This is a question for the ncap folks over at npcap.com. I believe they're try to catch up with libpcap API, about which I know nothing.
Here are some links to libpcap specifically and the TCPDump site which covers libpcap as well.
I believe they're try to catch up with libpcap API
Given that they provide the libpcap API by compiling iibpcap code and shipping it as one of the libraries, there's not much catching up to do - I think they're currently based on libpcap 1.10.4, which is the current libpcap release.
I wasn't aware that npcap was now current with libpcap, looking at the release notes I can see that occurred in npcap 1.74, which has a critical regression so use 1.75 or later.
Current stable Wireshark (4.0.8) still installs npcap 1.71. That will change with the 4.2.x release.
As far as libpcap library use goes, the current Windows version of Wireshark is compiled with libpcap1.10.1.1
As far as libpcap library use goes, the current Windows version of Wireshark is compiled with libpcap1.10.1.1
...which differs from 10.1.4 only for bug fixes; no new APIs were introduced, at least as per diffs between pcap/pcap.h.
Can any npcap library functions reassemble fragmented packets?
No. It's libpcap plus driver code (and a library that the libpcap code uses to communicate with the driver), and libpcap's purpose is to deliver raw packets to an application; it's up to the application to do reassembly. Wireshark, for example, has code to do IP reassembly.
Asked: 2023-09-27 13:16:57 +0000
Seen: 80 times
Last updated: Sep 28 '23
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
