 | 1 | initial version |
You're assuming the loopback adapter is a regular Windows network adapter that can have an IP address assigned to it, and that loopback traffic passes through it.
As far as I know, that's not the case. Windows support loopback traffic to 127.0.0.1 even if you don't have Npcap installed; the looping back doesn't go through a regular NDIS interface, I think it's special-cased in the IPv4 and IPv6 code.
All Npcap does is provide a special hook to allow that looped-back traffic to be captured; the hook looks like a network adapter from the point of view of the libpcap API, so that programs using that API (which is also the Npcap API) to capture traffic can capture on it the same way it can capture on a regular interface, but that doesn't mean it is a regular interface.
If you want an authoritative answer, you should post it as an issue on the Npcap issues list, so that Daniel Miller, the Npcap developer, can answer in more detail. My main role in Npcap is "developer and maintainer of the code in libpcap that uses the lower-level Npcap code, and that's incorporated into Npcap"; I do know some of Npcap's lower-level innards, but I don't regularly work on it, I just look at it as necessary to make libpcap stuff work with it.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
