How to monitor the windows loopback adapter using sharppcap and npcap?

Question

I have installed the npcap driver, because I want to monitor the windows loopback adapter. However the loopback adapter is not in the SharpPcap CaptureDeviceList.

I see the loopback adapter in Wireshark and Wireshark is able to monitor the loopback adapter.

What should I do to monitor the loopback adapter using SharpPcap?

Answer 1

I have helped you create an issue in their GitHub repo here: https://github.com/chmorgan/sharppcap/issues/15

Please wait for their answers.

Update:

I installed latest Npcap 0.80 with Install Npcap in WinPcap API-compatible Mode option checked and ran the Example01.IfList example in the SharpPcap repo, and the output is:

SharpPcap 4.2.0.0, Example1.IfList.cs

The following devices are available on this machine:
----------------------------------------------------

interface: Name: rpcap://\Device\NPF_{9ADACD44-ECFF-45E2-BD5E-3491DEBA711F}
Description: Network adapter 'NdisWan Adapter' on local host
Flags: 0



interface: Name: rpcap://\Device\NPF_{8A300A14-CA5A-4A3C-B52B-7516661B4CDA}
Description: Network adapter 'NdisWan Adapter' on local host
Flags: 0



interface: Name: rpcap://\Device\NPF_{44DB6B7A-661D-4FA3-925E-6287EA48D3F6}
Description: Network adapter 'NdisWan Adapter' on local host
Flags: 0



interface: Name: rpcap://\Device\NPF_{F0353155-69D0-4611-AB2A-EE864BE0ADD9}
FriendlyName: Local Area Connection* 19
GatewayAddress: 0.0.0.0
Description: Network adapter 'Microsoft' on local host
Addresses:
Addr:      fe80::cd59:f5d:81cb:989d
Netmask:
Broadaddr:

Addresses:
Addr:      fe80::cd59:f5d:81cb:989d
Netmask:
Broadaddr:

Addresses:
Addr:      HW addr: E094678FFF3F

Flags: 0



interface: Name: rpcap://\Device\NPF_{385F30D0-9166-45D3-BBC6-F1D9C5300AF9}
FriendlyName: Wi-Fi
GatewayAddress: 192.168.0.1
Description: Network adapter 'Microsoft' on local host
Addresses:
Addr:      fe80::eddc:63ca:cf19:aecd
Netmask:
Broadaddr:

Addresses:
Addr:      192.168.0.109
Netmask:   255.255.255.0
Broadaddr: 0.0.0.0

Addresses:
Addr:      HW addr: E094678FFF3E

Flags: 0



interface: Name: rpcap://\Device\NPF_{1E6769B9-ED4A-454D-A921-EECDA220ADA1}
FriendlyName: Npcap Loopback Adapter
GatewayAddress: 0.0.0.0
Description: Network adapter 'MS NDIS 6.0 LoopBack Driver' on local host
Addresses:
Addr:      fe80::b1cb:57f6:4ebc:6359
Netmask:
Broadaddr:

Addresses:
Addr:      0.0.0.0
Netmask:   255.0.0.0
Broadaddr: 255.255.255.255

Addresses:
Addr:      HW addr: 02004C4F4F50

Flags: 1



Hit 'Enter' to exit...

So obviously the last adapter is the Npcap Loopback Adapter. I don't know why the user cannot monitor the Npcap Loopback Adapter using SharpPcap. I will reply to him about my feedback in Stackoverflow.

I can think of two possible causes:

1. The user doesn't select the Support loopback traffic ("Npcap Loopback Adapter" will be created) option when installing Npcap.
2. The user has WinPcap installed too, and Npcap is installed with Install Npcap in WinPcap API-compatible Mode option unchecked. In this way, SharpPcap can only recognize WinPcap and use the original WinPcap DLLs, which doesn't support Npcap Loopback Adapter at all.

My suggestions are:

1. Uninstall WinPcap if it is installed.
2. Install latest Npcap 0.80 with Support loopback traffic ("Npcap Loopback Adapter" will be created) and Install Npcap in WinPcap API-compatible Mode options both checked.

Now the user should be able to see the Npcap Loopback Adapter through the SharpPcap interface.