 | 1 | initial version |
- What configurations does it touch/modify/change?
It may put the interface in promiscuous mode, which has, on occasion, been known to change some network behavior in ways that clear up networking problems; however, as you tried both with and without promiscuous mode, with no change, that's probably not what's happening here.
Npcap, which provides the capture mechanisms that Wireshark (and other programs) use, adds a "filter driver" to the networking stack. As far as I know, that driver is always in the stack, but when a capture is in progress, that might change the behavior of the networking stack. You'd have to ask the Npcap developers about that.
- Which services does it start? If any?
It doesn't directly start any services; if installed with Npcap, there's a service that's part of Npcap that I think is started when the machine is booted.
- Which processes does it use?
The Wireshark UI process and a subprocess, running the "dumpcap" utility that's part of Wireshark, which does the packet capturing and writes the packets to a file.
- Does it change any OS settings?
Nothing other than the stuff Npcap does.
| | 2 | No.2 Revision |
What configurations does it touch/modify/change?
It may put the interface in promiscuous mode, which has, on occasion, been known to change some network behavior in ways that clear up networking problems; however, as you tried both with and without promiscuous mode, with no change, that's probably not what's happening here.
Npcap, which provides the capture mechanisms that Wireshark (and other programs) use, adds a "filter driver" to the networking stack. As far as I know, that driver is always in the stack, but when a capture is in progress, that might change the behavior of the networking stack. You'd have to ask the Npcap developers about that.
Which services does it start? If any?
It doesn't directly start any services; if installed with Npcap, there's a service that's part of Npcap that I think is started when the machine is booted.
Which processes does it use?
The Wireshark UI process and a subprocess, running the "dumpcap" utility that's part of Wireshark, which does the packet capturing and writes the packets to a file.
Does it change any OS settings?
Nothing other than the stuff Npcap does.
