Good morning, how is it decided which version of NPCAP is bundled with Wireshark? I see that the latest available version of Wireshark is offering NPCAP 1.80 in the installer, but NPCAP 1.83 is available. Does the bundled NPCAP version generally follow the latest available version pretty closely, or is there usually a bit of lag?
Usually the versions track fairly closely in the development version, but for stable releases of Wireshark it depends. Since the 4.6.0 release is imminent, there is somewhat less urgency in updating the version of Npcap in the 4.4 branch, particularly if the most recent releases concentrate on new features versus bug fixes. However, we probably could update the version in 4.4 if asked
Thanks for the response. This question was prompted by CVE-2025-43715 which is addressed in NPCAP 1.83. The CVE very much reads like one of those "all the planets have to align for this to actually be a risk" issues, but I thought it was worth raising.
If you're going to be using Wireshark mainly on Windows it helps to think of them as separate programs.
The most current npcap is available at https://npcap.com/#download
Notifications of new npcap versions are available from https://github.com/nmap/npcap/releases (1.84 released today)
I can't think of a recent instance where Wireshark didn't work with a newer version of npcap than what was bundled with the Wireshark installer.
If you run the development version of Wireshark it usually has a pretty recent npcap bundled with it.
See "Live on the Bleeding Edge" on https://www.wireshark.org/download.html
Asked: 2025-10-02 16:18:31 +0000
Seen: 88 times
Last updated: Oct 02
