [http://pcapdot.net Pcap.Net]
• Haskell: [http://hackage.haskell.org/package/pcap pcap]
• OCaml: [https://web.archive.org/web/20110830000918/http://www.drugphish.ch/~jonny/mlpcap.html mlpcap]
• Chicken Scheme: [http://wiki.call-cc.org/eggref/3/pcap pcap]
• Common Lisp: [https://github.com/atomontage/plokami PLOKAMI]
• Racket: [http://planet.racket-lang.org/display.ss?package=SPeaCAP.plt&owner=evanfarrer SPeaCAP]
• Go: [https://github.com/akrennmair/gopcap pcap] by Andreas Krennmair, [http://godoc.org/github.com/miekg/pcap pcap] fork of the previous by Miek Gieben, [http://godoc.org/code.google.com/p/gopacket/pcap pcap] developed as part of the [https://pkg.go.dev/github.com/google/gopacket gopacket] package
• Erlang: [https://github.com/msantos/epcap epcap]
• Node.js: [https://github.com/node-pcap/node_pcap node_pcap]

• Python: [https://pypi.python.org/pypi/pypcapfile pycapfile]
• Python: [https://pypi.python.org/pypi/pypcapkit PyPCAPKit]

• Apache Drill, an open source SQL engine for interactive analysis of large scale datasets.{{cite web|url=https://drill.apache.org/blog/2017/07/31/drill-1.11-released/|title=Drill 1.11 Released|first=Bridget|last=Bevens|date=July 31, 2017}}{{github|https://github.com/apache/drill/blob/master/contrib/format-pcapng/src/main/java/org/apache/drill/exec/store/pcap/decoder/Packet.java}}
• Endace's EndaceProbe, a high scale packet capture system that continuously records weeks or months of network traffic.{{cite web|url=https://www.endace.com/learn/what-is-a-pcap-file|title=What Can Read or Save a PCAP?|work=What is a PCAP file?|publisher=Endace}}

{{Reflist|30em}}

{{Portal|Free and open-source software}}

• {{Official website|https://tcpdump.org}}, libpcap, tcpdump
• {{Official website|https://npcap.com}}, Npcap
• {{Official website|https://www.winpcap.org/}}, WinPcap, WinDump
• [https://www.netresec.com/?page=PcapFiles List of publicly available PCAP files]

Category:Network analyzers

Category:Unix network-related software

Category:Windows network-related software

Category:MacOS network-related software

Category:Windows security software

Category:MacOS security software

Category:Free software programmed in C

Category:Cross-platform free software

Category:Free network management software

Category:Software using the BSD license