[Winpcap-users] WinPCap on Vista

Bryan Kadzban bryan at kadzban.is-a-geek.net
Wed Sep 12 21:40:19 GMT 2007

Hash: RIPEMD160

Ioan Popescu wrote:
> I know that to use Wireshark (or any WinPCap-based app) on Vista, it 
> must be "run as administrator" when starting it.
> My question is this: Why?

Having never actually run Vista, all I can do is guess.  However, my
guess would be that the problematic action is either "starting the npf
driver", or "talking to the NPF driver through the virtual device file
that it provides".

If the problem is starting the driver, then only the first program to
talk to wpcap.dll would need to be elevated, and starting the driver at
boot time (which the current Wireshark setups should give the option to
do) would be a workaround.  If the problem is talking to the driver via
its device, then any program that uses wpcap.dll at any point would need
to be run in elevated mode.

(It's also possible that the problem is something completely different,
in which case none of this applies.)
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


More information about the Winpcap-users mailing list