Software update: Npcap 1.30

Previously, on the Windows platform, you had to rely on WinPcap when you wanted to capture or edit network traffic. However, its development was completely discontinued in 2013. Nmap, among others, made use of this packet capture library and these developers then started developing Npcap where several improvements can be found in. For example, recent libpcaps are supported, and it can receive or send loopback traffic. Npcap is used by several networking tools today, such as Nmap and Wireshark. The Npcap development team released version 1.00 last year and now update it with 1.30 as the version number. The announcement looks like this:

Npcap 1.30 released

Hi folks.

The Nmap Project is pleased to release Npcap version 1.30 at We hope Nmap and Wireshark users will be especially happy with the raw WiFi improvements, since you tend to be particularly savvy about low-level network inspection. It turns out that some of the issues we thought were caused by lower level hardware drivers were actually bugs in our driver. oops! But at least that means we can fix them ourselves, and we did. This release also includes substantial performance improvements, especially for applications which repeatedly call pcap_findalldevs(). That has been a sore point in the past, so Dan Miller went in and restructured the whole system for better performance. Wireshark starts up noticeably faster. Memory allocations were also optimized by replacing GlobalAlloc() calls with the modern HeapAlloc() system. You can read about all the improvements in this and previous Npcap releases at https://npcap.org/changelog.

Please note that Nmap 7.91 still comes with Npcap 1.00 and Wireshark doesn’t yet have this new Npcap 1.30 either (though they do a terrific job keeping up to date). Fortunately, any Nmap or Wireshark user can get the improvements by just downloading and installing Npcap 1.30 from You don’t need to re-install Nmap or Wireshark themselves. You can check your current Npcap version in “Add/Remove Programs” or run “nmap -V”.

As always, you can download Npcap and its SDK from That page includes details on the Npcap OEM program for commercial use and redistribution too.

Enjoy the new release!

sincerely,
Gordon “Fyodor” Lyon

changelog

• Restore raw WiFi frame capture support, which had been broken in a few ways since Npcap 0.9983. Additional improvements enable PacketSetMonitorMode() for non-admin-privileged processes, allowing Wireshark to correctly enable monitor mode via checkbox without requiring WlanHelper.exe.
• Fixed WlanHelper.exe to correctly set modes and channels for adapters, if run with Administrator privileges. Fixes #122.
• Improved speed of pcap_findalldevs() by using fewer calls to GetAdaptersAddresses() and avoiding direct Registry inspection. The new method may result in more adapters being available for capture than previously reported. See #169.
• Updated Packet.dll to use modern HeapAlloc() allocation, faster than the legacy GlobalAlloc() inherited from WinPcap.
• Improve error reporting from PacketGetAdapterNames() and related functions.