Ask Your Question
0

Can we freely distribute customized wireshark windows installer with npcap?

asked 2019-12-26 06:02:54 +0000

Dorababu gravatar image

updated 2019-12-26 06:03:37 +0000

We use our own plugin in Wireshark. Recently we recompiled our plugin to work with new Wireshark. But what we got to know that new wireshark uses Npcap instead of WinPcap support is now very limited. Our target systems are Windows Server 2012/R2/Windows 2016/Windows 10

We want to distribute the customized Wireshark to our customers, but this link point to some restrictions:-

https://nmap.org/npcap/oem/redist.html https://github.com/nmap/npcap/blob/ma... Also we tried using Win10Pcap (http://www.win10pcap.org/) but didn’t worked for us and code also seems to be 4 years old.

Our concern is:- Can we freely distribute Npcap for commercial purposes? If not does using Npcap with Wireshark involves any licence and how to obtain that? Is there a way of using Winpcap so that it works with latest Wireshark and supports Windows Server 2012/R2/Windows 2016/Windows 10?

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by » oldest newest most voted
1

answered 2019-12-26 07:31:54 +0000

grahamb gravatar image

Yes, npcap has a licence restriction on redistribution. This is done to allow funding of pcap support.

Your choices seem to be:

  1. Submit your dissector to the Wireshark project where it will be maintained by the project team and distributed for all to access. Note that as you are already distributing to customers, the source code of your plugin should be available to those customers under the Wireshark (GPL 2.0 or later) licence.
  2. Obtain an npcap distribution licence from nmap (as detailed in the ncap licence).
  3. Modify your copy of the Wireshark installer to not include npcap, and request your customers download and install their own copy of npcap (as suggested in the npcap licence).
  4. Modify your copy of the Wireshark installer to install WinPcap which works on all those OS's you have listed. Note that any support and development for WinPcap ended many years ago. At some point, MS changes to Windows may stop it working.
  5. Do something else with other random unsupported Windows capture libraries, e.g. Win10PCap.
edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2019-12-26 06:02:54 +0000

Seen: 530 times

Last updated: Dec 26 '19

Related questions

At what stage does Wireshark check which capture library (npf) is installed?

Dumpcap captures traffic, but Wireshark and Tshark can't see the interfaces

Wireshark 2.4.1 GTK Crash on long run

Why redirection of VoIP calls to voicemail fails?

Capture incoming packets from remote web server

How do I get and display packet data information at a specific byte from the first byte?

Client is waiting for FIN flag from server for 30 sec

wifi disconnects as wireshark starts

How do I add "child item" to an item in the subtree?

What is the syntax for wireshark custom column