Npcap 1.80

Installer and debug symbols available at https://npcap.com/#download

• On ARM64, Npcap now installs ARM64X pure-forwarder DLLs so that Npcap can be used by x86_64
  processes running under emulation as well as x86 and ARM64 processes. Programmers do not need to
  make any special changes to take advantage of this feature. Fixes #585.

• Npcap now supports packet capture on SR-IOV virtual function adapters directly. Some
  manufacturers, such as Intel, were already supported because they use a separate miniport driver
  on top of the virtual function driver. Others that use a virtual function only, such as Broadcom,
  are now supported. Fixes #34.

• Due to Microsoft's deprecation of software publisher certificates with kernel-mode signing
  capability, installations of Npcap on Windows 7, 8, and 8.1 will use the Npcap 1.79 driver by
  default. The Npcap 1.80 driver can be chosen in the GUI and via the /latest_driver=yes
  command-line option if driver signing is disabled in Windows. See #751.

• Addressed faults found with Application Verifier: WSACleanup() was not being called in some
  cases, and in other cases was called from the DllMain() function of wpcap.dll, which Microsoft
  warns may cause deadlocks. Fixes #742.

• Fixed a BSoD crash due to a race condition between NPF_DetachAdapter and
  NPF_Cleanup when closing a capture handle. Fixes #746.

• Upgraded build system to Visual Studio 2022. This version prevents building drivers for earlier
  Windows versions, so the npcap.sys driver for Windows 7 through 8.1 is still built on Visual
  Studio 2019. See #629.

Npcap 1.79

Installer available from https://npcap.com/#download

• Fixed a condition where disabling and re-enabling a network adapter while a
  capture is active would prevent any packets from being received by the system
  until the capture handle was closed. Fixes #710.

• Introduced a workaround for a previously-unknown bug in Microsoft's bthpan.sys that was
  causing BSoD crashes with INVALID_MDL_RANGE when Npcap or other drivers sent packets over
  a Bluetooth-tethered connection. Microsoft intends to patch this Windows bug, but Npcap will
  no longer trigger it regardless of patch status. Fixes #708.

v1.78

Installer available from https://npcap.com/#download

• Fixed a kernel memory leak in Npcap 1.76 and 1.77 which occurs when the kernel buffer is full. This can be triggered by the sparkline graphs in the Wireshark splash screen. Fixes #701.

• Correctly handle an allocation failure during out-of-memory condition, avoiding a null pointer dereference. Fixes #698.

Npcap 1.77

Installer available at https://npcap.com/#download

• Fixed a memory leak in Npcap 1.76 only which occurs while capturing traffic
  at high data rates. Fixes #688.

• Fixed an issue in Npcap 1.76 where packets delivered to the driver by NDIS in
  a single indication, having the same timestamp, would be placed in the packet
  queue in reverse order. Fixes #684.

• Fixed an issue with Npcap 1.75 and 1.76 where changing timestamp modes could
  result in all packets being delivered with the same timestamp. Fixes #695.

• Fixed an issue with the Npcap installer that caused it to install duplicate
  certificates in the system's certificate store, which caused problems for
  some software. The fixed installer will remove the duplicates. Fixes #692.

Npcap 1.76

Installer and symbols available at https://npcap.com/#download

• Our code signing key has been reissued to "Nmap Software LLC" replacing the old "Insecure.Com LLC" subject name.

• Improve performance of the driver by reducing lock contention and consolidating data copy operations. This may help address #663.

• Additional fixes to locking discipline to potentially address a BSoD issue, #679.

Npcap 1.75

Installer available from https://npcap.com/#download

• Fix a critical regression in Npcap 1.74 which caused all captured packets to have the same timestamp. Fixes #668.

Npcap 1.74

Installer available from https://npcap.org/#download

• Updated libpcap to 1.10.4.

• Fixed an issue (#667) that prevented capture handles from receiving packets after a NDIS stack pause operation.

• Fixed an issue that could cause inaccurate timestamps when multiple handles were open and using different timestamp modes. Fixes #666.

• Fixed an issue preventing raw WiFi frame capture since Npcap 1.60.

• Fixed an issue causing "failed to set hardware filter to promiscuous mode" errors with NetAdapterCx-based Windows 11 miniport drivers. Npcap was interpreting the NDIS spec too strictly; we have opened an issue with Microsoft to address the fault in netadaptercx.sys. Fixes #628.

• Addressed several code readability and portability fixes in Packet.dll discovered using clang-tidy via Visual Studio Code Analysis.

Npcap 1.73

Installer, SDK, and symbols available from https://npcap.com/#download

• Fixed an issue causing "failed to set hardware filter to promiscuous mode"
  errors due to a new code path failing to return appropriate error codes. Fix
  by Guy Harris in PR #656.
  Fixes #628.

• Fixed an issue with WlanHelper causing "error 0x7b" since Npcap 1.70.Fix by
  Hauke Neitzel in PR #652.
  Fixes #649.

• Fixed an issue preventing capture handles from reattaching after NDIS stack
  pause operations, resulting in persistent ERROR_DEVICE_REMOVED (1617)
  errors. Fixes #627.

• Restored original behavior of timestamps in the default case,
  PCAP_TSTAMP_HOST_HIPREC_UNSYNCED/TIMESTAMPMODE_SINGLE_SYNCHRONIZATION.
  Since Npcap 0.9994, the timestamp was resynchronized after NDIS stack pause
  operations, which reduced timestamp drift from wall clock time but made it no
  longer monotonic, making packet interval calculations inaccurate. This
  restores the default behavior of WinPcap.

• Fixed an issue that prevented Npcap 1.71 and 1.72 from being completely
  removed on uninstall. A misconfigured npcap driver service had persisted.
  Fixes #657.

• Fixed an issue where applications using Npcap 1.20 or later DLLs with a Npcap
  1.00 driver would crash due to a stack buffer overrun when the driver returned
  too many bytes in response to a request for timestamp modes. Additionally,
  changed NPFInstall.exe to attempt to uninstall the Npcap NetCfg component
  prior to installation, in case an improperly-uninstalled component persists.

• Updated libpcap to 1.10.3.

Npcap 1.72

Installer and debug symbols available at https://npcap.com/

• Fixed an issue where promiscuous mode or other hardware packet filters are ignored after a second
  handle is opened on the same adapter, including handles opened in the process of listing adapters
  with pcap_findalldevs(). Fixes #647.

• Fixed an issue with validation of parameters to PacketGetNetInfoEx(). The NEntries parameter
  was not being checked for values less than or equal to 0. Fixes #625.

Npcap 1.71

Installer, debug symbols, and SDK available from https://npcap.org/#download

• Increase strictness in checking for and restoring adapter parameters modified during capture:
  hardware packet filter and lookahead will only be modified if the original value can be
  determined. This fixes issues with connectivity on certain adapter types (WWAN and some WiFi
  adapters) after a capture is closed.

• Modify NDIS binding parameters so that Npcap will bind both above and below a NIC teaming or
  network bridge IM driver. This may improve capture options in related situations, like #115.

• Updated build configurations to enable DEP and ASLR for npcap.sys, which were missing from the
  original configs inherited from WinPcap. Additionally, enabled Control Flow Guard for Packet.dll
  and all helper EXEs.

• Fix a BSoD issue on Windows 8.1 due to registering a service without a name. Fixes #565.

• Fix an issue with admin-only mode where high-integrity processes (UAC not enforced) could not open
  or list adapters. Fixes #606.

• Restored an undocumented data member of the struct ADAPTER that is not used internally. Directly
  accessing members of the ADAPTER struct from Packet32.h is highly discouraged, since the
  API in Packet32.h is not intended for use apart from libpcap. Closes #609.

• Extensive refactoring of driver code for performance and maintainability.