Ask Your Question
0

Npcap is installed but Wireshark says unable to load on ARM64

asked 2022-04-07 19:14:50 +0000

updated 2022-04-08 11:07:34 +0000

grahamb gravatar image

On a new install of Wireshark, including Npcap, when starting Wireshark it reports:

Unable to load Npcap or WinPcap (wpcap.dll); you will not be able to capture packets. In order to capture packets Npcap or WinPcap must be installed. See https://npcap.com/ for a downloadable version of Npcap and for instructions on how to install it

Npcap is installed. Any tips on how to troubleshoot this?

*************************************************
DiagReport for Npcap ( http://npcap.org )
*************************************************
Script Architecture:        64-bit
Script Path:            C:\Program Files\Npcap\DiagReport.ps1
Current Time:           04/08/2022 07:02:38
Npcap install path:     C:\Program Files\Npcap
Npcap Version:          1.55
PowerShell Version:     5.1.22000.282


*************************************************
OS Info:
*************************************************       
Caption                 : Microsoft Windows 11 Pro
BuildNumber             : 22000
Locale                  : 0409
MUILanguages            : {en-US}
OSArchitecture          : ARM 64-bit Processor
ServicePackMajorVersion : 0
ServicePackMinorVersion : 0
SystemDirectory         : C:\Windows\system32
Version                 : 10.0.22000
edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-04-07 21:31:27 +0000

grahamb gravatar image

updated 2022-04-08 12:24:46 +0000

It appears you're running on the bleeding edge. from the output:

OSArchitecture          : ARM 64-bit Processor

While npcap does support ARM, there is no Windows ARM build of Wireshark so it must be running under x86 emulation. According to MS, experimental support for x64 applications was added in build 21277, you have 22000.

I'm not sure if the x86 version, running under emulation, will work with the ARM64 version of npcap and as you've found, apparently not.

Edit: Hidden in the comments below, the user switched to the x86 (32 bit) version of Wireshark and it now loads the npcap x86 DLL's.

edit flag offensive delete link more

Comments

I'm not sure if the x86 version, running under emulation, will work with the ARM64 version of npcap

Support for loading an ARM64 DLL into an x86-64 executable may not be supported on Windows; they may only support having translated x86-64 executables load x86-64 DLLs by translating the x86-64 DLL into ARM64 at load time.

This is a known Npcap issue. ARM64 Npcap installs no x86-64 DLLs; the workaround that the person who opened that issue used is:

I was able to get x64 Wireshark to capture packets on my Arm64 Windows 11 by copying wpcap.dll and packet.dll from an x64 system to Wireshark's installation directory.

Guy Harris gravatar imageGuy Harris ( 2022-04-08 06:21:53 +0000 )edit

Or install the 32 bit version of Wireshark which should be able to load the x86 32 bit npcap DLLs.

grahamb gravatar imagegrahamb ( 2022-04-08 07:47:03 +0000 )edit

Or install the 32 bit version of Wireshark which should be able to load the x86 32 bit npcap DLLs.

Are those DLLs installed when ARM64 Npcap is installed? If not, I'm not sure that installing Npcap with IA-32 Wireshark will work, as that would probably try to install IA-32 Npcap, which would probably try to install an IA-32 kernel driver, which Will Not Work on an ARM64 (or x86-64 or ARM32) system.

Guy Harris gravatar imageGuy Harris ( 2022-04-08 08:05:32 +0000 )edit

I was going by the npcap release notes for 1.50 that state:

Npcap can now be installed on Windows 10 for ARM64 devices. Both ARM64 and x86 DLLs will be installed, allowing existing x86 applications such as Nmap or Wireshark to run without modification.

grahamb gravatar imagegrahamb ( 2022-04-08 09:23:00 +0000 )edit

Thank you for the suggestions. I can confirm that the following DLLs are present: C:\Windows\SysWOW64\Npcap\wpcap.dll C:\Windows\System32\Npcap\wpcap.dll

brandyballoon gravatar imagebrandyballoon ( 2022-04-08 10:51:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-04-07 19:14:50 +0000

Seen: 217 times

Last updated: Apr 08