<sect1 id="npcap-intro">
  <title>Introduction</title>

  <para>This Manual describes the programming interface and the source code of
    Npcap. It provides detailed descriptions of the functions and structures
    exported to programmers, along with complete documentation of the Npcap
    internals. Several tutorials and examples are provided as well.</para>

  <sect2 id="npcap-description">
    <title>What is Npcap?</title>

    <para>Npcap is an architecture for packet capture and network analysis for
      Windows operating systems, consisting of a software library and a network
      driver.</para>

    <para>Most networking applications access the network through widely-used
      operating system primitives such as sockets. It is easy to access data on
      the network with this approach since the operating system copes with the
      low level details (protocol handling, packet reassembly, etc.) and
      provides a familiar interface that is similar to the one used to read and
      write files.</para>

    <para>Sometimes, however, the <quote>easy way</quote> is not up to the task,
      since some applications require direct access to packets on the network.
      That is, they need access to the <quote>raw</quote> data on the network
      without the interposition of protocol processing by the operating
      system.</para>

    <para>The purpose of Npcap is to give this kind of access to Windows
      applications. It provides facilities to:</para>

    <itemizedlist>
      <listitem>capture raw packets, both the ones destined to the machine where
        it's running and the ones exchanged by other hosts (on shared media)</listitem>
      <listitem>filter the packets according to user-specified rules before
        dispatching them to the application</listitem>
      <listitem>transmit raw packets to the network</listitem>
      <listitem>gather statistical information on the network traffic</listitem>
    </itemizedlist>

    <para>This set of capabilities is obtained by means of a device driver,
      which is installed inside the networking portion of the Windows kernel,
      plus a couple of DLLs.</para>

    <para>All of these features are exported through a powerful programming
      interface, easily usable by applications. The main goal of this manual is
      to document this interface, with the help of several examples.</para>

    <sect3>
      <title>What kind of programs use Npcap?</title>

      <para>The Npcap programming interface can be used by many types of
        network tools for analysis, troubleshooting, security and monitoring.
        In particular, classical tools that rely on Npcap are:</para>

      <itemizedlist>
        <listitem>network and protocol analyzers</listitem>
        <listitem>network monitors</listitem>
        <listitem>traffic loggers</listitem>
        <listitem>traffic generators</listitem>
        <listitem>user-level bridges and routers</listitem>
        <listitem>network intrusion detection systems (NIDS)</listitem>
        <listitem>network scanners</listitem>
        <listitem>security tools</listitem>
      </itemizedlist>
    </sect3>

    <sect3>
      <title>What Npcap can't do</title>

      <para>Npcap receives and sends the packets independently from the host
        protocols, like TCP/IP. This means that it isn't able to block, filter or
        manipulate the traffic generated by other programs on the same machine: it 
        simply <quote>sniffs</quote> the packets that transit on the wire. Therefore, it does not 
        provide the appropriate support for applications like traffic shapers, QoS 
        schedulers and personal firewalls. </para>
    </sect3>

  </sect2>

  <sect2 id="npcap-features">
    <title>Npcap Features</title>

      <para>Npcap has many exciting features that set it above other packet capture solutions:</para>

      <itemizedlist>
        <listitem><para><emphasis>Built for modern Windows</emphasis>: Npcap is written for Windows 10, Windows 8.1, Windows 8, and Windows 7. Using up-to-date NDIS versions, it allows you to capture traffic without slowing down the network stack. Npcap is implemented as a NDIS 6 Lightweight Filter driver, faster and with less overhead
	    than the legacy <ulink role="hidepdf" url="https://docs.microsoft.com/en-us/previous-versions/windows/hardware/network/ff557149(v=vs.85)">NDIS 5 Protocol Driver</ulink>
            used by WinPcap.
        </para></listitem>

	<listitem><para><emphasis>WinPcap compatibility</emphasis>: Npcap is a
	    drop-in replacement for <ulink role="hidepdf" url="https://www.winpcap.org/">WinPcap</ulink>
	    in most applications. 
        </para></listitem>

	<listitem><para><emphasis>Updated cross-platform libpcap API</emphasis>:
	    The libpcap API allows cross-platform packet capture applications
	    to target Linux, Windows, macOS, BSD, Solaris and others. Npcap includes
            the latest version of <ulink role="hidepdf" url="https://tcpdump.org">libpcap</ulink>,
	    providing the best solution for compatibility, performance, functionality, and security.
            </para></listitem>

        <listitem><para><emphasis>Loopback packet capture and injection</emphasis>: Npcap is able to
            see Windows loopback packets using the
            <ulink role="hidepdf" url="https://msdn.microsoft.com/en-us/library/windows/desktop/aa366510(v=vs.85).aspx">
              Windows Filtering Platform (WFP)</ulink>. Npcap supplies an
            interface named <quote>NPF_Loopback</quote>, with the description <quote>Adapter for loopback capture.</quote>
            Wireshark users can choose this adapter to capture all loopback traffic the same way as other
	    non-loopback adapters.
	    Packet injection works as well with <function>pcap_inject()</function>.
            </para></listitem>

        <listitem><para><emphasis>Raw 802.11 Packet Capture Support</emphasis>: Npcap is able to see
            <emphasis>802.11</emphasis> frames instead of <emphasis>emulated Ethernet</emphasis> frames on ordinary wireless
            adapters. You need to select the <option>Support raw 802.11 traffic (and monitor
              mode) for wireless adapters</option> option in the installation wizard to enable
            this feature. When your adapter is in <quote>Monitor Mode</quote>, Npcap will supply all
	    <emphasis>802.11 data + control + management</emphasis> packets with <ulink role="hidepdf" url="http://www.radiotap.org/">Radiotap</ulink> headers. When
            your adapter is in <quote>Managed Mode</quote>, Npcap will only supply <emphasis>Ethernet</emphasis>
            packets. Npcap directly supports using Wireshark to capture in <quote>Monitor Mode</quote>.
            Npcap also provides the <filename>WlanHelper.exe</filename>
            tool to manually configure WiFi PHY parameters. See more details
            about this feature in <xref linkend="npcap-feature-dot11" />.
            </para></listitem>

        <listitem><para><emphasis><quote>Admin-only Mode</quote> Support</emphasis>: Npcap supports restricting its
            use to Administrators for safety purpose. If Npcap is installed with
            the option <quote>Restrict Npcap driver's access to Administrators only</quote> checked,
            only Built-in Administrators may access its features via user software (Nmap, Wireshark, etc).
	    This provides a level of restriction similar to requiring root access for packet capture on Linux/UNIX.</para></listitem>

      </itemizedlist>
  </sect2>

  <sect2>
    <title>Purpose of this manual</title>

    <para>The purpose of this manual is to provide a comprehensive and easy way
      to browse the documentation of the Npcap architecture. You will find
      three main sections:</para>

    <para><xref linkend="npcap-users-guide" /> is for end users of Npcap, and
      primarily concerns installation options, hardware compatibility, and bug
      reporting procedures.</para>

    <para><xref linkend="npcap-devguide" /> is for programmers who need to use
      Npcap from an application: it contains information about functions and
      data structures exported by the Npcap API, a manual for writing packet
      filters, and information on how to include it in an application. A
      tutorial with several code samples is provided as well; it can be used to
      learn the basics of the Npcap API using a step-by-step approach, but it
      also offers code snippets that demonstrate advanced features.</para>

    <para><xref linkend="npcap-internals" /> is intended for Npcap developers
      and maintainers, or for people who are curious about how this system
      works: it provides a general description of the Npcap architecture and
      explains how it works. Additionally, it documents the complete device
      driver structure, the source code, the Packet.dll interface and the
      low-level Npcap API. If you want to understand what happens inside Npcap
      or if you need to extend it, this is the section you will want to
      read.</para>
  </sect2>

  <sect2>
    <title>Terminology</title>

    <para>We call Npcap an <wordasword>architecture</wordasword> rather than
      <wordasword>library</wordasword> because packet capture is a low level
      mechanism that requires a strict interaction with the network adapter and
      with the operating system, in particular with its networking
      implementation, so a simple library is not sufficient.</para>

    <para>For consistency with the literature, we will use the term
      <wordasword>packet</wordasword> even though
      <wordasword>frame</wordasword> is more accurate since the capture process
      is done at the data-link layer and the data-link header is included in
      the captured data.</para>

  </sect2>

  <sect2 id="npcap-license">
    <title>Npcap License</title>

    <para>Even though Npcap source code is publicly available for review, it is
      not open source software and may not be redistributed without special 
      permission from the Nmap Project. The
      <ulink
	  url="https://github.com/nmap/npcap/blob/master/LICENSE">Npcap
      Free License</ulink>
      allows end users to download, install, and use up to 5 copies of
      Npcap from our site for
      free. Copies which are only used with <ulink
      url="https://nmap.org">Nmap</ulink>, <ulink url="https://www.wireshark.org">Wireshark</ulink>, and/or
      <ulink
	  url="https://www.microsoft.com/en-us/microsoft-365/security/identity-defender">Microsoft
      Defender for Identity</ulink> don't count toward this 5-install
      limit.
    </para>


    <para>We fund the Npcap project by selling the Npcap OEM
    Edition. This special version of Npcap includes enterprise
    features such as the silent installer and commercial support as
    well as special license rights allowing customers to redistribute
    Npcap with their products or to install it on more systems within
    their organization with easy enterprise deployment. We offer two
    commercial license types:</para>

    <itemizedlist>
      <listitem>
	<para>The <ulink
	url="https://npcap.com/oem/redist.html">Npcap OEM
	Redistribution License</ulink> is for companies that wish to
	distribute Npcap OEM within their products (the free Npcap
	edition does not allow this). Licensees generally use the
	Npcap OEM silent installer, ensuring a seamless experience for
	end users. Licensees may choose between a perpetual unlimited
	license or an annual term license, along with options for
	commercial support and updates.</para>
      </listitem>
      <listitem>
	<para>The <ulink
	url="https://npcap.com/oem/internal.html">Npcap OEM
	Internal-Use License</ulink> is for organizations that wish to
	use Npcap OEM internally without redistribution outside their
	organization. This allows them to bypass the 5-system usage
	cap of the Npcap free edition. It includes commercial support
	and update options, and provides the extra Npcap OEM features
	such as the silent installer for enterprise-wide
	deployment.</para>
      </listitem>
    </itemizedlist>    
  </sect2>

  <sect2 id="npcap-download">
    <title>Obtaining Npcap</title>

    <para>The latest Npcap release can always be found
      <ulink url="https://npcap.com/#download">on the Npcap
        website</ulink> as an executable installer and as a source code
      archive.</para>
  </sect2>

  <sect2 id="npcap-guide-copyright">
    <title>Acknowledgements and copyright</title>

    <para>Npcap is an update of <ulink role="hidepdf" url="https://www.winpcap.org/">WinPcap</ulink>.
      It is developed
      by the <ulink role="hidepdf" url="https://nmap.org/">Nmap Project</ulink>
      as a continuation of the project started by Yang Luo
      under <ulink role="hidepdf" url="https://www.google-melange.com/gsoc/project/details/google/gsoc2013/hsluoyz/5727390428823552">Google Summer of Code 2013</ulink> and
      <ulink role="hidepdf" url="https://www.google-melange.com/gsoc/project/details/google/gsoc2015/hsluoyz/5723971634855936">2015</ulink>.
      It also received many helpful tests from <ulink role="hidepdf" url="https://www.wireshark.org/">Wireshark</ulink>
      and <ulink role="hidepdf" url="https://www.netscantools.com/">NetScanTools</ulink>.
    </para>

    <para>Portions of this guide were adapted from the WinPcap documentation.
      Copyright &#169; 2002-2005 Politecnico di Torino. Copyright &#169;
      2005-2010 CACE Technologies. Copyright &#169; 2010-2013 Riverbed
      Technology. Copyright &#169; 2025 Nmap Software LLC. All rights
      reserved.</para>
  </sect2>
</sect1>
