With "WinPcap Compatible Mode" OFF, Npcap installs its DLLs into C:\Windows\System32\Npcap\ instead of WinPcap's C:\Windows\System32\. The key about which is loaded first is DLL Search Path. The applications who knows Npcap's existence can choose to use Npcap or WinPcap first. So the applications unaware of Npcap SHOULD be able to use Npcap automatically if WinPcap is unavailable. With "WinPcap Compatible Mode" OFF, Npcap can coexist with WinPcap and share the DLL binary interface with WinPcap. "WinPcap Compatible Mode" Support: "WinPcap Compatible Mode" is used to decide whether Npcap should coexist With WinPcap or be compatible with WinPcap.This is similar to UNIX where you need root access to capture packets. Only when the end user chooses Yes, the driver can be accessed. If Npcap is installed with the option Restrict Npcap driver's access to Administrators only checked, when a non-Admin user tries to start a user software (Nmap, Wireshark, etc), the User Account Control (UAC) dialog will prompt asking for Administrator privilege. "Admin-only Mode" Support: Npcap supports to restrict its use to Administrators for safety purpose.One reason is that packet data stucture has changed (from NDIS_PACKET to NET_BUFFER_LIST) since Vista and NDIS 5 needs to handle extra packet structure conversion. It's faster than the legacy NDIS 5 Intermediate technique. NDIS 6 Support: Npcap makes use of new LWF driver in Windows Vista and later (the legacy driver is used on XP).It also received many helpful tests from Wireshark and NetScanTools.
It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 20. Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique.
0 kommentar(er)
