I installed the NPCap driver that comes with Wireshark, and also Win10PCap (another driver created to overcome the problem of WinPCap not working on Windows10). Right now, WireShark is using NPCap, and I need to know what menu setting to go to, to tell it to use Win10PCap instead. Is there such a driver selection setting in the menus? Or is this a feature not yet available?
There is no mechanism in Wireshark to support that.
Why not just use Npcap?
Also note that there is no issue with running WinPcap on Windows 10, it works exactly the same as it has on earlier versions of Windows. I wish this meme would die.
Win10Pcap has been abandoned, the last update was 4 years ago. Best to NOT use it.
Having said that, npcap is the preferred library for Wireshark 3.0 onwards as it is actively maintained.
If there's no problem with WinPcap running in Win10, then why did NPCap need to be created? And how do I test which driver Wireshark is using? I'm not 100% sure I fully uninstalled WinPcap.
WinPcap uses a Windows API called NDIS5 and this is deprecated, in addition, WinPcap is not being maintained. Npcap uses NDIS6 and is maintained by the nmap project.
You can see the driver library being used in the Wireshark -> Help -> About Wireshark -> Wireshark dialog, in the "Running on..." section of text.
Comments