Npcap 1.84

Installer and debug symbols available from https://npcap.com/#download

• Fixed a regression in #742 (previously fixed in Npcap 1.80). The fix changes
  to libpcap had been overwritten in our local branch, causing the same
  Application Verifier faults to recur.

• Resolve an issue in the installer/uninstaller where x64-emulated processes on
  ARM64 (and possibly 32-bit processes on both x64 and ARM64) that were using
  Npcap were not correctly terminated, leading to failed installations.

• New DriverQuery.exe diagnostic tool. This will be run as part of
  DiagReport
  on new installations, but can be run independently on older installations for
  better diagnosis of connection issues.

• Added performance metrics for time spent processing packets. These can be
  queried with the DriverQuery diagnostic tool or via PacketGetInfo() using
  the NPF_GETINFO_STATS query ID.

• Added additional checks to ensure data structures allocated when injecting
  packets are freed. No leaks were reported, but it is possible some packets
  could have been leaked when using the SendToRx feature.

• An experimental feature, adaptive buffer sizing, can be enabled in Packet.dll
  by setting the PACKET_EXPERIMENTAL_OPTIMIZATION environment variable.
  See (#622).

Npcap 1.83

Installer and debug symbols available from https://npcap.com/#download

• [SECURITY] Rebuilt the Windows self-installer with NSIS 3.11, addressing
  CVE-2025-43715--a race condition in earlier NSIS versions that could allow
  local attackers to escalate to SYSTEM privileges when a vulnerable installer
  is run as SYSTEM. The Npcap installer does not run as SYSTEM by default.

• Added a check for malformed OID request objects. This should prevent the BSoD
  crashes that have been reported when setting up a PPPoE connection (#296).

• Fixed an issue with SendToRx mode that resulted in packet injection calls
  hanging. Fixes #785.

• SendToRx mode, which causes injected packets to be indicated as receives
  instead of sends, can now be enabled per capture handle using the
  pcap_setmode(handle, PACKET_MODE_SENDTORX). Since this feature was
  previously enabled globally via the Registry, user code can now opt out of it
  with pcap_setmode(handle, PACKET_MODE_SENDTORX_CLEAR).

• The Npcap driver now can deliver packet timestamps using nanosecond
  precision. This feature will be made available via the portable libpcap API
  in the next Npcap SDK.

Npcap 1.82

Installer and debug symbols available from https://npcap.com/#download

• Fixed an issue where Npcap 1.81 would incorrectly reject packets as too large
  which had VLAN headers and would be equal to the maximum frame size when the
  header was removed. Fixes #790.

• Fixed an issue where captured frames with an 802.1q VLAN header would have
  the high-order bit of the 802.1p priority always set to 0, so a priority of
  5 would be shown as 1, for instance. Fixes #783.

• Fixed an issue where packets with VLAN tags having a TCI of 0 would not have
  a VLAN tag when captured. Fixes #791.

Npcap 1.81 and SDK 1.15

Installer and debug symbols available at https://npcap.com/#download . Additionally, version 1.15 of the Npcap SDK is also now available.

• Added complete capture support for 802.1q VLAN packets. The 802.1q frame tag
  is usually stripped by NDIS before Npcap encounters it, but Npcap will now
  restore it from the packet metadata if the VLAN ID is not 0. Filtering with the
  "vlan" keyword is also now supported on live captures. The deprecated
  /vlan_support installer option has no impact on this feature. Fixes #171.

• Added support for sending 802.1q VLAN packets. Ethernet frames passed to pcap_sendpacket() or
  pcap_inject() with 802.1q VLAN tags will have those tags converted to NDIS metadata, and the
  NDIS stack will process them appropriately. The adapter must be configured to allow traffic on the
  target VLAN.

• Significantly streamlined packet sending operations, especially for pcap_sendqueue(), removing
  unnecessary copying of packet data. Fixes #555.

• Fixed an issue with the installer where the appropriate code-signing certificates for the
  /prior_driver=yes option were not installed on Windows 7, 8, and 8.1. This could lead to failed
  installations on those versions of Windows.

• Fixed a layout issue in the installer that prevented the full warning from
  being displayed when a Win10Pcap installation is detected. Win10Pcap hasn’t been actively
  maintained since 2015, and we recommend uninstalling it before installing Npcap.

• Npcap now supports the BPF_MOD and BPF_XOR instructions. Previously, pcap
  filter expressions using the % and ^ operators would result in
  less-efficient user-mode filtering.

• The Npcap driver now supports a range of NDIS versions depending on what is
  available at runtime. This will allow us to support newer features like URO
  and hardware timestamping when available, without needing to have separate
  builds for each NDIS version at install time.

Npcap 1.80

Installer and debug symbols available at https://npcap.com/#download

• On ARM64, Npcap now installs ARM64X pure-forwarder DLLs so that Npcap can be used by x86_64
  processes running under emulation as well as x86 and ARM64 processes. Programmers do not need to
  make any special changes to take advantage of this feature. Fixes #585.

• Npcap now supports packet capture on SR-IOV virtual function adapters directly. Some
  manufacturers, such as Intel, were already supported because they use a separate miniport driver
  on top of the virtual function driver. Others that use a virtual function only, such as Broadcom,
  are now supported. Fixes #34.

• Due to Microsoft's deprecation of software publisher certificates with kernel-mode signing
  capability, installations of Npcap on Windows 7, 8, and 8.1 will use the Npcap 1.79 driver by
  default. The Npcap 1.80 driver can be chosen in the GUI and via the /latest_driver=yes
  command-line option if driver signing is disabled in Windows. See #751.

• Addressed faults found with Application Verifier: WSACleanup() was not being called in some
  cases, and in other cases was called from the DllMain() function of wpcap.dll, which Microsoft
  warns may cause deadlocks. Fixes #742.

• Fixed a BSoD crash due to a race condition between NPF_DetachAdapter and
  NPF_Cleanup when closing a capture handle. Fixes #746.

• Upgraded build system to Visual Studio 2022. This version prevents building drivers for earlier
  Windows versions, so the npcap.sys driver for Windows 7 through 8.1 is still built on Visual
  Studio 2019. See #629.

Npcap 1.79

Installer available from https://npcap.com/#download

• Fixed a condition where disabling and re-enabling a network adapter while a
  capture is active would prevent any packets from being received by the system
  until the capture handle was closed. Fixes #710.

• Introduced a workaround for a previously-unknown bug in Microsoft's bthpan.sys that was
  causing BSoD crashes with INVALID_MDL_RANGE when Npcap or other drivers sent packets over
  a Bluetooth-tethered connection. Microsoft intends to patch this Windows bug, but Npcap will
  no longer trigger it regardless of patch status. Fixes #708.

v1.78

Installer available from https://npcap.com/#download

• Fixed a kernel memory leak in Npcap 1.76 and 1.77 which occurs when the kernel buffer is full. This can be triggered by the sparkline graphs in the Wireshark splash screen. Fixes #701.

• Correctly handle an allocation failure during out-of-memory condition, avoiding a null pointer dereference. Fixes #698.

Npcap 1.77

Installer available at https://npcap.com/#download

• Fixed a memory leak in Npcap 1.76 only which occurs while capturing traffic
  at high data rates. Fixes #688.

• Fixed an issue in Npcap 1.76 where packets delivered to the driver by NDIS in
  a single indication, having the same timestamp, would be placed in the packet
  queue in reverse order. Fixes #684.

• Fixed an issue with Npcap 1.75 and 1.76 where changing timestamp modes could
  result in all packets being delivered with the same timestamp. Fixes #695.

• Fixed an issue with the Npcap installer that caused it to install duplicate
  certificates in the system's certificate store, which caused problems for
  some software. The fixed installer will remove the duplicates. Fixes #692.

Npcap 1.76

Installer and symbols available at https://npcap.com/#download

• Our code signing key has been reissued to "Nmap Software LLC" replacing the old "Insecure.Com LLC" subject name.

• Improve performance of the driver by reducing lock contention and consolidating data copy operations. This may help address #663.

• Additional fixes to locking discipline to potentially address a BSoD issue, #679.

Npcap 1.75

Installer available from https://npcap.com/#download

• Fix a critical regression in Npcap 1.74 which caused all captured packets to have the same timestamp. Fixes #668.