This Manual describes the programming interface and the source code of Npcap. It provides detailed descriptions of the functions and structures exported to programmers, along with complete documentation of the Npcap internals. Several tutorials and examples are provided as well.
You can follow the links at the top of this page or use the tree control at the left to reach sections of interest.
This documentation was created using the Doxygen documentation system, that can be found at http://www.doxygen.org.
Npcap is library for packet capture and network analysis for the Win32 platforms.
Most networking applications access the network through widely used operating system primitives such as sockets. It is easy to access data on the network with this approach since the operating system copes with the low level details (protocol handling, packet reassembly, etc.) and provides a familiar interface that is similar to the one used to read and write files.
Sometimes, however, the 'easy way' is not up to the task, since some applications require direct access to packets on the network. That is, they need access to the "raw" data on the network without the interposition of protocol processing by the operating system.
The purpose of Npcap is to give this kind of access to Win32 applications; it provides facilities to:
This set of capabilities is obtained by means of a device driver, which is installed inside the networking portion of Win32 kernels, plus a couple of DLLs.
All these features are exported through a powerful programming interface, easily usable by the applications and available on different OSes. The main goal of this manual is to document this interface, with the help of several examples. If you are interested in starting your exploration right away you can go directly to the Npcap user's manual.
The Npcap programming interface can be used by many types of network tools for analysis, troubleshooting, security and monitoring. In particular, classical tools that rely on Npcap are:
Npcap receives and sends the packets independently from the host protocols, like TCP/IP. This means that it isn't able to block, filter or manipulate the traffic generated by other programs on the same machine: it simply "sniffs" the packets that transit on the wire. Therefore, it does not provide the appropriate support for applications like traffic shapers, QoS schedulers and personal firewalls.
The purpose of this manual is to provide a comprehensive and easy way to browse the documentation of the Npcap architecture. You will find two main sections: Npcap user's manual and Npcap Internals.
The first one can be used by a programmer who needs to use Npcap from an application: it contains all the information about functions and data structures exported by the Npcap API, a manual that explains how to write packet filters and a page that explains how to include it in an application. A tutorial with several code samples is provided as well; it can be used to learn the basics of the Npcap API using a step-by-step approach, but it also offers code snippets that demonstrate advanced features.
The second section is intended for Npcap developers and maintainers, or for people who are curious about how this system works: it provides a general description of the Npcap architecture and explains how it works. Additionally, it documents the complete device driver structure, the source code, the Packet.dll interface and the low-level Npcap API. If you want to understand what happens inside Npcap or if you need to extend it, this is the section you will want to read.
For additional and up-to-date documentation, we suggest that you look at http://nmap.org/npcap/guide/