Download Npcap (Winpcap) 0.9995 – Tiện ích giám sát mạng

3 weeks ago

taiphanmem

7 minutes

Download Npcap (Winpcap) 0.9995 – Tiện ích giám sát mạng

Npcap (Winpcap) là ứng dụng hỗ trợ người dùng truy cập mạng ở tầng liên kết dữ liệu trong môi trường Windows.

Npcap (Winpcap) cho phép bắt và truyền tải dữ liệu mạng, cung cấp thêm các tính năng như công cụ thống kê mạng, bộ lọc gói mạng mức kernel và hỗ trợ chụp gói từ xa.

Npcap (Winpcap) là gì?

Npcap bao gồm một trình điều khiển mở rộng hệ điều hành để cung cấp khả năng truy cập mạng mức độ thấp, cùng với một thư viện hỗ trợ truy cập các lớp mạng mức độ thấp. Thư viện này cũng chứa phiên bản Windows của libpcap Unix API.

Với một loạt tính năng hữu ích, Npcap là tiện ích lọc và chụp dữ liệu hiệu quả của nhiều công cụ mã nguồn mở như: công cụ phân tích giao thức, hệ thống phát hiện xâm nhập mạng, bộ tạo lưu lượng truy cập, công cụ kiểm tra mạng và công cụ quét mạng. Một số công cụ mạng như: Wireshark , Nmap, Snort rất được biết đến và sử dụng trong cộng đồng mạng.

Npcap (Winpcap) phát hành theo giấy phép mã nguồn mở BSD, cho phép bạn thay đổi và sử dụng cùng với ứng dụng của mình. Mã nhị phân và mã nguồn luôn có sẵn ở đây.

Tính năng chính của Npcap

Npcap (Winpcap) for Windows 10 : Npcap runs on Windows 7 and above using the new NDIS 6 Light-Weight Filter (LWF) API. It operates faster than the older NDIS 5 API, which Microsoft may remove at any time. Furthermore, the EV-certified driver signed by Microsoft can run on drivers requiring stricter registration from Windows 10 1607.
Enhanced Security : Npcap can limit access such that only administrators can identify packets. Users who are not administrators using Npcap through software like Nmap or Wireshark will need to go through the User Account Control (UAC) dialog to use the driver. It’s similar to UNIX, where root access often requires packet access. Npcap also enables ASLR & DEP security features and has a signed driver to prevent tampering.
Loopback Packet Capture : Npcap supports detecting loopback packets using the Windows Filtering Platform (WFP). After installation, Npcap will create an adapter named Npcap Loopback for you. If you are a Wireshark user, select this adapter to capture packets, and you will see loopback traffic as if using a non-loopback adapter. Try it by typing commands like “ping 127.0.0.1” (IPv4) or “ping ::1” (IPv6).
Loopback Packet Injection : Npcap also sends loopback packets using the Winsock Kernel (WSK) technique. User-level software like Nping can only send packets outside using the Ncap Loopback adapter like any other adapter. Subsequently, Npcap performs “magic” by removing the packet’s Ethernet header and placing the payload into Windows’ TCP/IP stack.
Libcap API : Npcap utilizes the excellent Libcap library, enabling Windows applications to use a portable packet capture API, supporting both Linux and Mac OS X. While Winpcap was based on LibPcap 1.0.0 from 2009, Npcap includes the latest Libcap release along with other enhancements.
Npcap Compatibility: For applications not utilizing Npcap’s advanced features. Npcap can be installed in “Npcap (Winpcap) Compatible Mode.” This feature replaces any Npcap (Winpcap) installation. If the compatibility mode is not selected, Npcap coexists with Winpcap. Applications only recognizing Winpcap will continue using it, while others can choose the newer, faster Npcap driver.

Latest Npcap Updates

Npcap 0.9995

Fix for BSoD hang in NPF_Read when NDIS filter module is removed from an adapter.
On Windows 10, the Npcap driver is updated to NDIS 6.50 and compatible with Windows 10 WFP, supporting network improvements like RSC.
Complying with maximum frame size for adapter by querying OID_GEN_MAXIMUM_TOTAL_SIZE instead of using MTU, excluding space for link-layer headers.
Fixed leaks when using Npcap resources to uninstall or upgrade.
Adhering to snaplen (pcap_set_snaplen()) even if no packet filter is set.
Upgrade against pool/slab allocator, enabling memory release when not in use.
When installing Npcap OEM in silent mode, avoid running C:\Uninstall.exe unless the current Npcap installation process is exited.

Npcap 0.9981

During Npcap upgrade, don’t uninstall existing Npcap until user clicks Install.
Redefine I/O control codes used by Npcap when using macro CTL_CODE to ensure control and proper parameter matching. This is not an exported API, but changes will require Packet.DLL and Npcap driver to be the same version.
Fixed 1-byte overflow in NPFInstall.exe when closing processes using Npcap DLLs.
If PacketOpenAdapter is named in UTF-16LE, convert it to ASCII before performing string operations.
Significantly rearranged internal data structures to reduce memory usage and initialization costs.

Frequently Asked Questions

Npcap is an application and driver that allows users to access the network at the data link layer in a Windows environment. It enables applications to capture and transmit network data packets and provides features such as network statistics tools, kernel-level packet filters, and support for remote packet capturing. Npcap also includes a Windows-compatible library of the libpcap Unix API.

Npcap supports Windows 7 and above with the new NDIS 6 Light-Weight Filter API, has an EV-certified driver by Microsoft, enhances security by restricting access to administrators only, supports capturing and injecting loopback packets using Windows technologies, uses the latest Libcap API, and offers compatibility mode with Winpcap to ensure usability with older applications.

Npcap is highly compatible with many prominent open-source tools such as Wireshark, Nmap, Snort, and other network protocol analyzers, intrusion detection systems, traffic generators, network testing, and scanning tools.

Npcap is released under the BSD open-source license, allowing users to modify and use it with their applications. The source code and binaries are always provided.

Npcap restricts packet access to administrators only and requires non-administrators to go through the User Account Control (UAC) dialog to use it. It also enables ASLR & DEP security features, and its driver is signed to prevent tampering.

Npcap supports detecting and capturing loopback packets using the Windows Filtering Platform (WFP) and creating the Npcap Loopback adapter. Additionally, it sends loopback packets using the Winsock Kernel (WSK) technique, removing the Ethernet header and placing the payload into Windows’ TCP/IP stack.

Users can update Npcap to the latest version from the official homepage or source. The newest version, such as Npcap 0.9995, includes enhancements in Windows 10 compatibility, bug fixes, and performance improvements.

The Winpcap Compatibility Mode allows Npcap to run alongside or replace Winpcap, helping applications that only recognize Winpcap continue to function normally. When this mode is not selected, Npcap coexists with Winpcap, enabling applications to choose the appropriate driver.