Ask Your Question
0

Help installing PCAP WPCAP in Windows 7 64 bits (syswow64-system32)

asked 2020-06-14 20:38:04 +0000

Citrusl gravatar image

updated 2020-06-14 20:40:40 +0000

I saw that there are several cases but I couldn't find a solution.

Which is the problem?

wpcap is not compatible with wireshark. I understand that NPCAP is needed to fix the compatibility issue. Can i use Wireshark whitout fix this? absolutely not.

What i see?

I noticed that when i run the NPCAP installer it will search for wpcap DLL in "c/System32/wpcap.dll" which is not there. it's actually in syswow64 folder (also packet DLL which looks related).

What i have done?

I deleted both dlls manually and tryed to install them again. (ver 4.3 i think) then continue whit NPCAP. (Same issue). Tryed to delete both manually and then run NPCAP (Same issue). After this wpcap sets to 5.0...

There is possible to specify from which path NPCAP should read those dlls? I read that it is not convenient to manually copy them into the folder because it could cause problems.

Also tryed that on "Safe Mode reboot".

Could you help me? this is a Windows 7 Ultimate 64 bits.

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
1

answered 2020-06-14 22:38:41 +0000

Guy Harris gravatar image

wpcap is not compatible with wireshark.

What is "wpcap"? If it's WinPcap, it is compatible with Wireshark, as is Npcap.

I understand that NPCAP is needed to fix the compatibility issue.

There is no such compatibility issue.

WinPcap may have some issues with newer versions of Windows (such as Windows 10), and Npcap should address those issues.

I noticed that when i run the NPCAP installer it will search for wpcap DLL in "c/System32/wpcap.dll" which is not there. it's actually in syswow64 folder (also packet DLL which looks related).

The Npcap installer has an option for "WinPcap Compatible Mode". The Npcap home page says:

  • WinPcap compatibility: For applications that don't yet make use of Npcap's advanced features, Npcap can be installed in “WinPcap Compatible Mode.” This will replace any existing WinPcap installation. If compatibility mode is not selected, Npcap can coexist alongside WinPcap; applications which only know about WinPcap will continue using that, while other applications can choose to use the newer and faster Npcap driver instead.

That option is not necessary for Wireshark; Wireshark will work OK with WinPcap (assuming WinPcap itself works on your version of Windows), Npcap installed in WinPcap compatible mode, or Npcap installed not in WinPcap compatible mode.

If not installed in WinPcap compatible mode, the libraries are installed in C:\Windows\System32\Npcap. There's wpcap.dll, which is the DLL that implements the Npcap API (libpcap API, with UN*X-specific APIs removed, Windows-specific APIs added, and some additional APIs), and packet.dll, which is used by wpcap.dll to communicate with the NPF driver that Npcap installs to do packet capture.

On a 64-bit version of Windows, the installer also installs libraries in C:\Windows\SysWOW64\Npcap, for the benefit of 32-bit programs.

I suggest you uninstall WinPcap and Npcap from Control Panel, if it reports either of them, and then remove any Npcap directories in C:\WIndows\System32 and C:\Windows\SysWOW64. Then download the latest version of Npcap and install it.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2020-06-14 20:38:04 +0000

Seen: 2,509 times

Last updated: Jun 14 '20