WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.

WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API.


Thursday, September 20, 2007

Check the dll file from winpcap

How to check the dll file and their revision.

Check if you have any copy of packet.dll or wpcap.dll under
c:\windows\system32. If so, right-click on the file, click on properties,
Version tab. Let me know the version of the file.

Check npf.sys under c:\windows\system32\drivers? If it is the Same version?


Ok, some third party app probably installed WinPcap 3.1beta4 or parts of it,
and it's currently using it (that's why the installer for WinPcap 3.1 cannot
remove it).

I would suggest you to find out which app installed WinPcap 3.1beta4 (I
suppose that there's no WinPcap item under Control Panel ->Installed
Applications, right?).

Otherwise, a solution that *might* work is this one:

1. delete npf.sys from windows\system32\drivers
2. reboot the machine
3. try to delete windows\system32\packet.dll
4. If 3) succeeds, install WinPcap 3.1.