The current latest installer can be found here:, the source code can be found here: When installed on Windows XP or earlier, it will install the legacy WinPcap driver. When installed on Windows Vista or later (including Win7, Win8 and Win10) with option 'Support loopback traffic ('Npcap Loopback Adapter' will be created)' selected, it will create an Npcap Loopback Adapter that can be selected in Wireshark so as to capture IPv4/IPv6 loopback traffic. 1) NDIS 6 SupportĤ) Loopback Packets Capture and Send Support (either as fake Ethernet or Null/Loopback frames)ĥ) Raw 802.11 packets Capture Support (in 'monitor mode') Npcap has added many features compared to the legacy WinPcap. Npcap is an update of WinPcap using NDIS 6 Light-Weight Filter (LWF), done by Yang Luo for Nmap project during Google Summer of Code 20.

Windows Starting from Windows Vista: Npcap

Summary: you can capture on the loopback interface on Linux, on various BSDs including macOS, and on Digital/Tru64 UNIX, and you might be able to do it on Irix and AIX, but you definitely cannot do so on Solaris, HP-UX, or Windows. See CaptureSetup/NetworkMedia for Wireshark capturing support on various platforms. You will only see it if you capture on the 'loopback interface', if there is such an interface and it is possible to capture on it see the next section for information on the platforms on which you can capture on the 'loopback interface'. This means that you will not see it if you are trying to capture on, for example, the interface device for the adapter to which the destination address is assigned. If you are trying to capture traffic from a machine to itself, that traffic will not be sent over a real network interface, even if it's being sent to an address on one of the machine's network adapters.

The following will explain capturing on loopback interfaces a bit.

Wireshark windows monitor mode